Part 5 of the ACH Origination Maturity Series
In this ACH Origination Maturity Series, we have looked at how ACH programs outgrow controls, how warning signs surface, what risk assessments reveal, and why Exposure Limits can become disconnected from changing customer activity. Each topic points back to the same larger question: does the ACH program still have the structure, visibility, and discipline needed to support the activity it carries today?
This final article turns to something less technical, but just as important: people.
Every financial institution has someone like this. They may not have the most senior title. They may not manage the largest team. Their name may not appear on the organizational chart in a way that reflects their true influence.
But everyone knows who they are.
They are the person people call when something does not look right, when an unusual return appears, when an Originator asks a complicated question, when an auditor requests documentation, when a report does not make sense, or when a process that rarely happens suddenly needs to happen.
Someone inevitably says, “Let’s ask Susan.” Or Mark. Or Jennifer. Or whichever person happens to be carrying years of operational knowledge inside their head.
Every institution has a version of this person, and there is a good chance they are one of the reasons the ACH program runs as smoothly as it does. The problem is not their expertise. The problem is what happens when the institution begins confusing that expertise with a control.
Operational resilience is increasingly recognized as a critical component of ACH risk management. In addition to system availability and vendor resilience, institutions should consider whether important ACH processes can continue if key personnel are unavailable. FDIC ACH Core guidance includes business continuity, disaster recovery, incident response, organizational structure, personnel responsible for ACH activities, and training programs among areas considered in ACH supervision and review. NPG’s own ACH Risk Assessment methodology also includes operational resilience as part of its assessment structure.
In that sense, knowledge concentration is not simply a staffing concern. It is a risk-management concern.
The Difference Between What We Know and What We Depend On
One of the most interesting conversations I have during ACH risk assessments does not involve return rates, Originator monitoring, or fraud controls. It starts with a different question: if this person were not here tomorrow, what would happen?
Almost nobody answers immediately. The room gets quiet, and then the responses begin. Someone would have to figure out how a process works. Someone is not sure who else understands a particular report. Someone realizes that only one employee knows why something is done a certain way.
What is interesting is that institutions often already know where the dependency exists. What they underestimate is the risk that comes with it. As long as the person remains in place, the vulnerability stays hidden. The program works. Reports get completed. Questions get answered. Customers are supported. It feels stable.
Until something changes.
The Vacation Test
One simple way to understand knowledge concentration risk is to think about vacations. Not retirement. Not resignation. Not an emergency. Just a vacation.
Imagine your primary ACH expert is going to be out for two weeks. What happens before they leave? Do people begin asking questions they have been postponing? Are notes created? Are instructions distributed? Are meetings scheduled? Do staff suddenly realize there are processes they are not entirely comfortable performing?
Those reactions often reveal more about operational resilience than any organizational chart.
The question is not whether someone could eventually figure out the process. The question is whether the institution can continue operating confidently without relying on one person as the source of critical knowledge.
The Process That Nobody Fully Understands
Most institutions have processes that have existed for years. At one point, each decision made sense. A report was created because a specific risk existed. An approval step was added after an issue. An exception review was implemented for a reason.
Over time, those decisions become routine. The process survives, but the reason behind it fades. Then the employee who remembers the original reason retires, changes roles, or moves on. What remains is a process everyone follows, but no one fully understands.
That is not just a documentation issue. It is a governance issue. Controls are most effective when people understand not only what they are doing, but why they are doing it.
Organizational Knowledge Is Different From Individual Knowledge
One of the strongest ACH programs I have reviewed was not remarkable because of its technology, team size, or sophisticated monitoring. What made it stand out was how intentionally knowledge was shared.
Multiple employees understood critical processes. Documentation reflected actual operations. Cross-training was embedded into normal management practices. Questions were not directed to one person because several people knew the answer.
The institution had converted individual knowledge into organizational knowledge.
That approach supports more than continuity. It strengthens training, improves succession planning, enhances audit readiness, and reduces the likelihood that critical decisions, controls, or operational practices become dependent on institutional memory alone. FDIC ACH Core guidance specifically includes employee training, personnel responsible for ACH activities, and business continuity considerations among areas relevant to ACH risk review.
That distinction matters. Individual knowledge leaves with people. Organizational knowledge stays.
Final Thoughts
Every ACH program benefits from experienced professionals. Their judgment, knowledge, and perspective are invaluable. But experience and expertise were never meant to function as controls.
Controls are designed to remain effective even when people change roles, retire, take vacations, or pursue new opportunities. People strengthen a program. People improve a program. People help a program evolve. But people are not controls.
One of the most revealing questions any institution can ask is this: if our ACH expert were not here tomorrow, what would we wish we had done sooner?
The answer often reveals more about the strength of an ACH program than any audit, report, or checklist.
That is ultimately the thread running through this ACH Origination Maturity Series. ACH risk rarely appears all at once. It develops through growth, assumptions, outdated documentation, unchanged limits, familiar relationships, and knowledge that becomes too concentrated to see clearly.
The strongest institutions are the ones willing to notice those risks early — and address them before they become findings, losses, or operational challenges.
Concerned About Knowledge Concentration Risk?
Some of the most significant ACH risks are not compliance issues or technology issues — they are operational risks that develop when critical knowledge is concentrated in too few places.
NEACH Payments Group helps financial institutions evaluate operational resilience, strengthen ACH program governance, and identify areas where key-person dependencies may create unnecessary risk.
Let’s start with a conversation.
Call 781-321-1011 or email info@neachgroup.com.