How To Get Issues Management Right

Every bank suffers lapses in controls and compliance. The difference between a contained hiccup and a regulatory red flag, though, can come down to how those issues are identified, tracked, and resolved. In a recent RMA webcast, Andrew Mansholt, senior risk analyst at Wintrust Financial, laid out a practical path for building a stronger issues management framework. 

Start Early—and Make It Safe To Speak Up 

Mansholt stressed the importance of early detection: “The sooner that an issue is identified, the easier it is to contain and to resolve before it escalates.” But early reporting requires trust. Creating a “safe harbor” period—where audit holds off on penalties for self-identified issues—can encourage employees to speak up sooner. 

Keep It Formal—and Centralized 

Avoid ad hoc tracking methods. “Don’t track some issues in a GRC tool and then some in an Excel spreadsheet,” Mansholt warned. Inconsistent processes can lead to missed deadlines and repeat issues. A formal, centralized system helps ensure transparency, consistent reporting, and timely resolution. 

Link to RCSAs—and Escalate When Needed 

Issues and actions often flow directly from the risk and control self-assessment process, especially for high residual risks. Tracking these in the same system supports better coordination across risk teams. And when similar issues arise across the enterprise, they may warrant escalation to risk committees and senior executives for further review. 

Get Your Second Line Involved 

While the first line owns most issues and resolutions, the second line plays a critical oversight role. “The closure is not really finalized until there's an independent second line of defense [that] also views that issue and confirms that, yes, it was resolved,” Mansholt said. 

Recognize What Goes Right, Not Just What Goes Wrong 

A healthy risk culture isn’t just about avoiding blame—it’s about rewarding transparency. “Blaming tends to shut down any hope of future self-identified issues,” Mansholt said. Recognizing teams that flag and fix problems early can reinforce the behavior you want to see. 

Bottom Line 

Strong issues management isn’t just about fixing what’s broken—it’s about creating a structure that supports speed, accountability, and risk awareness across the bank, Mansholt said. And with the right mindset and tools, even small teams can make a big impact.