The hidden cost: The manual middle

Most teams have already digitised checks. Results come back faster, files live in the right place, and the platform does what it says on the tin.

But there’s a catch: a lot of the work is still manual. Someone reviews a clear result, ticks a box, moves a case along, updates a status, sends the next email. Then does it again. And again.

That isn’t control. It’s process debt.

Process debt: When the tool improves but the workflow doesn’t

In software, technical debt builds up when yesterday’s “good enough” decisions become today’s bottleneck. Compliance has its own version. You’ve modernised the checks, but you’re still running the same old workflow around them.

The signs are familiar:

  • The check finishes quickly, but the case sits waiting for someone to act.
  • Two people make slightly different calls on the same “simple” outcome.
  • Audits prove a step happened, not that it happened consistently.

The technology to run checks digitally is mature. Identity verification, criminal record checks, right to work, employment referencing – all requested, completed, and returned through a platform. That’s genuine progress.

Digitisation solved the speed of individual checks. It didn’t solve the overhead of managing them. That’s process debt. And like technical debt, it compounds.

The illusion of control

Manual processes can look like diligence. A person reviews every case. Boxes get ticked. If something goes wrong, there’s comfort in saying: we followed the process.

But that’s comfort, not control.

Manual steps introduce variability:

  • Different reviewers interpret the same policy differently.
  • Attention drops as volume rises.
  • Steps get missed.
  • Urgent cases wait in the same queue as routine ones.

Then there’s the audit argument. Many teams keep people in every step because they need to prove what happened.

The problem is that a manual audit trail usually shows that a person did something. It doesn’t reliably show what criteria they applied, whether it matched policy, or whether it was consistent across hundreds of cases. It’s a record of activity, not a record of rigour.

A well-designed automated process logs the rule, the input, the outcome, and the timestamp – every time. When something doesn’t match and needs escalation, that’s logged too. The audit trail becomes clearer and it’s meaningful.

Scale exposes the trade-off: either the audit trail is too thin to trust, or it’s so heavy it slows everything down.

What scaling (usually) breaks

At low volume, manual workflows can work. A small team keeps things moving through experience and good habits. Cracks get patched informally – someone remembers, someone stays late.

As volume climbs, the workarounds stop working. The team that could keep on top of 200 cases a month can’t push through 2,000 in the same way. You can add headcount, but it only buys time – because every new person still has to learn the same manual steps and rely on the same stretched, unwritten know-how.

This is usually the point it becomes obvious the process wasn’t built to scale. It was just coping – doing fine right up until it hit its ceiling. And because it “worked”, nobody had a reason to redesign it.

Now there is. More checks. Tighter rules. Faster hiring cycles. More scrutiny on how data is handled. The manual approach doesn’t just get slower – it hits a hard limit. The question isn’t if it starts to creak. It’s when.

The hidden cost: Dead time

There’s another delay most teams don’t track: how long the work sits waiting for someone to be free to move it on.

A result lands at 6pm and gets picked up tomorrow. A case is ready to progress, but the reviewer is in back-to-back meetings. Someone’s on leave, so their queue just stops.

The check isn’t the problem – that part finished in minutes. The time gets lost in the gap between “ready” and “someone can act”.

In recruitment, that dead time costs you. Every extra day a candidate sits in a compliance queue is another day they could accept a different offer. Time to hire isn’t just an efficiency metric – it’s a competitive one. And compliance is often where the most avoidable delays pile up.

Automation closes that gap. If the result meets the criteria, the process moves immediately – at 6pm, at 2am, on a bank holiday. Think of it less as replacing the team and more as giving the team always-on coverage for the predictable steps, so people can focus on the work that actually needs judgement.

Rethinking the role of people

Keeping people involved is the right instinct. Compliance has real consequences for real people.

But “human in the loop” shouldn’t mean a human has to touch every step. It should mean people do the work that actually needs context and judgement.

Reviewing a flagged criminal record check against role requirements – that’s a decision which needs context, experience, and judgement. Confirming a clear result matches a policy that says clear results are approved – that’s a procedure.

Most workflows treat both the same. Everything gets the same manual handling, whether it needs it or not. Compliance professionals end up spending time on routine admin, and the genuinely tricky cases have to fight for attention in the same queue.

The aim isn’t to take people out. It’s to put expertise where it matters most. Routine procedures don’t need a person – they need a policy, applied consistently, every time.

The question to ask

Most organisations don’t rethink compliance until they have to – volume they can’t hire their way out of, or a regulatory shift their manual workflow can’t stretch to meet.

The ones that move first do it for a simpler reason. They’ve clocked something uncomfortable: the process they trust isn’t reliable at scale. It’s familiar. It feels safe. It’s “how we’ve always done it”. But familiarity isn’t a strategy. And “we’ve always done it this way” isn’t reassurance – it’s a warning sign.

Digitisation was never about running the same manual process on better software. It was about making a better process possible. The organisations that act won’t just shave time off the edges. They’ll build compliance that holds up under pressure: clear, consistent, and confident, even when volume keeps rising.

See the latest blogs & articles from our team

2026-03_integrations-interoperability
Client onboarding

From connected checks to connected businesses

questions_header
AML

Four questions every MLRO should ask their identity verification (IDV) provider

mlr-dvs-update_article-post
AML

New Digital Identity guidance: why “suitable” is just the starting line