Recording reviews and opening investigations

After analyzing the trading activity, you are ready to begin reviewing the clusters to determine whether additional investigation is needed. During the review process, TT Trade Surveillance lets you attach notes to individual clusters and to daily cluster groups to record your dispositions. To provide traceability, TT Trade Surveillance maintains a historical record of all notes that are added to a cluster or cluster group.

Reviewing clusters and cluster groups

In TT Trade Surveillance, you can review clusters or cluster groups and provide disposition comments of your review. For clusters with higher risk scores, you can examine the behavior more closely and create notes of your findings. When reviewing clusters with lower scores, you can simply add a note that the cluster has been reviewed.

Reviews can be started from the Cluster List view.

To review clusters and cluster groups:

1. Display the Cluster List view for the selected dates and models.

   

2. Click anywhere in the cluster (or cluster group) row to view the Cluster Scorecard.
3. Evaluate the cluster details in the scorecard then click Review Cluster.

   

   The Review panel appears at the left.
4. Enter notes in the Review panel and click Add Note.

   

   If you click View Individual Clusters at the top of the scorecard, the Reviewed column now shows true to indicate the cluster has been reviewed.

   

You have successfully reviewed a cluster. If suspect that a cluster or cluster group requires more detailed analysis, you can begin an investigation of the cluster.

Creating a bulk review

The cluster list and group views also provide you with the ability to mark all clusters for the selected model and dates as being "reviewed". You can then conduct further investigations of each cluster as needed.

To create a bulk review:

1. Display the Cluster List or Daily Cluster Groups view for the selected dates and models.

   

2. Click Bulk Review in the upper right corner of the cluster list or group view.

   

3. Add notes to the bulk review dialog box as needed and click Review.

   

   All clusters for the selected data are marked as "Reviewed".

Adding cluster reviews to an investigation

After reviewing various clusters or cluster groups, you might determine that more investigation or follow-up is required. If so, you can open an investigation from a review or add your reviews to an existing investigation. Using investigations lets you create dispositions for problematic trading activity that occurs across multiple clusters or even across multiple traders and accounts.

To start an investigation into a cluster or cluster group:

1. Start a review for a cluster or cluster group.
   As you can see, the notes you previously entered are now a part of the cluster's review history.

   

2. In the Type Investigation Name field, enter a name for the investigation and click Create New Investigation.

   

   Alternatively, you can select an existing investigation and click Add to Existing Investigation to add this review to the investigation.
   The investigation is added to the Investigations page. You can access this page via the TT Trade Surveillance dashboard.

   

You have successfully added a cluster review to an investigation.

Managing investigations

From the TT Trade Surveillance Dashboard, you can view existing investigations. Within each investigation report you can track the investigaton's progress, assign a different owner to manage the investigation, and add comments or a final disposition with attachments.

To manage an investigation:

1. Click the Investigations tab at the top of the screen.
2. Click View Investigation in the "Action" column for an investigation.

   

   The investigation details appear.

   

   The following sections are included on this screen:

   • Clusters and Daily Group Clusters: Lists the clusters and cluster groups being investigated.
   • Status: Shows a list of state changes, and allows you to change the status.
   • Owner: Shows a list of owners who can be assigned to the investigation, and allows you to change owners.
     Note: Only users with TT Trade Surveillance Administrator permissions are listed in the owner selector.
   • History: Shows the full history of investigation activity, including who created the investigation.
   • Comment: Shows a history of comments added to the investigation, and allows you to add comments or a final disposition and upload attachments.
     Note: A previously added comment cannot be edited or deleted. To address a previously added comment, you must add a new one.
3. To display the Clusters and Daily Cluster Groups that are included in the investigation, click Clusters or Daily Cluster Groups, respectively.
4. To change the investigation status, select the new status from the Status dropdown.

   

5. To change the owner of the investigation, select the desired person from the Owner dropdown.
6. To add comments or upload attachments, use the Comment section.

   

7. After making changes to the investigation, click Save.

You have succesfully managed changes to an investigation.