Often, we find ourselves in the cliche trap of spending 90 percent of our time and resources on 10 percent of the problems. This is also true of compliance programs where the singular, often more interesting case, alert or investigation, pulls a disproportionate amount of focus from the overall risk picture.