When a control failure is identified, the question immediately becomes how long it existed and who was affected. A lookback answers it.
Scope decisions. The period, the populations, the products and the geographies. Each should be justified by evidence about when the failure began and what it touched, not by convenience.
Sampling versus full population. Statistically valid sampling is acceptable for many purposes and must be designed by someone competent to do so, with the methodology, confidence level and error tolerance documented. Where remediation to individuals is required, full population review is usually necessary.
Data quality. Most lookbacks are delayed by the discovery that historical data is incomplete or inconsistent between systems. Assess data availability before committing to a timetable.
Governance. A steering group, a defined methodology document approved before work begins, and periodic reporting. Changes to methodology mid-review must be documented and justified, because they will be questioned.
Regulator engagement. Where a regulator is involved, agreeing the scope and methodology in advance avoids the worst outcome, which is completing a large review and being told to redo it.
Remediation. Customer redress calculations, interest, communications, and a process for those who cannot be located.
Cost. Lookbacks frequently cost more than the underlying issue, which is the strongest argument for detecting failures early.