The penalty letter was the lucky one

The letter arrives on a Tuesday. A filing that was supposed to go in automatically didn't, and now there is a penalty, a deadline to fix it and an awkward conversation with the board.

It feels like the worst thing that happened this quarter. It probably wasn't. It was the one failure somebody outside the business noticed and wrote to you about.

This post is for the week after that letter. How the filing slipped will get fixed. The better question is what else has stopped at some point, in a place where nobody outside is counting, and so nobody is going to write.

Why the letter was lucky

A statutory filing has someone on the other side keeping score. There is a deadline, a register and a team whose job is to chase anyone who misses it. When the job that sends the filing stops, you find out within weeks, in writing, with a date at the top.

Most of the work your systems do on their own has nobody keeping score.

Every night, somewhere in the business, there are jobs that delete records you no longer need, check new customers against the sanctions list, copy your data to a backup and send figures to another company's system. Nobody outside is waiting for any of them. If one stops, there is no letter. There is just silence, and silence looks exactly like everything working.

So the penalty letter is a warning about what doesn't come with a letter. If one automated job could stop without anyone inside noticing, the same thing can happen to the jobs that nobody outside is watching either.

The jobs nobody writes to you about

Here are the ones that matter most in a regulated business, with who would notice if they stopped and roughly when. Print it and take it to your next team meeting.

Only the first row comes with a letter. That's why it gets fixed fastest.

Why your systems say everything is fine

You'd expect a broken job to show up as an error. Most of the time it doesn't.

The tools that watch your systems are built to spot things going wrong: a crash, a failed connection, an error message. A job that never starts doesn't crash. It produces no error, so there is nothing for the alerts to catch. The dashboard stays green, because a green dashboard means "nothing reported a problem". It doesn't mean "everything that was supposed to happen, happened."

That is what we mean by a silent failure: a process that reports success, or reports nothing at all, and hasn't done the work.

Sanctions screening is the clearest example. When the check runs and finds nobody on the list, the report says zero matches. When the check doesn't run at all, the report also says zero matches, or there is no report and nobody misses it. Most days, "no matches" is the answer everyone hopes for, so nobody looks twice. Eleven weeks of a stopped check and eleven weeks of good news can look the same from the finance office.

Deletion has the same problem the other way round. When the job that removes old records stops, nothing breaks. The data just stays. Nobody complains about data that is still there, right up until a customer asks why you still have it.

The rules don't care that nobody told you

For the jobs in that table, nobody being told is not much of a defence.

Under UK GDPR, you must not keep personal data in a form that identifies people for longer than you need it. That is the storage limitation principle in Article 5. People also have a right to ask you to erase their data in many circumstances, under Article 17. A retention policy that says "we delete after six years" only helps if something actually deletes after six years. If the job stopped in 2023, the policy describes what you meant to do. It doesn't describe what you did.

Sanctions are stricter. For breaches on or after 15 June 2022, OFSI (the part of the Treasury that enforces financial sanctions) no longer has to show that you knew, or had reason to suspect, you were dealing with someone on the list before it can impose a civil penalty. What you knew is now only one of the factors it weighs. The maximum penalty is £1 million, or half the value of the money or assets involved if that is more. OFSI's own guidance says it will look at the controls and systems you had in place and whether they were proportionate to the risk you faced.

A screening job that quietly stopped running is a control you thought you had. The question an investigator will ask is how you would have known.

What to ask your team this week

You don't need to be technical to do this. You need to ask plain questions and notice when the answer is vague.

1. Did anything else stop when the filing stopped? Jobs often fail together: same server, same software update, same person who left. Ask what else ran in the same place.
2. Which of our automatic jobs would someone outside notice if they stopped, and which would nobody notice? Go down the table above. The second list is the one that matters.
3. For each job on that second list, how would we know it ran last night? Ask to be shown, not told. A good answer is something you can see: a short message every morning saying the job ran and how many records it handled, and a named person who chases it when the message doesn't come.
4. When a report says "nothing found", could that also mean "didn't run"? If nobody can tell the difference, you have found your first gap.
5. Who owns each job now? If the answer is the person who set it up three years ago and has since left, it isn't owned.

Answers that should worry you: "It's automated." "We'd get an error." "IT handles that." None of them is wrong exactly. None of them tells you whether the job ran.

Answers that should reassure you sound like a record: "It ran at 2am, it checked 214 new customers, it found none on the list, and here's last night's report." If your team can show you that for every row on the second list, the letter really was a one-off.

The letter is the start of the list

The penalty is annoying, but it did its job. Something outside the business noticed a gap and told you. Most of the gaps in that table will never be reported that way. They wait until an auditor, a regulator or a customer goes looking.

If you can't say how you would find out that one of those jobs had stopped, that is what a Silent Failure Audit answers: five days, a fixed fee, and a written list of every job that runs without anyone watching, whether it ran, and whether it produced anything. If everything is running, that's what the report will say. You can also see worked examples of what the findings look like before you decide.

Sources and references

• UK GDPR, retained Regulation (EU) 2016/679 (full text). Articles 5(1)(e) and 17 cited.
• ICO, Principle (e): Storage limitation (guidance) and Right to erasure (guidance).
• Policing and Crime Act 2017, section 146, as amended by the Economic Crime (Transparency and Enforcement) Act 2022 (full text).
• OFSI, Financial sanctions enforcement and monetary penalties guidance, updated 9 February 2026 (guidance).

Sources verified on 2026-10-22. This post does not constitute legal advice.