How CUSUM Sequential-Detection Algorithms Find Small Persistent Shifts: Reference Values, Control Limits, Average Run Length, Residual Monitoring and False Alarms

Reader question: If a model or banking process starts drifting only a little at a time, how can an algorithm detect the change before the deviation becomes visually obvious?

CUSUM, short for cumulative sum, is a sequential change-detection method. Instead of judging each new observation in isolation, it accumulates small pieces of evidence in the same direction. Repeated mild deviations can therefore trigger an alarm even when no single observation looks extreme.

This article owns the small persistent shift-detection problem: a baseline model + a stream of observations or residuals + a target shift + a false-alarm tolerance → recursive cumulative statistics, alarm times, run-length diagnostics and evidence about whether the underlying process has changed.

It does not own general model redevelopment, population-stability indices, offline structural-break estimation or fraud classification. Those are separate jobs. The purpose here is to show how sequential evidence accumulation works mathematically and why false-alarm calibration is as important as sensitivity.

This is public mathematical and computational education. It is not a live alert about any bank, market or financial institution.

1. Why a Shewhart-style one-point rule can miss small changes

Suppose a monitored residual has baseline mean zero and standard deviation one. After a change, the mean shifts to +0.4.

A single observation from the shifted process still looks ordinary most of the time. A rule that alarms only when an observation exceeds three standard deviations may wait a long time.

CUSUM instead asks whether many observations are collectively leaning in one direction.

The key idea is:

small evidence + small evidence + small evidence → detectable cumulative evidence.

2. Standardise the monitored quantity

Let the observation be X_t. Under the baseline model, suppose the expected mean is μ₀ and standard deviation is σ.

Define a standardised deviation:

z_t = (X_t − μ₀)/σ.

If the baseline is correct and observations are appropriately modelled, z_t should fluctuate around zero.

In financial applications, X_t might instead be a forecast residual, calibration error, loss-rate residual or another controlled diagnostic. The baseline should be the quantity that is expected to remain stable, not merely the raw level of a nonstationary series.

3. The one-sided upper CUSUM

A common standardised upper CUSUM is:

C_t⁺ = max[0, C_t−1⁺ + z_t − k].

Here:

• k is the reference value;
• the statistic resets to zero when evidence for an upward shift disappears;
• an alarm is raised when C_t⁺ > h, where h is the decision or control limit.

Subtracting k means tiny positive deviations are not accumulated without cost. The observation must, on average, exceed the reference value for the statistic to grow persistently.

4. The lower CUSUM detects negative shifts

A corresponding lower statistic can be written:

C_t⁻ = max[0, C_t−1⁻ − z_t − k].

An alarm occurs when:

C_t⁻ > h.

Running both statistics produces a two-sided detector: one side looks for persistent upward movement and the other for persistent downward movement.

5. The reference value k defines the shift the detector cares about

In the textbook normal-mean case with known variance, if the target standardised mean shift is δ, a common design is:

k = δ/2.

For a one-standard-deviation target shift, k = 0.5. For a half-standard-deviation shift, k = 0.25.

This does not make k a universal constant. It follows from a particular likelihood-ratio design under a specified model.

Weak link: choosing k without defining the target shift makes the detector’s sensitivity hard to interpret.

6. The decision limit h controls the false-alarm versus delay trade-off

A small h produces quicker alarms but also more false alarms under the baseline process.

A large h reduces false alarms but takes longer to detect a real change.

Therefore CUSUM design is not “pick a threshold that feels large.” It is a calibrated trade-off between:

• in-control false-alarm frequency;
• out-of-control detection delay.

7. Average Run Length makes the trade-off measurable

The Average Run Length, or ARL, is the expected number of observations before an alarm.

ARL₀ refers to the baseline or in-control process. A larger ARL₀ means fewer false alarms.

ARL₁ refers to a specified changed process. A smaller ARL₁ means faster detection.

A useful CUSUM design therefore reports both. A detector that finds a 0.5σ shift in three observations but falsely alarms every ten observations is not necessarily useful.

8. A worked recursive example

Suppose:

k = 0.5, h = 4.

Start with:

C₀⁺ = 0.

Now observe standardised residuals:

0.7, 0.8, 0.9, 1.0, 0.6, 1.1.

The first updates are:

C₁⁺ = max(0,0+0.7−0.5)=0.2

C₂⁺ = 0.2+0.8−0.5=0.5

C₃⁺ = 0.5+0.9−0.5=0.9.

No single residual is alarming. But the cumulative statistic keeps rising because the residuals consistently exceed the reference value.

If later residuals become negative, the max-with-zero rule can erase accumulated evidence. This prevents ancient weak evidence from contaminating the detector forever.

9. The log-likelihood-ratio form shows the general principle

Page’s CUSUM can be written more generally using a log-likelihood ratio.

If f₀(x) is the baseline density and f₁(x) is the changed density of interest, define:

Y_t = log[f₁(X_t)/f₀(X_t)].

Then:

S_t = max(0, S_t−1 + Y_t).

Alarm when S_t crosses a threshold.

This form explains the method: every new observation contributes evidence for the alternative versus the baseline. Evidence in the wrong direction resets the running score.

10. Monitoring raw financial series is usually a mistake

Prices, spreads, balances and loss rates can trend, seasonally vary or respond to known covariates. Applying a stationary CUSUM directly to such a series can generate alarms simply because the baseline model is incomplete.

A better design often monitors residuals:

e_t = observed_t − predicted_t.

If the predictive model has already accounted for known seasonality, exposure mix and risk factors, a persistent residual shift is more interpretable.

This connects sequential detection to model validation: first model what should be predictable, then monitor what remains.

11. Brown–Durbin–Evans CUSUM is related but not identical

The econometric CUSUM test associated with Brown, Durbin and Evans uses cumulative sums of recursive residuals to test parameter stability in regression models.

That is related to Page’s sequential change detector but answers a somewhat different question. The Brown–Durbin–Evans procedure is commonly used as a structural-stability test with confidence boundaries, whereas Page CUSUM is often designed as an online detector with a target shift and run-length properties.

A careful article or implementation should name which CUSUM it is using rather than treating all cumulative-sum methods as interchangeable.

12. Autocorrelation can destroy nominal false-alarm rates

Classical ARL tables often assume independent observations or increments. Financial residuals can remain autocorrelated even after modelling.

Positive autocorrelation creates runs of deviations in the same direction, exactly the pattern a CUSUM is designed to accumulate. False alarms can therefore become much more frequent than the nominal design suggests.

Falsifier: simulate the detector using a fitted baseline dependence model or block-bootstrap residuals. If empirical ARL₀ is far below the design value, the independence assumption is unsafe.

13. Volatility changes can masquerade as mean shifts

A detector calibrated for unit variance may alarm more often if variance rises while the mean remains unchanged. More extreme positive or negative observations arrive simply because the distribution widened.

Possible responses include:

• standardising by a dynamic volatility estimate;
• using a variance-sensitive CUSUM separately;
• monitoring both mean and scale;
• recalibrating thresholds by simulation under the actual baseline model.

Mean change and variance change are different hypotheses.

14. Heavy tails create another false-alarm channel

If the baseline distribution has heavier tails than the normal model used for calibration, occasional large residuals can push the cumulative statistic across its limit too often.

Robust score functions, alternative likelihoods or simulation-calibrated thresholds can reduce this mismatch.

Diagnostic: compare the empirical residual quantiles with the distribution assumed by the detector.

15. Gradual drift and abrupt change are different alternatives

A classical CUSUM is especially effective for a persistent step-like change from one regime to another.

If the mean moves gradually from 0 to 0.5 over hundreds of observations, a detector tuned for a sudden 0.5 shift may react differently.

EWMA charts, state-space models or explicitly modelled drift processes can be better alternatives for slowly evolving changes.

16. Inputs and outputs

Inputs can include:

• baseline mean or predictive model;
• baseline scale estimate;
• monitored observations or residuals;
• direction of interest;
• target shift δ;
• reference value k;
• control limit h;
• reset policy;
• minimum warm-up period;
• dependence model or bootstrap scheme;
• missing-data treatment.

Outputs can include:

• upper and lower CUSUM paths;
• alarm time;
• estimated change direction;
• run length;
• empirical ARL₀ and ARL₁;
• alarm attribution window;
• baseline residual diagnostics;
• simulation-calibrated thresholds;
• post-alarm verification status.

17. Evidence polarity

Evidence for confidence includes residuals that are approximately stable under the baseline model, empirical false-alarm rates close to design values, consistent detection in injected-shift simulations, alarms that persist under reasonable alternative baselines, localisation near an independently observed process change, and acceptable detection delay for the target shift.

Evidence against confidence includes strong residual autocorrelation, heavy tails ignored by calibration, alarms clustered at seasonal boundaries, sensitivity to arbitrary warm-up periods, repeated alarms without any post-alarm evidence of change, a variance shift mislabelled as a mean shift, or detector performance that collapses in out-of-sample simulations.

18. Counterexample: autocorrelation creates a false shift

Suppose residuals follow an AR(1) process with positive correlation but zero long-run mean. A run of positive residuals can build CUSUM evidence even though the mean has not changed.

Falsifier: fit the baseline dependence structure, simulate many no-change sequences and measure actual ARL₀. If false alarms occur too quickly, prewhiten or recalibrate.

19. Counterexample: a seasonal effect looks like model deterioration

A banking process may behave differently at month-end or around recurring payment dates. If the baseline omits that seasonality, the detector can alarm predictably every cycle.

Falsifier: align alarm times with calendar features. A repeated seasonal pattern suggests baseline misspecification rather than a new structural change.

20. Counterexample: threshold chosen after seeing the alarm

If analysts tune k and h after looking at the historical change they want to “detect,” the reported sensitivity is in-sample.

Falsifier: freeze the detector design before evaluating on a separate time period or simulated test set.

21. Counterexample: an alarm becomes an automatic retraining command

CUSUM detects evidence inconsistent with a baseline; it does not diagnose the cause. A data-pipeline error, policy change, composition shift or genuine behavioural change can produce similar residual patterns.

Automatically retraining the model after every alarm can teach the model to absorb data errors or temporary anomalies.

Falsifier: require independent verification of the data and mechanism before changing the production model.

22. Counterexample: missing data are silently treated as zeros

If a missing residual is replaced with zero, the CUSUM statistic is artificially pushed toward its reset state. If missingness is concentrated during stressed periods, this can delay detection systematically.

Falsifier: audit missingness separately and simulate the detector under the actual missing-data process.

23. Diagnostics ladder

1. Baseline fit: confirm residual mean and scale.
2. Dependence test: inspect autocorrelation and run structure.
3. Tail test: compare empirical and assumed residual distributions.
4. Target-shift definition: state the shift δ that matters.
5. k/h calibration: compute or simulate ARL trade-offs.
6. Injection test: insert known shifts and measure delay.
7. No-change simulation: measure empirical false alarms.
8. Calendar attribution: test seasonality.
9. Variance attribution: separate mean and scale changes.
10. Post-alarm verification: inspect data, policy and population changes.
11. Out-of-sample evaluation: test frozen parameters on future data.

24. Alternatives

Shewhart charts react quickly to isolated large shifts but are less efficient for small persistent changes.

EWMA charts exponentially smooth past observations and can be useful for gradual or persistent drift.

Generalised likelihood-ratio detectors search over unknown change magnitudes instead of fixing one alternative.

Bayesian change-point methods update posterior probabilities of a change and can incorporate prior beliefs about change frequency.

Offline structural-break tests use a completed historical sample and can estimate multiple change points without the same sequential false-alarm objective.

25. Connections to the surrounding Bukit Timah Tutor knowledge estate

How Banks Detect Model Drift owns the broad validation workflow: population shift, calibration decay, outcomes analysis and redevelopment decisions. This CUSUM article owns the narrower sequential-detection mechanism.

GARCH and EWMA volatility algorithms explain why changing conditional variance can invalidate a fixed-scale CUSUM.

Probability-of-default calibration provides one example of a model output whose residual calibration could be monitored over time, while calibration itself remains a separate job.

The full public lane is indexed at Finance & Banking Algorithms | Applied Mathematics in Real Financial Systems.

26. What would falsify confidence?

Confidence should be withdrawn if the detector’s empirical no-change false-alarm rate is much worse than designed, if residual autocorrelation or seasonality explains alarms, if variance changes masquerade as mean changes, if performance depends on parameters tuned after seeing the answer, if missing-data handling suppresses evidence, or if alarms cannot be reproduced on independent data or simulated shifts.

27. Verification and update triggers

Preserve the baseline model, residual definition, standardisation rule, target shift, k, h, warm-up period, reset policy, dependence assumptions and simulation code with every detector version.

Revalidate when the upstream model changes, residual variance shifts, seasonality changes, the observation frequency changes, missingness patterns change, the cost of false alarms or missed detection changes, or empirical ARL begins to depart from its design target.

28. Primary and high-quality references

• E. S. Page, Continuous Inspection Schemes, Biometrika, 1954.
• U.S. National Institute of Standards and Technology, CUSUM Average Run Length, Engineering Statistics Handbook.
• U.S. National Institute of Standards and Technology, CUSUM control-chart reference, including reference-value and decision-limit concepts.
• R. L. Brown, J. Durbin and J. M. Evans, Techniques for Testing the Constancy of Regression Relationships over Time, Journal of the Royal Statistical Society Series B, 1975.
• Stata, CUSUM tests for parameter stability, current software documentation.

Educational boundary: CUSUM is an evidence-accumulation algorithm, not a diagnosis. An alarm means the observed sequence is unusually inconsistent with the chosen baseline; it does not by itself identify fraud, model failure, insolvency or any other cause.