Blog · Board and management reporting · Compliance
How a compliance team measures whether each control was tested when its plan said it would be, from the control register and the testing log: cadence adherence per control owner and business unit, the slipped-test list ranked by the risk the control covers, and the trend that shows a testing programme quietly falling behind before the regulator asks.
A regulator asks whether a control was tested last quarter. The compliance head knows it was in the plan. Whether it happened is a different question, and the testing log answers it, for that control and for the four hundred others. This guide sets out cadence adherence, the slipped list, and the trend.
Per control:
Days since last test, against the frequency window On cadence if days since last test ≤ frequency + tolerance
Per owner, per business unit:
Cadence adherence = controls on cadence ÷ controls in scope
Control and owner identifiers only.
controls in scope = on cadence + slipped + never tested
Every control is in exactly one state. A control in the log that is not in the register fails the roll-up and is listed; it is usually a retired control still being tested, or a register that is behind.
| Control | Unit | Risk | Frequency | Last test | Days | State |
|---|---|---|---|---|---|---|
| C-0412 | Payments | High | Quarterly | 14 Apr | 155 | Slipped |
| C-0088 | Lending | High | Monthly | 2 Jul | 76 | Slipped |
| C-0231 | Treasury | High | Quarterly | never | 290 since added | Never tested |
| C-0177 | Payments | Medium | Quarterly | 30 May | 109 | Slipped |
Three high-risk controls at the top, one never tested in ten months. Beneath, the medium and low ones. The compliance head works from the top and knows, before the regulator asks, which answers will be uncomfortable.
| Business unit | In scope | On cadence | Adherence | High-risk slipped |
|---|---|---|---|---|
| Payments | 82 | 61 | 74% | 4 |
| Lending | 117 | 109 | 93% | 1 |
| Treasury | 44 | 40 | 91% | 1 |
And the trend: Payments was at 91 percent two quarters ago. The decline is the finding.
Register and log not joined. Two spreadsheets, each right, never compared. The join is the whole method.
Frequency missing on the register. No window, no state. Every control gets a frequency, or it is listed as unscheduled.
Adherence reported without the risk split. 93 percent hides one high-risk control nobody has tested. Show the high-risk count beside the percentage.
Retired controls counted. They sit on the slipped list forever. Retire them in the register, dated.
Mapped once, the register and the log produce the states, the slipped list and the adherence trend every month. Covirage builds this from the exports as they are. The compliance page describes the setup, and the obligation coverage guide covers the coverage measure that testing cadence sits under.
The control's stated frequency plus a tolerance the compliance head sets: a quarterly control tested within 100 days of the last test is on cadence; at 101 it has slipped. The tolerance is on the report.
They are the top of the slipped list, with the days since the control was added to the register in place of days since last test. A control in the register for a year with no test is a finding in its own right.
By the risk rating already on the control in the register, high, medium or low, and the obligation it maps to. A slipped high-risk control ranks above ten slipped low-risk ones. The compliance head works the list from the top.