Obligation-to-control coverage, asserted: the compliance roll-up

Regulators ask two questions that most compliance functions answer slowly: is every obligation covered by a control, and is every control tested. The answer lives in three sources that rarely agree: the obligations register, the control library, and the testing log. This guide sets out the join and the roll-up that turns them into one coverage number, asserted, with the exceptions listed.

The measures

Per obligation:

Covered = at least one mapped control Tested = every mapped control has a test inside its cadence

Per regulation, business line and entity:

Coverage = obligations covered ÷ obligations Testing = controls tested in cadence ÷ controls mapped

Per entity:

Review = last review date inside the entity's review cycle

The rows you need

• Obligations register: one row per obligation with regulation, business line, entity, risk rating.
• Control library: one row per control with owner, cadence, and the obligations it maps to.
• Testing log: one row per test with control, date, result.
• Entity list: entities with their review cycle and last review date.

The firm's own identifiers throughout.

The roll-up

1. Obligation: mapped controls, tested controls, covered flag, tested flag.
2. Regulation, business line, entity: coverage and testing rates, gaps ranked by risk rating.
3. Firm: assert that obligations by regulation, by business line and by entity each sum to the register count, and that every obligation appears once in each view.

register = Σ regulations = Σ business lines = Σ entities

An obligation mapped to two business lines appears twice in one view and the assertion fails. That is a register problem, and the report shows the obligation.

A worked example

Financial crime obligations, one business line, one quarter.

Coverage three of four. Testing two of three mapped. The compliance lead's list opens with FC-02, a high-risk obligation whose only control has not been tested in cadence, and FC-03 after it. The board pack's coverage figure and the regulator's answer are the same number, because they are the same query on the same three files.

Where it goes wrong

Controls mapped in the library but not in the register. The two sources disagree about which controls cover which obligations. The join uses one mapping and the report counts the disagreements.

Testing logged against a control name that changed. A renamed control's tests vanish. A mapping table from every historical name.

Cadence not recorded. A control with no cadence cannot be overdue. Count the controls without one and set it.

Entities with several names. A subsidiary under two names appears as two entities with partial obligations. One identifier per entity.

Every quarter, one number

Mapped once, the three exports produce coverage and testing by regulation, business line and entity every quarter, with the gaps ranked by risk and the assertion showing the register agrees. Covirage builds this from the exports as they are, inside the firm's tenant on an enterprise deployment. The compliance page describes the setup.