Blog · Coverage and territory · Compliance
How a compliance team tracks the gap between regulatory change and control coverage from its own obligation register and change log: obligations added or amended per period, the days each has been live with no mapped control, the business units where unmapped obligations concentrate, the ageing of the mapping backlog, and the identity that every obligation is either mapped, in progress or unmapped with a date.
A regulatory change is received, reviewed and logged. A year later the regulator asks which control addresses it, and the obligation register shows the obligation with no control beside it. The gap between change and control is measurable from the day the change lands, and it ages. This guide sets out coverage of regulatory change from the register and the change log, the backlog by unit, and the identity.
Per obligation:
State: mapped, in progress, unmapped Days uncovered = today − effective date, while not mapped Days past target, if in progress with a target date past
Per business unit, per period:
Obligations added or amended Unmapped count and median days uncovered In progress past target
Obligation and owner identifiers only.
obligations = mapped + in progress + unmapped
Every obligation in one state. An obligation with a control link to a retired control is not mapped; it fails and is listed as mapped to nothing.
| Unit | Obligations added or amended, last 12 months | Mapped | In progress | Unmapped | Median days uncovered | Past target |
|---|---|---|---|---|---|---|
| Payments | 41 | 22 | 11 | 8 | 140 | 6 |
| Lending | 28 | 25 | 3 | 0 | 1 | |
| Treasury | 14 | 9 | 2 | 3 | 210 | 0 |
Payments has eight obligations that have been live for an average of five months with no control, and six more whose mapping target has passed. Treasury has three, older still. The regulator's question about a change from last spring has an answer in Lending and not in the other two.
| Days uncovered | Obligations | Units |
|---|---|---|
| 0 to 30 | 5 | Normal: recently effective |
| 31 to 90 | 3 | Backlog |
| 91 to 180 | 2 | Finding |
| Over 180 | 4 | Payments 2, Treasury 2 |
Change logged, obligation not created. The change is received and the register never sees it. The join from change log to register is what catches it.
Mapped to a retired control. Looks covered; is not.
In progress forever. No target date; never past it. Require the date.
Register reviewed annually. A change in February is a finding by August.
Mapped once, the change log, the obligation register and the control register produce the states, the ageing and the backlog per unit every month. Covirage builds this from the exports as they are. The compliance page describes the setup, and the obligation coverage guide covers the steady-state coverage measure this feeds into once the mapping is done.
At least one control in the register linked to the obligation, with the control's owner and testing frequency set. A control linked but never tested is mapped and on the testing cadence list; the mapping measure is about the link.
By an owner and a target date recorded against the obligation. In progress with a target date past is its own ageing; unmapped with no owner is the finding. Both are shown, with the days.
The horizon-scanning or regulatory intelligence feed the firm subscribes to, or the compliance team's own log of changes reviewed. Each entry with a date received and a date effective, joined to the obligation register on the obligation it created or amended.