Blog · Coverage and territory · Compliance
The ten questions a head of compliance puts to the business units and the compliance team, which obligations have no control, which controls were not tested on schedule, which findings are past their date and how many times extended, which regulatory changes have no mapping yet, who is overdue on training, which units report nothing, which high-rated issues are open, what will a regulator find first, what did the last audit find that the register did not, and what changed, each with the table from the registers, the identity behind it, and the answer to send back.
A head of compliance asks the business units whether they are compliant and receives assurance. The registers hold the answer as states, and each question has a table. This guide is the ten questions, the tables, and the answer to send back.
| # | The question | The table | Identity | Send back |
|---|---|---|---|---|
| 1 | Which obligations have no control? | Obligation-to-control coverage, by unit and rating | Obligations in three states | Assurance |
| 2 | Which controls were not tested on schedule? | Testing cadence: on cadence, slipped, never tested, by owner | Controls in three states | Adherence percentage without the risk split |
| 3 | Which findings are past their date? | Issue ageing against original and current dates; extension count | Findings in four states | Current-date ageing only |
| 4 | Which regulatory changes have no mapping? | Change backlog by unit; days uncovered | Obligations from changes in three states | A change log with no register join |
| 5 | Who is overdue on training? | Completion by unit and module against the role matrix; expiries | Assignments in three states | Company completion figure |
| 6 | Which units report nothing? | Reporting rate against activity, beside findings rate | Incidents in three sources | Raw report counts |
| 7 | Which high-rated issues are open? | Open findings by rating and owner, with ageing | Same as 3 | A count |
| 8 | What will a regulator find first? | Tables 1 to 3 read from the top by rating | A prepared narrative | |
| 9 | What did the audit find that the register did not? | Audit findings not in the register or not self-reported | Findings by source | The audit report alone |
| 10 | What changed? | The movements page | Every line cites | Narrative |
Head of compliance: Which obligations have no control? Response: Eleven, three high-rated, all in Payments; median 140 days since effective. Table 1. Head of compliance: And of the controls that exist? Response: Payments at 74 percent on cadence, four high-risk controls slipped, one never tested in ten months. Table 2. Head of compliance: What will the regulator ask first? Response: Control C-0231 in Treasury: high-rated, never tested, 290 days since added. Table 8, row 1.
Three tables, and the regulator's first question answered a quarter early.
Assurance as the answer. The unit head's word.
Percentages without the rating split. Ninety-three percent, and one high-risk control nobody tested.
Registers never joined. Obligations, controls, changes and findings in four spreadsheets.
Regulator's question unrehearsed. Answered in the meeting, from memory.
Covirage produces the ten tables from the registers and the training and incident exports, with every item in one state. The compliance page describes the setup, and the obligation coverage guide covers the first table.
Obligations with no mapped control, because an obligation nobody has a control for is the finding a regulator asks about first, and the register can answer it in a table before the regulator asks. Everything else is about whether the controls that exist are working.
Every obligation is mapped, in progress or unmapped; every control is on cadence, slipped or never tested; every finding is open on time, open past date, closed evidenced or closed unevidenced; every training assignment is complete, overdue or not yet due. The three or four states sum to the register, and a table that does not is sent back.
The same tables, read as a regulator would: the high-rated obligation with no control; the control not tested in a year; the finding extended three times. The head of compliance reads the tables from the top and answers the question before it is asked.