Recording which people have read and confirmed a published policy or procedure, and which have not. Distinct from training: acknowledgement proves dissemination; an assessment proves understanding. In Blueprint+ →
A level of sign-off in a document's lifecycle. Most organisations use one (a function head); some add a board or committee tier for policies that require it.
Formal sign-off of a policy by the board or a delegated committee, usually required for risk appetite, AML, outsourcing and similar policies in regulated financial institutions.
An activity, system or rule that reduces a risk. Controls have an owner, a frequency, a type (preventive, detective, corrective; manual or automated) and a test history. Control registry →
Checking that a control operates as designed, by inspection, re-performance or sampling, and recording the result with evidence. Usually done in an RCSA or by internal audit.
The proportion of a regulation's clauses that are satisfied by a published policy clause. Reported per regulation and per document. Regulatory tracking →
The log of every run of a workflow: who acted at each step, when, and with what outcome. The evidence that a process was followed.
Tracing what else is affected when a policy, risk, control or regulation changes, through the links between them. Impact Analyzer →
Inherent risk is the exposure before controls; residual risk is what remains after controls operate. RCSAs score both and compare residual risk to appetite.
Where a governed item is in its life: Draft, Under review, Approved, Published, Archived. Applies to policies, procedures and register entries alike.
A recorded relationship between a clause and the regulatory clause, control, risk or other document it relates to. Linkage is what makes coverage and impact analysis possible.
Organisation-wide reference datasets (business units, tag pools, regulators) maintained by administrators so every document and form draws from the same lists.
A statement of what an organisation requires and why, approved by the appropriate authority. Policies set the rule; procedures say how it is carried out.
The steps, roles and decisions by which a policy is carried out in practice. Best expressed as a flow, with system steps shown rather than described. Procedures →
A structured exercise in which the business rates its own risks and the effectiveness of its controls, reviewed by the second line, with a report to management. RCSA →
A structured list of the obligations an organisation must meet, held at clause level with source and effective date, from which policies are linked.
The level of residual risk an organisation is willing to accept, set by the board. Assessments compare scored risk against it.
The catalogue of identified risks with owners, categories and scores, maintained with the same lifecycle as a policy. Risk register →
Risk and compliance functions that oversee the business (the first line). Internal audit is the third line, independent of both.
A third party a vendor uses to process customer data on its behalf, listed in the DPA. DPA →
The structure of first line (operations), second line (risk and compliance) and third line (internal audit), each with a distinct role in governance.
The retained record of every published version of a document, with who changed what and when. Required for audit and for understanding what rule applied on a given date.
A defined sequence of steps, roles and decisions that an item moves through, such as draft, review, approve, publish. Workflow automation →
The trial comes with sample registers, linked policies and an assessment in progress.