One record for every obligation: the controls against it, the tests that check it, the findings they raise, and who approved each step.
Tested by one personApproved by another
When a test is finished, the tester sends it for approval. Their own approval is not on offer. A second person reads the evidence and signs it off, and both stay on the record.
The same applies when a finding is closed.
Step 1 of 5
Take one your whole board knows: regulatory returns are filed on time. It goes in the register with where it comes from and who answers for it. Here, that is the Chief Financial Officer.
Step 2 of 5
Finance keeps a filing calendar, and each return is signed off before it goes. That control is recorded against the obligation, with the person who owns it.
Step 3 of 5
Each quarter a compliance officer samples the returns and checks the filing dates against the deadlines. This quarter, one of six went in late. The Head of Compliance approves the test.
Step 4 of 5
The late return becomes a finding, and the finding becomes a remediation action with an owner and a date. Finance fixes the cause, and closing it needs an independent approval too.
Step 5 of 5
Every step wrote an entry to the audit trail as it happened. When the board asks whether returns are filed on time, the answer and the evidence are already there.
What is due, what is overdue and what is waiting for you, without opening a spreadsheet.
Heads of compliance and MLROs see where the programme stands. Senior management and auditors can be given read-only access.
Work across several clients from one place. Each client decides which named people may come in, and can withdraw that access at once.
This page shows parts of the system. In a demo we walk you through all of it.