Compliance monitoring cycle

Obligations are risk-rated through the CRA. Residual risk drives where controls, monitoring tests, findings and board reporting focus their effort. The cycle closes when test results feed back into the next reassessment.

  1. Obligations—
  2. RCSA1/1 submitted
  3. CRA0 accepted
  4. Controls—
  5. Monitoring—
  6. Findings—
  7. Governance—
All RCSA cycles

H1 2026 (Sample)

AR
Obligation × Control — first-line ratings

H1 2026 (Sample)

Each row is one control mapped to one obligation. The control owner rates design (is the control set up to work?) and operating (is it working in practice?) on a 1–4 scale, with commentary and an evidence pointer. Compliance then accepts or challenges each rating. Accepted ratings flow through to the CRA as control-effectiveness inputs.

Assessments
1
Submitted
1/1
Accepted (2LoD)
0
Under challenge
0
Challenge notes
0

Self-assessments · 1

  • 8c7cae47-807e-45b0-8496-3e6c452064be
    SEED-CDD-007 · SEED-CTL-0019
    Customer Due Diligence · Reliance on Third Parties: Onboarding CDD checklist completed
    Design
    3/4
    Operating
    3/4
    Self rating
    3/4
    Review
    pending