The whole cycle,
one continuous loop.
From the business-risk assessment your board approves to the annual attestation they sign — walked as one connected record, not seven disconnected spreadsheets.
Business Risk Assessment (BRA)
Why this matters: The BRA is where the board takes a position on the firm's inherent exposure. Every downstream artefact points back at it.
Compliance Risk Assessment (CRA) — residual after controls
Why this matters: Residual is the routing engine. Change a residual, and cadence, sample sizes, triage tier and board depth all rebalance below.
Compliance Monitoring Programme (CMP) plan
Why this matters: The plan isn't authored in Excel. It's a projection of the CRA — change once, refresh everywhere.
Fieldwork — sample drawn, evidence captured
Why this matters: The sample selected in 2026 will select the same 60 rows if replayed in 2030. Reviewers stop arguing about "how did you pick these?".
Findings & issues — triage, ownership, clock
Ownership filter — Name the human who carries this from here. 'The team' is not a name.
Why this matters: A finding without a named owner doesn't move. A finding without a date is a report, not a plan.
Attestation & board pack
Why this matters: The board pack isn't authored — it's assembled from the same records the team worked from all quarter. One version, no drift.
Annual effectiveness — the loop closes
Why this matters: The Code asks the board to satisfy itself, at least annually, that compliance risk has been effectively managed. RegAlign writes that attestation from the year's actual record — no separate paper trail.