Interactive tool

How much of your AML programme could you evidence tomorrow?

Nineteen questions across seven control dimensions. Each one restates a control objective from the register this product holds itself to, and each answer level is about evidence rather than intent — because the difference between a control that exists and a control you can show an examiner is the whole of this assessment.

Step 7 of 7

0 of 19 questions answered

Privacy, records and access

Whether the institution can show an examiner who did what, prove the record has not been altered, and keep what it is required to keep.

Capability group: J. Privacy and records, with A. Institution and access management

The five levels

0 Not in place: — The control does not exist, or nobody could say who performs it.
1 Ad hoc: — It happens in practice, but it is not a defined control: no named owner, no written procedure.
2 Defined: — The objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.
3 Evidenced: — It runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.
4 Accepted: — That evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

1. Audit events form an append-only hash chain whose integrity can be verified on demand, and the anchors are held somewhere the application cannot rewrite.

An audit table an administrator can UPDATE is evidence of nothing in the one scenario audit exists for. [C-16]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

2. Retention policy and legal holds are enforced by the system: a hold refuses a purge, and no record is reduced below the statutory floor.

Retention enforced by a reminder in someone's calendar fails in exactly the month that person is on leave. [C-17]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

3. There is no default-open route: every permission is registered and checked, service accounts cannot assume human roles, and emergency access is time-bound, reason-coded, audited and reviewed after the event.

Standing emergency access is not emergency access; it is an unowned exception with a green status on top of it. [C-02, C-04, SoD]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

Back

The report is computed on the server and rendered into the page you are sent to.

How this works

The framework is not ours to inventThe seven dimensions are the enterprise capability map in the product's own design documentation. The questions restate control objectives from its control register, and each shows the control reference it came from.
Every step is a real pageAnswers travel in the address bar and the score is computed on the server. You can bookmark a half-finished assessment, send it to a colleague, or use the Back button without losing it.
Nothing is storedThere is no database behind this. Your answers exist in your own browser's address bar and in the HTML sent back to you, and nowhere else — which is a better posture for a self-assessment than a session on someone else's server.

The levels are deliberately weighted towards evidence. A control that runs but produces nothing an examiner could inspect scores 2, not 4, however well it works — because in a review it is indistinguishable from a control that does not run at all. That is the same standard the register applies to this product’s own controls: a status cannot be changed to accepted until the evidence column holds a test result, an audit sample, a signed pack, a provider contract or an approved policy.

Start the conversation

A gap you can name is a gap you can plan around

If the assessment surfaced something, the useful next step is an hour with a compliance specialist looking at the specific control — not a product demo. Bring the URL of your result and we will start from your answers.

Book a working session See the platform