Interactive tool

How much of your AML programme could you evidence tomorrow?

Nineteen questions across seven control dimensions. Each one restates a control objective from the register this product holds itself to, and each answer level is about evidence rather than intent — because the difference between a control that exists and a control you can show an examiner is the whole of this assessment.

Step 2 of 7

0 of 19 questions answered

Risk and controls

Whether risk scoring and the policy behind it can be changed safely: versioned, approved by someone other than the proposer, and reversible.

Capability group: C. Risk and controls, with K. Content and policy governance

The five levels

0 Not in place: — The control does not exist, or nobody could say who performs it.
1 Ad hoc: — It happens in practice, but it is not a defined control: no named owner, no written procedure.
2 Defined: — The objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.
3 Evidenced: — It runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.
4 Accepted: — That evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

1. Sensitive changes use maker-checker, and the approval binds the actor, a digest of what was approved, the decision and the timestamps. The maker cannot be the checker.

An approval recorded against a mutable screen rather than a digest approves whatever that screen said later, which is not an approval at all. [C-03]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

2. The customer risk model is versioned, each assessment pins the model version that produced it, and a missing or unapproved model is an explicit refusal rather than a default low rating.

Defaulting to low when the model is unavailable manufactures a clean risk rating out of a system failure, and the resulting file looks identical to a genuinely low-risk one. [C-06]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

3. Regulatory content and configuration are versioned with payload digests, exactly one version is active per key, the activation writes its audit event in the same transaction, and rollback has been rehearsed.

A configuration change nobody can roll back is a change nobody will make, so the policy drifts from the system instead. [C-19]

0 — Not in placeThe control does not exist, or nobody could say who performs it.1 — Ad hocIt happens in practice, but it is not a defined control: no named owner, no written procedure.2 — DefinedThe objective, the owner and the procedure are documented. Whether it ran last quarter would take some digging to establish.3 — EvidencedIt runs, and it produces the evidence artefact by itself — a test result, an audit sample, an approval record — without anyone assembling one afterwards.4 — AcceptedThat evidence has been independently reviewed and accepted, and any exception has a named owner, an expiry date and a compensating control.

Back

Next: Transaction intelligence.

How this works

The framework is not ours to inventThe seven dimensions are the enterprise capability map in the product's own design documentation. The questions restate control objectives from its control register, and each shows the control reference it came from.
Every step is a real pageAnswers travel in the address bar and the score is computed on the server. You can bookmark a half-finished assessment, send it to a colleague, or use the Back button without losing it.
Nothing is storedThere is no database behind this. Your answers exist in your own browser's address bar and in the HTML sent back to you, and nowhere else — which is a better posture for a self-assessment than a session on someone else's server.

The levels are deliberately weighted towards evidence. A control that runs but produces nothing an examiner could inspect scores 2, not 4, however well it works — because in a review it is indistinguishable from a control that does not run at all. That is the same standard the register applies to this product’s own controls: a status cannot be changed to accepted until the evidence column holds a test result, an audit sample, a signed pack, a provider contract or an approved policy.

Start the conversation

A gap you can name is a gap you can plan around

If the assessment surfaced something, the useful next step is an hour with a compliance specialist looking at the specific control — not a product demo. Bring the URL of your result and we will start from your answers.

Book a working session See the platform