An answer that survives being written down.
Hold what your firm does to meet each regulatory principle, with the documents that show it, against the version of the rules that was in force when you wrote it.
The question is rarely "what do you do"
It is "what did you do, when, and how do you know". Most firms can answer the first. The second is where the evidence turns out to live in an inbox.
A shared drive holds documents but not the reasoning that connected them to an obligation. An email thread holds the reasoning but not the version of the rule it was reasoning about. Neither holds the date in a form anyone will accept two years later, and the person who understood the arrangement has often moved on.
The result is familiar: a scramble to reconstruct a position that was perfectly sound at the time, and which nobody wrote down in a way that survived.
What the record actually holds
Four behaviours, each one enforced rather than encouraged.
- ✓Evidence written against a principle, not a folderEach regulatory principle has its own narrative and its own attached documents, alongside the regulator's published expectations for that principle, every one of them citing the section of the guidance note it came from.
- ✓A submitted cycle is frozenRe-attestation opens a new cycle rather than overwriting the last one. What your firm said in a given period stays exactly as it was said, so a past position can be explained rather than only defended.
- ✓A named person against each principleAccountability recorded as a name and a role rather than a login, because in a small firm the person answerable for cyber security is often an outsourced CISO and the MLRO is frequently part time. Neither will ever sign in, and the record should not pretend otherwise.
- ✓Every expectation, and whether you have answered itThe regulator's published expectations are held per principle, and your firm marks which it has written against and which do not apply, with a reason. Nothing is inferred from your narrative: whether a paragraph adequately answers an expectation is a judgement for you and your regulator, so the system counts what is missing rather than grading what is there.
- ✓The whole position, as one packEvery principle, its owner, your evidence, the attachments and the expectation counts, produced for an attestation period and printed straight from the record. It states in the document that it is your own record on a date, carries no score, and has not been reviewed by your regulator.
- ✓Rules resolved as at the time, not as at todayPrinciple numbers resolve through the framework version in force, so evidence written under an earlier version still reads correctly after the framework moves. A number that no longer resolves is shown as unresolved rather than quietly mapped to whatever currently holds that position.
The regulator's own material, already loaded
You are not starting from an empty template and a copy of the rulebook.
- 10 regulatory principles, each with the guidance note behind it
- 279 supervisory expectations, every one citing its source
- 11 guidance notes, held with their issue dates and revisions
What it will not do
A compliance tool that is confidently wrong is worse than no tool, because it gets relied on.
It does not score you. There is no compliance percentage and no traffic light over your firm. A number like that implies a precision nobody has, and once it is written down it gets quoted back as though it were measured.
It does not change your record for you. Nothing is edited, corrected or re-filed automatically. When something changes, you are told, and the writing stays yours.
It does not decide you are compliant. That is your regulator's judgement and it is not available to be automated. What this does is make sure the material you hand them says what you meant, on the date you meant it.