Solutions
Three parts, one record.
They are sold together and priced together, because separately each one answers less than it appears to. What your firm evidenced only means something alongside the rules that were in force at the time, and both only stay true if somebody is watching for change.
The compliance recordHold what your firm does to meet each regulatory principle, mark which of the regulator's published expectations you have written against, and produce the whole position as a pack when somebody asks for it.Read moreKnowing when the ground movesA record is only true as of the day it was written. Published regulatory material is watched for change, and what reaches your record is approved by a person first and carries the link it was found at.Read moreCryptography with a shelf lifeRecord where the business depends on cryptography a quantum computer would break, with every entry labelled against the published standards and cited, so the answer is a record rather than an opinion.Read more
Start with your own evidence
Create an account, pick your jurisdiction, and work through the principles at your own pace. Nothing is published anywhere and nothing is shared with a regulator.