Fourteen Registrations, Three Spreadsheets, One Assistant

Order by (likelihood of recurrence × severity of consequence), not by visibility.

1. No authoritative obligations register (design). Three spreadsheets and an unmapped acquisition mean nobody can state the full population of registrations and conditions. Every downstream control inherits this defect - it is the root cause of the missed renewal. Fix first.
2. Acquired entity's legacy registrations unmapped (design). Operating on an unregistered or non-conforming legacy product is a hard stop with recall and penalty exposure. 18 months is well past any reasonable integration window.
3. Renewal control has no segregation of duties, no backup, no lead-time calendar, no escalation (design + operating). A single point of failure whose failure was foreseeable. The cure notice is an operating symptom, not the disease.
4. Compliance independence compromised (governance). A deputy CFO reporting to the CFO cannot objectively test finance-adjacent controls, and the CFO controls the compliance budget.
5. Hotline triage by HR with a subjective "material" filter and no logging (detection design). This is the most dangerous gap not yet realized: it suppresses the allegations you most need to see, and creates retaliation exposure.
6. Audit committee reporting reduced to "no issues" (governance/monitoring). No metrics, no trends, no visibility.

Blaming the assistant is itself a finding: the control depended on one person's diligence, which is a design failure, not an individual failure.

Do now (low cost, high leverage):

• Reporting line. Move the compliance officer out of the deputy-CFO role. Best fit for a company this size: report to the General Counsel or CEO with a guaranteed direct reporting channel to the audit committee, including the right to place items on the agenda without management filtering. Independence is about escalation rights as much as org boxes.
• Named accountability in the first line. Every registration gets a named business owner and a named backup, with renewal dates, lead times, and evidence requirements in the register. Compliance does not own renewals; it assures them.
• Hotline. Move intake to an independent third-party vendor with a written triage standard (log everything, forward categories automatically, no HR discretion to filter), plus a quarterly log reviewed by the audit committee.
• Board reporting. Replace the single slide with a one-page dashboard (see next task).

Defer, but schedule: a full three-lines-of-defense build, a policy suite rewrite, and jurisdiction-by-jurisdiction compliance mapping. With two FTEs, attempting all three guarantees shallow execution everywhere.

Use leverage instead of headcount: the register can be built with a temporary contractor or outside counsel for the six jurisdictions; the first-line owners do the data entry; compliance does quarterly sampling. Say this explicitly to the audit committee so the resourcing trade-off is theirs to accept.

Why "no issues" is a red flag. A program with three unintegrated spreadsheets, an unmapped acquisition, a hotline filtered by HR, and a missed renewal that generated a cure notice cannot have zero issues. A single reassuring slide indicates either no measurement or filtering - both of which mean the committee is unassured while feeling assured.

Proposed quarterly dashboard (one page):

• Registrations by jurisdiction with days to expiry, and count inside the renewal lead-time window; exceptions flagged red.
• Percentage of registrations with a named owner and backup, and with evidence of conditions tested.
• M&A integration status: legacy registrations mapped / total.
• Hotline: volume, categories, ageing, closure time, retaliation allegations, and how many were closed without escalation and why.
• Regulatory interactions: cure notices, warning items, information requests, penalties - with trend lines.
• Open corrective actions: owner, due date, days overdue; repeat findings escalated automatically.
• Assurance coverage: what was tested this quarter and, critically, what was not.

Framing. Report residual risk, not just incidents: "of 14 registrations, 11 have tested controls and 3 are unassured pending integration; the largest unassured exposure is X." Ask the committee to approve the risk acceptance for the unassured items. That converts a status report into a governance decision, which is what the committee is for.