Compliance and Assurance
This domain tests compliance-by-design, control mapping, evidence, segregation of duties, and assurance testing. Expect questions that connect regulatory obligations to process controls and audit evidence.
Compliance by design
- Identify obligations such as SOX Section 404, GDPR, Basel, and industry rules.
- Map obligations to process controls in a risk and control matrix: risk, control, owner, frequency, evidence.
- Distinguish preventive from detective controls and automated from manual controls.
- Segregation of duties prevents one person from controlling conflicting steps.
- BPMN should show control points, data objects, and audit trails where evidence is produced.
Assurance
- Test both design effectiveness and operating effectiveness.
- Use sampling, evidence retention, remediation, and continuous monitoring.
- Conformance checking can compare actual process execution with the approved model.
Worked example
In purchase-to-pay, a SOX-relevant risk is unauthorized payment. The control is a three-way match among purchase order, goods receipt, and invoice before payment. It is a preventive automated control in the workflow; the owner is the AP manager; evidence is the match log retained for seven years. Segregation of duties means the vendor master maintainer cannot approve payments. Assurance tests 25 samples; one exception comes from a manual override. Remediation adds a mandatory reason code and secondary approval. Reasoning: the control maps to a risk and obligation, has evidence, and is tested for operation, not just existence.
Traps that cost marks
- Confusing a risk with a control.
- Documenting a control without retaining evidence.
- Ignoring segregation-of-duties conflicts.
- Assuming automated controls need no testing.