Establishing and Monitoring Compliance
This domain tests how a compliance programme is built, operated, and monitored over time, including policies, obligations mapping, monitoring plans, reporting, and remediation.
Programme building blocks
A workable programme includes approved policies and procedures, a compliance obligations register, a risk-based monitoring plan, training, advisory support, management information, and a remediation tracker. Monitoring should have a documented scope, sample basis, frequency, owner, and evidence standard.
Monitoring versus other activities
Monitoring tests whether controls and behaviours comply with requirements. It is not internal audit and not a substitute for management's own checks. Findings should be graded, root-caused, assigned, and followed up until closed.
Worked example
A quarterly monitoring review finds that three STRs were filed after the internal deadline. The compliance officer traces the delay to an unclear approval queue, updates the procedure, trains staff, and adds a weekly ageing report. Reasoning: the finding is a control design and monitoring issue; changing the procedure without tracking filing timeliness would leave the risk unresolved.
Traps that cost marks
- Monitoring without a written plan or sample rationale.
- Treating a policy document as proof that the control operates.
- Closing findings without evidence or root-cause analysis.
- Ignoring regulatory change until the next inspection.
Good answers show a cycle: identify obligations, design controls, monitor, report, remediate, and re-test.