Skip to main content

Creation of regulatory controls

What is a regulatory control and what purpose do they serve?​

A regulatory control restates the regulatory obligation into CUBE's Index Control format. This will serve a dual purpose. First, it will enhance the capabilities of the AI matching engine to accurately map the obligations to CUBE Index controls. Second, in instances where there are no matches between a regulatory control and a CUBE Index control OR a unique-to-customer control, regulatory controls are available for network members to review and determine whether to adopt as part of their control inventory.

Regulatory control structure​

The relationship between regulatory obligations and regulatory controls will be one-to-one.

In a similar way to CUBE Index Controls, regulatory controls will have a description which comprises the Review, Identify, Action format.

  • RegControl Name: short name to describe the regulatory control.
  • RegControl Description:
    • Review: states what the regulatory obligation is requiring to be reviewed or monitored
    • Identify: states what the regulatory obligation is requiring to be looked for or identified
    • Action: states what action(s) are required to be performed and evidenced by the regulatory obligation based on the outcome of the Review and Identify steps.