Control

Control

info

**Fact - Business Unique ** A risk management lever used across financial institutions to mitigate a Firm’s / Business Function’s applicable risks.

Properties

Name	Type	Description	Max Length
Id	GUID	Internal system identifier (NOT TO BE USED FOR EXTERNAL REFERENCE)
IsDeleted	BOOLEAN	True/False - Indicates whether this record has been marked as deleted
Code	STRING	The business code used as a unique identifier	255
IsApproved	BOOLEAN	True/False - Indicates whether this record has been approved for use
AuditId	GUID	Internal system reference to audit change control record

Example JSON

[
    {
        "Id": "A9318D46-4282-48C0-83C3-00238BA24971",
        "Code": "1616",
        "AuditId": "CADCE313-44EA-40BC-96D1-DE06E0656464",
        "IsDeleted": false,
        "IsApproved": true
    }
]

ControlInstance

info

**Fact - Versioned Details Instance ** A risk management lever used across financial institutions to mitigate a Firm’s / Business Function’s applicable risks.

Properties

Name	Type	Description	Max Length
Class	STRING	Defines the standard class of control from a pre-defined list	255
Description	STRING	Control Description provides details on the control design, especially answering the questions:a) WHAT the control is; b) WHO typically operates the control; c) WHEN is the control used/effected; and d) the escalation mechanism. The descriptions are generic (bank-agnostic) but specific enough to be comprehensive and implementable
RawJSON	STRING	JSON formatted data containing all information received from customer. Can be used to extend record details
Family	STRING	Identifies whether the control is Shared or Specific	255
Name	STRING	The business name used as a unique label
ControlId	GUID	Internal system identifier that indicates related Control record
DescriptionReview	STRING	States what is being reviewed or monitored (the latter in the case of daily on-going controls)
Objective	STRING	The Control Objective documents the risk being mitigated and the particular driver that caused the risk to materialise and which the control seeks to prevent or detect.
ExecutionFrequency	STRING	Defines the typical frequency that the control is executed. Based on a pre-defined list	255
IsNetworked	BOOLEAN
OwnerTeam	STRING	Defines the team who owns and operates the control in this context. This should not be a named individual for the purposes of this data set	1000
BusinessImpact	STRING		255
Id	GUID	Internal system identifier (NOT TO BE USED FOR EXTERNAL REFERENCE)
TechnicalChangeImplementationStage	STRING		255
DescriptionAction	STRING	States what is being looked for or identified. [“As per Review” if the identification is implicit in the review activity]
Version	INTEGER	Incremental counter detailing the version of the record
IsApproved	BOOLEAN	True/False - Indicates whether this record has been approved for use
IsSox	BOOLEAN
IsLatestVersion	BOOLEAN	True/False - Indicates whether this is the most recent record for a business code
Type	STRING
SupervisorTeam	STRING	Defines which team is supervising whether the control is being carried out or performed. This should not be a named individual for the purposes of this data set	255
Automation	STRING
BusinessProcessMapping	STRING
DescriptionIdentify	STRING	States what action(s) are required to be performed and evidenced, based on these findings, typically to correct or escalate the issue. CUBE use a standardised list of actions because, although individual firms operate differently at the specific level, overall the resulting actions can be categorised generically, e.g., ‘Determine circumstance of breach or deviation’
IsDeleted	BOOLEAN	True/False - Indicates whether this record has been marked as deleted
AuditId	GUID	Internal system reference to audit change control record
RelatedPolicies	STRING

Example JSON

[
    {
        "Id": "9EDC9DD5-8767-4A32-8BC1-0002BF4FE6C6",
        "ControlId": "8AE75185-C76F-4EDB-BAC1-6A0789F878A7",
        "Name": "Benchmark Procedures & Training Review",
        "Description": "Front-Office - typically the Risk & Control function - maintains a succinct but comprehensive procedure document for each Benchmark highlighting its core components e.g.:\n(a) Description of the Benchmark\n(b) Purpose of the contribution\n(c) Use of the output\n(d) Submission process including systems used, timing of submission, IT involvement\n(e) Retention period of submission and communication to relevant individuals\n\n Any changes to be updated as and when required and a formal annual review to be carried out with latest documents to be sent to the Governance & Oversight body where applicable.",
        "DescriptionReview": "Review the procedure documentation and training statistics for each benchmark [e.g. training documentation: the benchmark description, purpose of the contribution, use of the output, submission process including systems used, timing of submissions, IT involvement, retention period of submission and communication to relevant individuals, regulatory obligations and penalties for breaches]\r\n \r\n",
        "DescriptionIdentify": "Identify gaps in the documentation / procedures, where roles and responsibilities are unclear and/ or where personnel remain untrained",
        "DescriptionAction": "1. Amend inaccurate / incomplete or stale data or documentation \r\n2. Agree timeframe for completion with relevant parties\r\n3. Provide sign-off that review has been performed, logs / documentation / systems are updated and issue is resolved with evidence as necessary",
        "Objective": "To prevent a key person risk due to inadequate documentation and training\r\n\r\n",
        "Type": "Prevent",
        "OwnerTeam": "Front Office",
        "Family": "Specific Control",
        "Class": "Governance (incl. Policy, Doc)",
        "ExecutionFrequency": "Event-Driven",
        "TechnicalChangeImplementationStage": "Operation",
        "BusinessImpact": "Warn",
        "SupervisorTeam": null,
        "RelatedPolicies": null,
        "BusinessProcessMapping": null,
        "Automation": "Insufficient Network Data",
        "IsSox": null,
        "IsNetworked": false,
        "Version": 108,
        "IsLatestVersion": false,
        "IsDeleted": false,
        "IsApproved": true,
        "AuditId": "A048D05C-4031-4C3D-85E9-E5E496CE16F1",
        "RawJSON": null
    }
]

Data Quality Rules

• Control Description should include examples sparingly and with square brackets.
• Control Description Review Section should begin with 'Review' or 'Monitor' and be in line with the verb used in the Control Name.
• Control Description Identify section may be left as 'as per review' if there is nothing further to add.
• Control Description Action section should be taken from the CUBE default list in order to maintain consistency.- Control Name should end with a verb.
• Control Name should be 2 to 4 words to enable easy labelling and quick control identification.- Control Objective should specify the risk in enough detail to drive specific control identification and articulation.
• Control Objective CUBE maintain a list of risks and risk drivers. DTS for risks will be look at in full detail in due course.