Start with scope
Suggested project phases. These are not statutory deadlines and urgent obligations must be handled immediately.
Establish scope and ownership
List legal entities, services, locations, customers, people, key systems and suppliers. Identify who can make decisions and who keeps the records.
Start the obligations register. Record applicability questions that need specialist review before assuming a framework applies.
Working output: A scoped organisation map, accountable owner and source-based obligations shortlist.
Map risks and current controls
Interview people who do the work. Describe risks as cause, event and consequence against objectives. Capture actual controls and their evidence.
Agree scoring definitions and escalation criteria. Identify urgent risks, missing evidence and uncertain responsibilities.
Working output: An initial risk register and prioritised list of evidence gaps.
Close the material gaps
Assign specific actions, realistic dates and resources. Update procedures, training and supplier arrangements where the review supports it.
Check control operation using a proportionate sample. Record exceptions and distinguish a promised fix from observed improvement.
Working output: Owned actions and dated control-test records.
Review, challenge and improve
Prepare a board or owner review with material risks, sources of assurance, overdue actions and decisions requested.
Record what was decided, who acts next and how the framework will stay current. Set review triggers for incidents, new services, suppliers and regulatory changes.
Working output: A board summary, decision record and ongoing review calendar.
Guidance and underlying sources
- Build an obligations register that changes the work — includes the primary sources and applicability limits.
- Build a risk register that supports decisions — includes the primary sources and applicability limits.
- From a control list to board assurance — includes the primary sources and applicability limits.