| name | regulatory-mapping |
| description | Map internal controls / policies / procedures to specific regulatory citations (regulator + section + paragraph). Gap-analysis output format. Used by `risk-and-controls-specialist` + `policy-and-procedure-writer`. |
Skill: regulatory-mapping
Purpose: Map internal controls / policies / procedures to specific regulatory citations. Used by risk-and-controls-specialist and policy-and-procedure-writer.
When to use
- New regulation issued — gap analysis vs existing controls / policies
- Pre-exam — examiner will want the control-to-rule mapping
- Building a regulatory inventory for a new licence or jurisdiction
- Refreshing controls after a regulatory amendment
- Multi-jurisdiction coordination — same control, multiple regulatory bases
The output: a regulatory map
A clean mapping looks like this:
| Regulator | Regime | Citation | Requirement (1-line) | Internal control | Control owner | Evidence type | Last tested |
|---|
| BMA | Insurance Act 1978 | §6A(1) | Maintain prescribed capital | BSCR submission process | Group CRO | BMA-submitted CSR | YYYY-MM-DD |
| BMA | AMLR 2008 | Reg 11(1) | CDD on customers | KYC onboarding workflow | MLRO | KYC file sample | YYYY-MM-DD |
| OFAC | 31 CFR 501 | §501.601 | Maintain records 5 yrs | Recordkeeping policy + system retention | Compliance Officer | Audit log | YYYY-MM-DD |
Building the map
Step 1 — Inventory the regulation
Read the regulator's actual published rule. Don't trust a vendor summary. Extract:
- Citation (regulator + regime + section + paragraph)
- 1-line requirement (in plain English, not regulator-speak)
- Frequency (one-time, periodic, on-event)
- Penalty (informational — informs prioritization)
Step 2 — Inventory existing controls
From the firm's control library or risk register. Extract:
- Control ID
- Control statement (1-line)
- Owner (named, not functional)
- Frequency (manual / automated; daily / weekly / monthly / etc.)
- Evidence type (system log / report / signed memo / etc.)
Step 3 — Map (and find the gaps)
For each regulatory requirement, identify the control(s) that address it.
Four states emerge:
- Covered — one or more controls address the requirement, owners aligned, evidence available
- Under-controlled — control exists but doesn't fully satisfy the requirement (gap)
- Over-controlled — multiple controls testing the same requirement (rationalization opportunity)
- Uncovered — no control addresses the requirement (priority gap)
Step 4 — Output
| Status | Citation | Requirement | Existing controls | Gap | Owner | Target date |
|---|
Plus:
- P0 gaps — uncovered requirements with regulator visibility
- P1 gaps — under-controlled requirements
- Rationalization candidates — over-controlled areas
Common pitfalls
- Mapping to the wrong source. Vendor "guides" to regulation are starting points, not authorities. Cite the regulator's actual publication.
- One-to-one mapping where the actual relationship is one-to-many or many-to-one. A single requirement might need several controls; a single control might satisfy several requirements.
- Skipping the frequency check. A monthly control can't satisfy a real-time requirement.
- Skipping the evidence check. A control with no documented evidence is effectively no control.
- Treating the map as a one-time artifact. Maps are living — regulation changes, controls change, ownership changes.
Multi-jurisdiction notes
When the same firm is regulated under multiple regimes:
- Build separate columns per regulator on the same control row
- A control might satisfy multiple regulators with different cited bases
- Where regulators conflict (e.g., data-retention period), document the firm's policy + which regulator's standard it follows + rationale
See also
