regulatory-mapping

name	regulatory-mapping
description	Map internal controls / policies / procedures to specific regulatory citations (regulator + section + paragraph). Gap-analysis output format. Used by `risk-and-controls-specialist` + `policy-and-procedure-writer`.

Skill: regulatory-mapping

Purpose: Map internal controls / policies / procedures to specific regulatory citations. Used by risk-and-controls-specialist and policy-and-procedure-writer.

When to use

• New regulation issued — gap analysis vs existing controls / policies
• Pre-exam — examiner will want the control-to-rule mapping
• Building a regulatory inventory for a new licence or jurisdiction
• Refreshing controls after a regulatory amendment
• Multi-jurisdiction coordination — same control, multiple regulatory bases

The output: a regulatory map

A clean mapping looks like this:

Regulator	Regime	Citation	Requirement (1-line)	Internal control	Control owner	Evidence type	Last tested
BMA	Insurance Act 1978	§6A(1)	Maintain prescribed capital	BSCR submission process	Group CRO	BMA-submitted CSR	YYYY-MM-DD
BMA	AMLR 2008	Reg 11(1)	CDD on customers	KYC onboarding workflow	MLRO	KYC file sample	YYYY-MM-DD
OFAC	31 CFR 501	§501.601	Maintain records 5 yrs	Recordkeeping policy + system retention	Compliance Officer	Audit log	YYYY-MM-DD

Building the map

Step 1 — Inventory the regulation

Read the regulator's actual published rule. Don't trust a vendor summary. Extract:

• Citation (regulator + regime + section + paragraph)
• 1-line requirement (in plain English, not regulator-speak)
• Frequency (one-time, periodic, on-event)
• Penalty (informational — informs prioritization)

Step 2 — Inventory existing controls

From the firm's control library or risk register. Extract:

• Control ID
• Control statement (1-line)
• Owner (named, not functional)
• Frequency (manual / automated; daily / weekly / monthly / etc.)
• Evidence type (system log / report / signed memo / etc.)

Step 3 — Map (and find the gaps)

For each regulatory requirement, identify the control(s) that address it.

Four states emerge:

• Covered — one or more controls address the requirement, owners aligned, evidence available
• Under-controlled — control exists but doesn't fully satisfy the requirement (gap)
• Over-controlled — multiple controls testing the same requirement (rationalization opportunity)
• Uncovered — no control addresses the requirement (priority gap)

Step 4 — Output

Status	Citation	Requirement	Existing controls	Gap	Owner	Target date

Plus:

• P0 gaps — uncovered requirements with regulator visibility
• P1 gaps — under-controlled requirements
• Rationalization candidates — over-controlled areas

Common pitfalls

• Mapping to the wrong source. Vendor "guides" to regulation are starting points, not authorities. Cite the regulator's actual publication.
• One-to-one mapping where the actual relationship is one-to-many or many-to-one. A single requirement might need several controls; a single control might satisfy several requirements.
• Skipping the frequency check. A monthly control can't satisfy a real-time requirement.
• Skipping the evidence check. A control with no documented evidence is effectively no control.
• Treating the map as a one-time artifact. Maps are living — regulation changes, controls change, ownership changes.

Multi-jurisdiction notes

When the same firm is regulated under multiple regimes:

• Build separate columns per regulator on the same control row
• A control might satisfy multiple regulators with different cited bases
• Where regulators conflict (e.g., data-retention period), document the firm's policy + which regulator's standard it follows + rationale

See also

• Template: ../../templates/control-narrative.md
• Template: ../../templates/risk-register.md
• Agent: ../../agents/risk-and-controls-specialist.md
• Agent: ../../agents/policy-and-procedure-writer.md