AML/CFT Compliance Check-up

What this tool does

And, more importantly, what it does not do.

The application answers three questions in order: how much risk does your business carry by its very nature, how well do your controls work against that risk, and what is left over. If the remaining risk exceeds the limit your institution has accepted, a finding and an action come out of it.

You end up with three things: a printable executive report, an inventory of 218 controls matched to evidence references, and an action plan with named owners and due dates. When an examiner asks “how do you know that?”, the answer lives in those three.

What it is based on

The question bank, risk factors, sampling rates and thresholds were derived from a source workbook; the scoring engine matches that workbook's formulas exactly. The methodological frame is aligned with FATF Recommendations 1 and 7, the EBA ML/TF risk factors guidelines, the Basel approach to AML/CFT risk management, the Wolfsberg effectiveness statement and the IIA three lines model. Regulatory citations are indicative; article numbers must be checked against the legislation in force.

Methodology

The chain, the formulas, and why each step is there.

The assessment is a chain with seven links. Each link takes the previous one's output as its input; no link can be skipped, and if one is, the next link reports “not measured” and stays empty.

Setting the scope

Scoring a control as “absent” for business you do not conduct depresses the score unfairly; scoring it as “present” is a false declaration. That is why scope is set first, and in writing. A “No” to five of the six business scope questions in the Profile screen automatically takes the related question sections, inherent risk factors, business lines and extra control sets out of scope. The sixth (foreign branches/subsidiaries) does not scope anything out automatically; for the group-level policy and information sharing questions you are expected to record the reason for a “No” as a note.

A question taken out of scope counts as “Not applicable”: it enters neither the numerator nor the denominator, and moves the score neither up nor down. The rule binds only records you have not filled in manually — if you answered a question or scored a factor yourself, the automatic scope rule no longer applies to that record. That way the “we generally don't, but there is this one relationship” case is not lost.

Inherent risk

Inherent risk is the risk the business carries when you imagine there are no controls at all. It is measured across five dimensions with 25 factors in total: Customer, Geography and Sanctions, Product, Channel, Transaction. Each factor is scored from 1 to 5 and each factor carries its own weight.

• A factor marked Not applicable stays out of the denominator.
• A factor not yet scored also stays out of the denominator — a half-filled dimension does not produce a misleading average, but the number of missing factors is visible on the screen and in the badge.
• A dimension with no scored factors counts as “not measured”. Residual risk is not calculated for the domains fed by that dimension; showing zero would be misleading.
• When every factor is scored, the result matches the source workbook exactly.

Scoring anchors

Each of the 25 factors has a written rubric defining what every score from 1 to 5 means (for example “share of high-risk customers 3–7% → 3”). The rubric makes scoring independent of the person and defensible in an examination. Do not score a factor without reading its rubric.

Mandatory rationale

A rationale/evidence note is treated as mandatory for scores of 4 and 5. This is the first thing an examiner asks: “what did you base this score on?” High scores without a rationale are counted as a warning on the dashboard.

Changing weights

Factor weights are editable. A changed weight is tagged “weight changed”, written to the CSV export alongside the default, and reverted with one click. Changing a weight is a methodology decision of the institution and should be approved in writing.

Score suggestions

The figures entered on the Portfolio and Transactions screens produce score suggestions for 16 factors (12 from the portfolio, 4 from operations). A suggestion is derived by placing the calculated ratio into the rubric bands, and it is applied with one click. Suggestions are not binding; you still write the rationale. If there is no portfolio data, the figures from the Profile screen step in.

Control declaration

The control side is measured with 218 questions across 11 domains. Every question carries a weight and a criticality; 40 questions are rated “Critical”.

This value is the declared effectiveness: it is the institution's own statement and is not evidence on its own. An unrecognised answer value (a hand-edited file, a different version) is treated as unanswered; a silently broken score is never produced.

Maturity bands

The maturity label is derived from the test-adjusted effectiveness; it always comes from the same source as the percentage shown on the dashboard, in the heatmap, in the score table and in the report.

Open critical control

Any question rated “Critical” whose test-adjusted coefficient is not full counts as an open critical: answers other than “Yes”, and “Yes” declarations that the QA test rated “Partly confirmed” or “Contradicted”. Action need is read from the same coefficient; the action list looks at what the score, maturity and residual risk look at. Where the reason is the QA test, the card shows a “Due to QA test” marker, the source of a bulk-generated finding records both the declaration and the test result, and the report’s open-critical table shows the test result. Criticality is assigned by a written rule: a control is critical only if its absence on its own creates a direct legal breach or an exposure that cannot be remedied. What is important but recoverable — governance, methodology, an approval step, measurement — is rated “High”. Open criticals are listed separately even when the overall score looks good, and they get their own section in the report.

Independent testing: challenging the declaration

This is the backbone of the methodology: a questionnaire answer alone does not count as control effectiveness. Of the 218 questions, 115 require file testing. The test result applies a cap to the declaration.

Three separate numbers are therefore reported for each domain, and none of them substitutes for another:

• Declared effectiveness — from the questionnaire answers only.
• Test-adjusted effectiveness — after the QA caps are applied. Residual risk is calculated from this value.
• Assurance coverage — how many of the questions requiring a test were actually tested. If it is low, your scores have weak evidential force; the score itself does not change, your confidence does. A question answered “Not applicable” (by hand or by a scope rule) needs no test and is left out of the denominator; an unanswered question stays in it.

Basis: the Wolfsberg effectiveness statement (separating what is declared from what is demonstrated), the IIA three lines model (the second line's declaration being challenged by the third line), and the independent testing pillar of BSA/AML programmes.

Residual risk and the 95% cap

Controls reduce risk; they do not eliminate it. FATF Recommendation 1, the EBA ML/TF risk factors guidelines and the Basel approach are explicit on this. Without the cap, a domain with full marks would show 0.00 residual risk, which is indefensible in any examination. The cap applies only to the residual risk calculation, not to the effectiveness score itself — you see 98% on the Control Scores screen, and on the Residual Risk screen that row carries a “capped at 95%” note.

The inherent risk source of each domain

For domains with two sources, inherent risk is the average of the two dimensions. If even one of the source dimensions is unmeasured, that domain's residual risk is not calculated.

Residual risk bands

The institution-wide figure is never read on its own

Overall residual risk is calculated with the source workbook's formula: overall inherent risk × (1 − MIN(overall test-adjusted effectiveness, 95%)). That formula can dilute a concentrated weakness through averaging. This is why the dashboard also shows the highest domain residual risk, and a separate warning appears when the overall figure hides a domain breach. In an enterprise-wide risk assessment, a breach at domain level cannot be closed off by the overall average.

Risk appetite

The default appetite limit is 1.50 for every domain and for PF; it is a starting value based on industry practice, not your institution's decision. On the Residual Risk screen the limit can be changed on every row; a changed limit is tagged as an “institution decision” and appears that way in the report. If you enter a value equal to the default, no override is stored.

When residual risk exceeds the limit, the row is flagged OVER — ACTION, the sidebar badge shows the number of breaches, and the report lists breaches in their own section. A breach requires a finding in the action plan.

Why proliferation financing (PF) is separate

The 2020 revision of FATF Recommendation 1 and Recommendation 7 require PF risk to be assessed separately from money laundering and terrorist financing risk. The application keeps that separation:

• Five PF factors are scored in their own block: contact with countries under UN proliferation regimes, trade in dual-use goods, exposure to maritime and logistics customers, shell and supply network structures, and exposure to sanctions evasion typologies.
• The PF score is never mixed into the ML/TF overall average.
• On the control side it is paired with D6 sanctions screening effectiveness.
• It is reported on its own row on the Residual Risk screen, with its own appetite limit.
• The mandatory rationale for scores of 4 and 5 applies to PF factors too.

Business line assessment and the method choice

The EBA ML/TF risk factors guidelines and the Basel approach expect risk to be assessed at business line and product level and then aggregated to the institution weighted by business volume. In the matrix on the Inherent Risk screen you activate 12 business lines; for each you enter a business share (%) and 1–5 scores across the five dimensions.

• The application computes volume-weighted institutional inherent risk and flags the riskiest business line.
• If the shares deviate from 100 by more than 0.5 points, a warning appears.
• If the gap between the business-line weighted result and the dimension average exceeds 0.50 points, a warning appears: the dimension average may be hiding risk concentrated in a single business line.
• Business lines belonging to activities marked “none” in the Profile are automatically out of scope.

Why extra control sets are scored separately

Beyond the main question bank there are eight complementary sets with 44 questions: terrorist financing and NPOs, staff and internal reporting, sanctions lookback and model governance, and five sector-specific sets (insurance/pensions, e-money and payments, VASPs, currency exchange offices, brokerage and portfolio management).

Sets open and close automatically according to the obliged entity type and the business scope answers in the Profile; the reason for an out-of-scope set is shown on screen. Unlike sections of the main questionnaire, an out-of-scope set does not reopen through a manual answer: its scope is the type of institution, not a business choice — an insurance set does not apply to a bank. If the obliged entity type changes later, answers entered earlier are not deleted; the set card shows how many there are, but they do not count toward the score, finding generation or the report.

These sets do not enter the denominator of the main score. If they did, domain effectiveness would shift, breaking both the exact match with the source workbook and comparability with previous period files. The set is reported with its own coverage and effectiveness ratio: a tile on the dashboard, a separate table in the executive report, and rows tagged with the set name in the questionnaire CSV. The same QA caps and the same maturity bands apply within this set.

QA sampling methodology

There are 24 defined populations. Each population has a domain, a risk rating, a sampling rule and a testing frequency.

• For populations marked full coverage, the entire population is tested (STRs filed, freezing decisions, sanctions true matches, PEP files, exit decisions, law enforcement requests, correspondent relationships, closed audit findings).
• For the rest: annual sample = MIN(volume, MAX(volume × rate, minimum count)). Rates run from 2% to 15%, minimum counts from 15 to 30.
• Sample per test = annual sample ÷ number of tests, rounded up. Quarterly means 4 tests, Semi-annual 2, Annual 1.

The sampling is stratified: rates and minimum counts are higher for high-risk populations. The sampling plan tells you how many files to test, not which ones; file selection should be random or risk-stratified, and the selection method should be documented.

Findings, criticality and due dates

A finding that can be defended in an examination has five fields filled in: root cause, action, owner, due date and verification method. The application counts findings with missing fields in a separate tile.

For a new finding the due date is suggested automatically by this rule; for critical findings five working days are counted, skipping weekends. The suggested date can be changed by hand. A finding past its due date and not closed counts as “OVERDUE”.

Closure discipline. A closed finding has a closure date and an open one does not; the date cannot be in the future. A closed finding without a closure date counts as having missing fields. When the status is set to “Closed” and the date is empty, today is suggested.

Risk acceptance. The “Risk accepted” status is for a finding that is not remediated but is accepted with management approval; it counts as neither open nor closed. It is never overdue, is excluded from the open and open-critical counts, and enters neither the numerator nor the denominator of the closure rate — the rate measures remediation. On acceptance the approval reference (decision no., date, approver) goes in the Verification field and the decision date in the closure date; since nothing is remediated, an empty action field does not count as missing. A critical finding is by definition a legal breach and cannot be closed by risk acceptance; it must be remediated. Accepted findings are listed in a separate table in the executive report, with their approval reference.

Freshness of the reference data

It is not the code that expires but the external facts it rests on. Country risk flags, regulatory citations and the question bank are tied to a dated reference data pack. Each section ages on its own publication cycle: FATF lists change at every plenary, regulatory citations yearly, the question bank more slowly.

The pack version is shown on the Settings screen and at the bottom of the executive report. When a section passes its own threshold, a warning appears; the job then is to verify the lists against primary sources and update them on the Settings screen. Country flags the institution has changed itself are preserved as “institution decisions”.

Formula summary

Known limitations of the methodology

• Input quality sets the ceiling. The tool does not verify declarations; you enter the QA test results as well. When assurance coverage is low, a high effectiveness score has weak evidential force.
• Weights and rates are starting values. Question weights, factor weights, sampling rates and minimum sample sizes are based on industry practice; they should be calibrated to the institution's approved methodology.
• The default appetite is the same (1.50) for every domain. It should be replaced with the limits approved by the board.
• Regulatory citations are indicative. Article numbers and thresholds must be verified against the legislation in force.
• Averages can hide concentration. This is why the worst domain, the riskiest business line and open criticals are reported separately; do not read the overall score on its own.
• The tool is not an independent audit. It produces detection, prioritisation and remediation tracking.

Before you start

Half an hour of preparation prevents three days of searching.

Before opening the application, gather these three sets on your desk. You may not have all of them; a missing field can stay empty, but starting with a clear picture of what is missing is faster than hunting for it later.

Institution details

• Legal name, obliged entity type, countries of operation.
• Assessment period (start and end dates).
• Names of the compliance officer and of the person performing the assessment.
• Names and versions of the monitoring, screening and KYC systems in use.
• Answers to the six business scope questions: trade finance, correspondent banking, virtual assets, remote onboarding, agent network and other relevant activities.

Figures

• Total customers at period end; number of high-risk and PEP customers.
• Annual transaction count and cross-border transaction count.
• Compliance headcount in FTE.
• Customer distribution: type × risk band breakdown.
• Customer and transaction counts by country.
• Branch/unit list: country, customer count, compliance FTE, last audit date.
• Operational figures: alerts, cases, STRs, freezes, screening, RFIs, QA errors, training completion.
• Period volumes of the QA populations.

Documents

• Current compliance policy and procedures (to cite as evidence references).
• The latest EWRA, the latest internal/external audit report, the dates of the last scenario tuning and screening threshold calibration.
• Risk appetite limits approved by the board, if any.
• The previous period's working file (JSON) — for the period comparison.

Where your data lives

No server. That is a security feature and a responsibility.

The application makes no network requests at all: no external fonts, no CDN, no analytics. All data is held only in the local storage of the browser you use. Institutional data never leaves the device. This is not only a promise: the pages carry a content security policy, and the browser refuses any outbound connection or script from another origin.

The price of that is this: if browser data is cleared, the assessment is gone. The automatic backups sit in the same storage, so they go with it. There is only one way to take a durable backup: Data and backup → Download JSON.

How the application protects you

• Backup reminder — a warning appears on the dashboard once 25 new records have been entered since the last JSON backup, or 7 days have passed. If no backup has ever been taken, the threshold is 15 records. The sidebar shows the date of the last backup.
• Tab-close warning — if there is unbacked-up work, the browser asks for confirmation when you close the tab.
• Save failures are never silent — if storage fills up, you get a notification and a persistent strip in the sidebar.
• Deferred writes are safe — saving is debounced by 250 ms; any pending write is completed when the page is hidden, closed or unloaded.
• Automatic backups — the last five versions are also kept in the browser, and a mandatory backup is taken immediately before reset, file load, backup restore and merge operations.

If you share a computer

Data is tied to the browser profile. Anyone who opens that profile sees the assessment. On shared machines, work in your own user profile; at period end download the JSON and clear the machine with Reset.

Moving to another device

Download the JSON on the old device and open it on the new one with Load working file. The file is the complete working file: answers, scores, notes, findings, settings and the change log are all inside it.

Shell and navigation

The things that stay in the same place on every screen.

The left sidebar

Screens are listed in four groups: Overview (Dashboard, How to Read), Input (Profile, Portfolio, Transactions, Inherent Risk, Questionnaire, Extra Controls, QA Plan), Results (Control Scores, Residual Risk, Action Plan, Period Comparison, Team and Merge, Change Log, Executive Report) and Settings.

What the menu badges mean

The bottom of the sidebar

• Data and backup — JSON download, file load, nine CSV exports, automatic backups and reset in a single dialog.
• Load working file — opens a saved JSON (an automatic backup is taken before loading).
• Reset — deletes everything; asks for confirmation, and language and theme preferences are preserved.
• Below that: the time of the last save, the date of the last JSON backup (turns amber when overdue), the “data is stored in this browser only” note, and the save error strip.

The top bar

• TR / EN — switches the whole interface: menus, all 218 questions, expected evidence, regulatory citations, the rubrics of the 25 factors, the 24 QA populations, profile fields, KPIs, warnings, CSV headers and file names. Stored data is language-independent; switching language never breaks a score or a record.
• Print — prints the open screen. Use it for the executive report; the print styles hide the toolbars.
• Theme — light/dark toggle; the preference is remembered.

The address bar and shareable links

Screen addresses look like #/anket?d=D6&st=gap. Questionnaire filters are carried in the address bar: you can send a colleague a direct link to “the questions that came out as gaps in D6”, and the filter survives a page refresh.

Screen-by-screen reference

Seventeen screens and every feature on them.

1 · Dashboard

The whole assessment on one page. No input is taken, with two exceptions.

The four headline measures

• Control effectiveness — the test-adjusted value; below it the maturity label, and the declared value if it differs.
• Inherent risk — the OVERALL score (0–5), its level, and the scored/applicable factor count.
• Residual risk — the institution-wide figure and its level.
• Highest domain residual risk — which domain, which level. It makes visible the concentration that the overall figure can hide.

The second row of measures

Progress (answered/total), open criticals, appetite breaches, open actions (with overdue and critical counts), closure rate, and — if the extra control sets have been filled in — extra control effectiveness.

Warning strips

The start card

While the assessment is empty it walks through five steps in order, each linking to the relevant screen. Once work has begun it gives way to a “Last question” button that returns you to the question you worked on most recently.

Heatmap, dimension bars and the KPI table

• Heatmap — inherent risk, effectiveness and residual risk per domain; clicking a cell takes you to the relevant screen.
• Dimension bars — a comparison of the five inherent risk dimensions.
• KPI table — a target and a period measurement are entered for 15 KPIs; the status (“On target / Off target”) is derived automatically from the direction. Three are calculated automatically (action closure rate, months since the last scenario tuning and since the last screening calibration); if the Transactions screen has been filled in, 12 more KPIs are populated from there. A value you enter by hand overrides the automatic one.

2 · How to Read

The methodology summarised inside the application. It holds the chain that explains why the screens are in this order, the definition of eight core concepts and where each appears, four formulas, the scale thresholds (inherent 1–5, residual 0–5, maturity bands) and calibration notes.

The same screen defines 26 industry terms that appear in the question texts without explanation: CBDDQ, nested relationship, payable-through account, SoF/SoW, BTL/ATL, the 50 Percent Rule, the Travel Rule, unhosted wallet, dual-use, mirror trade, FOP, NPO and others. Have whoever fills in the questionnaire read this screen first.

3 · Profile

The institution profile: 26 fields in six groups, five of them mandatory. Every field carries a description of what to write and a sample value; in numeric fields the value you enter is read back with thousands separators.

What the screen produces

• Four ratios — share of high-risk customers, share of PEPs, share of cross-border transactions, and customers per compliance FTE.
• Scope effect table — which section each “No” took out of scope, why, and how many questions it affects.
• Date ageing table — for every date field, the months elapsed and whether the expected interval has been exceeded. These are dates of work already done: a future date cannot be picked, and if one comes from a file it is marked “future date” and no elapsed time is calculated (the related KPI stays empty too).
• Consistency warnings — a red strip appears if the high-risk or PEP count exceeds the total, if cross-border transactions exceed total transactions, if the period end precedes the start, if a date is in the future or if a number is negative. A negative number is not used; the same rule applies on the portfolio and operations screens.
• Score suggestions — where there is no portfolio data, these figures produce suggestions for inherent risk factors.

4 · Portfolio

Four tables, all optional; as much as you enter is used.

1. Customer distribution — 7 customer types × 4 risk bands. The total, the high-risk share and the legal entity share come from here; a deviation of more than 1% from the customer count in the Profile raises a warning.
2. Risk segments — 12 segments (PEPs and close associates, non-residents, complex ownership structures, cash-intensive sectors, offshore structures, VASPs, private banking, NPOs, new customers, rejected applications, exits, dormant accounts). Customer and high-risk counts are entered per segment; values exceeding the segment base raise a warning.
3. Country exposure — for every country you touch: relationship type (6 options), customer count and inbound/outbound transaction counts. Risk flags are read from the Settings screen and only displayed here. Countries flagged “domestic” do not enter the cross-border share.
4. Branch and unit network — 7 unit types; for each unit the country, customer count, high-risk customers, compliance FTE and last audit date. Customers per FTE and audit ages over 24 months are flagged.

The top tiles

Total customers, high-risk share, number of countries touched, share of transactions with FATF-listed countries, cross-border transaction share, number of units, units with overdue audits, and the number of score suggestions produced.

The 12 factors it feeds

5 · Transactions

101 operational metrics in eight groups. Each metric is entered as a count, an amount, days or hours; which fields are open depends on the metric.

What is derived

• 16 ratios are shown in a separate table with numerator, denominator and result: monitoring coverage, cash share, cross-border share, alert→case, case→STR, bulk closure share, screening hit rate, RFI response rate, returns from correspondents, trade finance screening coverage, QA critical and major error rates, training completion, remote onboarding share, agent share, unsupervised channel share.
• 12 KPIs are carried automatically to the dashboard.
• 4 inherent risk factors receive score suggestions.
• Consistency warnings — warnings appear if monitored transactions exceed the total, cases exceed alerts, STRs exceed cases, or answered RFIs exceed those received.
• If there is no trade finance activity, that group is taken out of scope by the Profile.

6 · Inherent Risk

Three blocks: the five ML/TF dimensions, the PF block and the business line matrix.

Dimension cards (25 factors)

On every factor row:

• A 1–5 score with the matching rubric text beside it.
• A rationale / evidence field — treated as mandatory for scores of 4 and 5.
• A Not applicable flag — removes the factor from the denominator.
• The weight — editable; if changed it is tagged and reverted with one click.
• A score suggestion — if it comes from portfolio or operational data, the ratio it rests on is written out and it is applied with one click.
• If the factor is out of scope because of the Profile, the reason appears on the row.

The card header carries the dimension score, its level and the scored/applicable factor count. A separate card lists the dominant risk drivers: the factors with the highest weighted contribution. When management asks “why is this high?”, that list is the answer.

The PF block

Five factors, a separate score, a separate average. It never mixes into the dimension averages; its control side is D6. The mandatory rationale applies here too.

The business line matrix

12 business lines as rows, five dimensions as columns. For each line you enter an active flag, a business share (%) and the dimension scores. The card shows the volume-weighted institutional inherent risk, the riskiest business line, the sum of the shares and the gap against the dimension average. A gap above 0.50 points raises a warning.

The method option

The same screen carries the “weight dimensions by business volume” option. It is off by default. When switched on with sufficient business line data, all dimension scores are aggregated from the business line level; the chosen method appears in the report and in the period comparison.

7 · Questionnaire

218 questions across 11 domains. The longest screen of the assessment.

The filter bar

Free-text search (across question text, evidence, source and section), domain, section, criticality, status and QA requirement. The status filter options are: unanswered, answered, gaps, open critical, no evidence reference, QA test pending, contradicted by QA. Filters are carried in the address bar and can be shared.

Selection summary

When a filter is applied, five tiles appear: number of questions selected, answered, the effectiveness of the selection, the number requiring action (including open criticals) and QA coverage (with the contradiction count).

The question card

• Answer buttons — Yes / Partial / No / Not applicable. On out-of-scope questions the buttons are locked and a reason badge is shown.
• Expected evidence, the source/regulatory citation and, where relevant, the sampling population are printed on the card.
• Evidence reference and finding note fields. Questions that are answered but have no evidence reference are badged and can be found through the filter.
• The QA file test block (on 115 questions) — result, number of files tested, number of files in error, and a note. The error rate is calculated automatically. If the answer is “Yes” while the result is “Contradicted”, a red warning appears.
• Create action — on questions that came out as gaps, opens a pre-filled finding form from the card.
• The criticality badge, the weight and the “priority action” flag sit at the top of the card.

Navigation

The list is divided by section headings; each heading shows that section's progress and stays on screen while you scroll. When the filter bar scrolls out of view, a floating “next unanswered” button appears showing how many questions remain. For keyboard shortcuts see Filling in the questionnaire.

8 · Extra Controls

Eight sets, 44 questions. The top tiles: how many sets apply, coverage, test-adjusted effectiveness and the number of open criticals. Each set has its own card, and the card header states why the set was added.

• Out-of-scope sets are dimmed with the reason written out (“your obliged entity type is not …” or “this activity does not exist”).
• Question rows have the same structure as the main questionnaire: answer, evidence reference, finding note and, where required, the QA file test block (result, files tested, files in error, note). The error rate is calculated automatically, and a red warning appears when a “Yes” declaration meets a “Contradicted” result.
• Rows that came out as gaps carry a Create action button; the finding form is pre-filled with the question id, domain and criticality.
• This set's score does not enter the denominator of the main score; it is reported separately.

9 · QA Plan

24 populations are listed: population name and focus, domain, risk rating, sampling rule, frequency. You enter only the period volume; the annual sample and the sample per test are calculated automatically.

Four tiles at the top: number of populations and how many have volumes entered, total volume, total annual sample, total sample per test. Below, a table of error classes (Critical / High / Medium / Low) with definitions and closure times.

10 · Control Scores

A derived screen; there is no input. The columns per domain are:

• Question count, answered, N/A
• Applicable weight and points earned
• Declared effectiveness and test-adjusted effectiveness (with a note on how many questions were adjusted by testing)
• Assurance coverage (tested / requiring a test)
• Maturity label, open critical count, number of questions needing action

The bottom row carries the institution total, and below it a reminder of the maturity bands. Clicking a domain name opens the questionnaire filtered to that domain.

11 · Residual Risk

Per domain: inherent risk, test-adjusted effectiveness (with a note if capped at 95%), residual risk, level, an appetite limit input and the status (OVER / within appetite). Rows in breach carry a “see the gaps” link that opens the filtered questionnaire directly.

Below, PF sits in its own table with its own appetite limit. Then come the residual risk bands and a methodology card explaining the method in use. If there are breaches, a red strip appears at the top; if the overall figure hides a breach, an amber strip appears as well.

12 · Action Plan

Finding → root cause → action → owner → due date → verification.

The top tiles

Total findings, open, overdue, findings with missing fields and the closure rate (risk acceptance excluded). Findings closed by risk acceptance, if any, are counted in a separate tile.

Filters and bulk generation

• Filter by status, criticality, domain and view (open only / overdue only).
• Generate from control gaps — creates draft findings in bulk from questions that came out as gaps in the main questionnaire and in the extra control sets that are in scope; the source question id, domain, criticality and a QA verification suggestion are pre-filled. Questions that already have a finding, and sets that are out of scope, are skipped.

The finding form

Before saving, the form checks the required fields, and rows with missing fields are flagged in the list. Adding, editing and deleting findings are written to the change log.

13 · Period Comparison

The previous period's working file (JSON) is loaded and kept as a summary. Six tiles read the two periods side by side: test-adjusted effectiveness, inherent risk, residual risk, appetite breaches, open criticals and assurance coverage — each with the delta and a direction arrow.

• Domain table — “was / now / delta” columns for effectiveness and residual risk, the change in open criticals, and the status: new breach, fixed, still in breach.
• Finding closure — findings open in the previous period that have been closed, those still open (listed), and findings opened this period.
• Method warning — if the two periods use different scoring methods, the comparison is flagged as limited.
• The comparison baseline can be replaced or cleared.

14 · Team and Merge

The application has no server; parallel work runs through files.

• Assignment table — an owner is named for each of the 11 domains, with that domain's progress beside it.
• Merge — an incoming JSON is compared field by field. The parts are: questionnaire answers per domain, extra control sets, inherent risk per dimension (score, N/A, rationale, weight), profile, QA volumes, operations, KPIs, PF, business lines, appetite limits, country settings, portfolio and findings.
• Each part shows how many filled records exist on your side and on theirs, plus the conflict count (filled and different on both sides); a few examples are listed as “yours → theirs”.
• You choose “mine” or “theirs” per part. In a part where “theirs” is chosen, only the fields that are filled in the incoming file are transferred; nothing is overwritten silently.
• An automatic backup is taken before the merge, and the operation is written to the change log.

15 · Change Log

Append-only; never edited. The events recorded are: questionnaire answers (extra controls included), inherent risk and PF scores, the scoring method choice, adding/editing/deleting findings (bulk-generated findings included), merges and file loads. Each row carries the date and time, who, what, which record, the old value and the new value.

• The “who” field is read from the compliance officer or the assessor in the Profile — it is a declaration; no identity verification is performed.
• Free-text search and filtering by event type; a CSV export is available.
• The screen shows the most recent 500 records; storage keeps at most 4,000 and the oldest drop off when the limit is reached.
• If a value has not actually changed, no record is created.

16 · Executive Report

A printable single-flow page. The sections in order:

1. Institution and period details, the assessor
2. Portfolio and exposure summary
3. Inherent risk profile (dimensions, PF)
4. The risk model and method used
5. Domain results: effectiveness, assurance, maturity, residual risk
6. Appetite breaches
7. Open critical controls
8. Action plan summary; any findings closed by risk acceptance (with approval reference)
9. Extra control sets (separate table)
10. Prepared by / reviewed by / approved by signature block
11. At the bottom, the reference data pack version and any stale sections

Use the print button in the top bar to send it to paper or PDF. The names in the signature block come from the Profile; if empty they are left blank for handwriting.

17 · Settings

Country risk settings and the reference data pack details live here.

• 211 countries and territories are defined; 137 arrive pre-flagged.
• Six flags can be toggled per country: FATF black list, FATF grey list, comprehensive sanctions regime, EU high-risk third country, offshore centre, weak AML supervision.
• Every country you change is tagged as an “institution decision”; it reverts to the default with one click, and all changes revert with one button.
• Search and filter: flagged, unflagged, changed, or by individual flag type.
• A change is reflected in all exposure calculations immediately; in country pickers the heaviest flag is shown in the option (“Iran (IR) — FATF black”).
• Reference pack card — version, compilation date and the age of the three sections (country flags, regulatory citations, question bank); a section past its threshold raises a warning.

Filling in the questionnaire

218 questions do not have to be clicked one by one.

What the four answers mean

Keyboard shortcuts

While the questionnaire screen is open and focus is outside a text field:

The active question is the card at the top of the screen, marked with a thin border. The “Last question” button on the dashboard returns you to the question you worked on most recently.

An efficient order

1. Use the domain filter to focus on one domain; finish one domain per sitting.
2. Filter to critical questions first and answer those — open criticals are the backbone of the action plan.
3. Then come back with the “no evidence reference” filter and complete the references.
4. Once the QA tests are done, enter the results using the “QA test pending” filter.
5. Finally, empty the “contradicted by QA” filter: every contradiction is closed either by correcting the declaration or by repeating the test.

Working as a team

Nobody works in the same file at the same time; you work in parallel and merge.

1. Assign. Name an owner for each domain on the Team and Merge screen. Have one person fill in the Profile, the Portfolio and the Inherent Risk.
2. Distribute. Download the JSON of that first file and send it to everyone. Each person loads it in their own browser and fills in only their domain.
3. Collect. When finished, everyone sends their JSON to the merger.
4. Merge. The merger loads the files one by one, chooses “mine / theirs” per part, reviews every conflict, and applies. An automatic backup is taken before each merge.
5. Verify. After merging, check on the Control Scores screen that the answer counts have reached the expected total; the merge appears in the Change Log.

Period-end checklist

Before sending the report for signature.

• Mandatory Profile fields are filled, period dates are correct, no consistency warning remains.
• The business scope answers reflect the reality of the period.
• All 218 questions are answered or excluded from scope with a reason.
• Answered questions have an evidence reference (the “no evidence” filter is empty).
• Results are entered for the 115 questions requiring a QA test; assurance coverage is at an acceptable level.
• The “contradicted by QA” filter is empty — every contradiction has been closed.
• All 25 inherent risk factors are scored; rationales are written for scores of 4–5.
• The PF block and, if used, the business line matrix are filled in; shares total 100%.
• QA population volumes are entered and the sampling plan has been produced.
• Appetite limits are updated with the values approved by the board.
• Every appetite breach and every open critical has a finding in the action plan.
• Findings have all five fields: root cause, action, owner, due date, verification.
• The previous period file is loaded, the comparison has been read, no method warning remains.
• Either there is no stale-section warning in the reference pack, or it has been updated.
• The executive report is printed and the signature block completed.
• The JSON backup is downloaded and filed in the institution archive; the CSV exports are taken.

The next period

Do not start from scratch.

1. Open the new period with this period's JSON: answers, evidence references and settings stay in place.
2. Load the same file as the baseline on the Period Comparison screen — that fixes the “before” picture.
3. Update the period dates, the figures and the audit dates in the Profile.
4. Close the findings that have been remediated; record the closure date and the residual risk after closure. Those left open show as “still open” in the comparison.
5. Clear the QA results and enter this period's tests — last period's test is not this period's assurance.
6. Review the inherent risk scores: if the portfolio has changed, so have the suggestions.
7. Do not change the method option; if you must, write in the report that the comparison is limited.

When something goes wrong

“My work has disappeared”

First make sure you are in the same browser and the same profile; data is tied to the profile. Then check the automatic backups list in the Data and backup dialog: the last five versions sit there with their dates and any of them can be restored. If you have a JSON, open it with Load working file.

A “save failed” warning keeps appearing

The browser storage is full. Download the JSON straight away. Then clear unnecessary site data in that browser, or continue in another profile and load the file there.

The file will not load

The file must be a JSON produced by this application. In hand-edited files, unrecognised answer values count as unanswered; the score is not silently corrupted, but the record does not appear either. An unrecognised QA result counts as not tested. Out-of-range values — scores outside 1–5, factor weights outside 0–10, business line shares outside 0–100, appetite limits outside 0–5 — are not used; they are shown with an “invalid value” strip on the dashboard and the Inherent Risk screen and a marker on the row concerned. Fields of the wrong type (text instead of a list, say) are corrected on load, and an unreadable reference-period summary is dropped. A corrupt file does not crash the application — it produces a warning.

The scores are not what I expected

• If a domain's residual risk is empty, one of its source dimensions has no scores at all.
• If effectiveness is lower than expected, look at the QA cap: a “Contradicted” result zeroes the coefficient.
• If the overall figure looks fine but a warning appears, a domain is in breach — check the worst-domain tile.
• If the percentages do not match the source workbook, the exposure weighting option may be switched on.
• If a question is locked, a business scope answer in the Profile has taken it out of scope.

I want a larger display

The browser zoom (Ctrl/⌘ and +) scales everything together without breaking the layout. The dark theme is on the button in the top bar.

Appendices and tables

Domains and question distribution

QA populations and sampling rules

Export options

CSV files are produced with a BOM and in the Excel format of the interface language: a semicolon separator and comma decimals in Turkish, a comma separator and dot decimals in English. Columns and numbers therefore split correctly in both locales. Free-text cells are never run as formulas.

Scope in numbers