When the supervisor asks, can you prove your controls work?

At an executive briefing on financial resilience hosted by Finalogic in Nicosia, the discussion kept returning to one question: when the supervisor asks, can you prove it? Not that a policy exists, but that the control worked when it mattered.

DORA, NIS2, anti-money laundering requirements, FATF standards and the AI Act differ in scope and legal status. They are not interchangeable. But their governance expectations share practical themes: accountability, risk, third parties, incidents, testing and evidence. The task is to connect those themes to the obligations that actually apply to your firm.

A policy describes a control. A record shows what happened. For an access review, ‘review complete’ is not enough. Retain the accounts examined, the decisions taken, the exceptions identified and proof that inappropriate rights were removed. An independent reviewer should be able to reconstruct the process without asking its owner to fill in the gaps.

The same applies to suppliers. A certificate only supports assurance within its scope. Trace a critical service to its supporting providers, check what their assurance covers and record who assessed the exceptions. A supplier register is not evidence that a dependency will survive an outage.

A clean-looking wallet is not the whole risk picture. Exposure may emerge further along a transaction chain or through activity over time. Analytics can flag relationships, but indirect exposure is not automatically proof of wrongdoing. Document what was detected, the limits of the information and why the transaction was accepted, escalated or declined. The tool informs the decision; responsibility stays with the firm.

A promised fix is not a verified outcome. Separate the agreed action, the implemented change and the retest. Configuring an access restriction proves implementation; checking that it blocks unauthorised activity demonstrates whether it works. Procedural weaknesses may need a fresh sample or a later operating period. A failed retest should not disappear behind a ‘completed’ status.

Boards need to see which important controls failed, which business activities remain exposed and what decisions are required—not just how many tasks were completed. Start with one critical service and one supposedly closed finding. Can each be explained from its records? The goal is not a bigger evidence folder. It is a defensible account of decisions, controls and outcomes.