Use a small number of business exposures. Describe evidence with its scope and date. Assign legal or contractual applicability questions to the appropriate advisers.
Review period / owner:
Attendees and roles (accountable executive, technology lead, compliance, outside adviser if any):
Frameworks or obligations the program claims to follow, and who confirmed applicability:
Obligation crosswalk
One row per commitment the firm has made or must meet. A row with no evidence column filled is a finding.
| Obligation or commitment (regulatory, contractual, investor, insurance) | Policy or procedure that addresses it | Control in operation | Evidence and retention location | Owner | Last confirmed |
|---|---|---|---|---|---|
Exposure review
| Business exposure | Control / practice | Evidence, scope, and date | Gap / uncertainty | Accountable owner | Decision required |
|---|---|---|---|---|---|
| Unauthorized access | |||||
| Loss of important information | |||||
| Unavailable critical service | |||||
| Vendor dependency | |||||
| Delayed detection or response | |||||
| Payment or instruction fraud | |||||
| Misuse of AI tools with firm or portfolio data |
Measures worth seeing each period
State the measure, the value, its source, and the date. Leave unknown values blank rather than estimating.
| Measure | Value | Source and date | Trend |
|---|---|---|---|
| Accounts with phishing-resistant or multi-factor sign-in, as a share of all accounts | |||
| Privileged accounts, and date of last review of that list | |||
| Devices meeting the baseline (encryption, updates, management), as a share of all devices | |||
| Critical updates outstanding beyond the agreed window | |||
| Backup or recovery exercises run, and how many met their objective | |||
| Vendors handling sensitive data with a review completed in the last year | |||
| Security awareness or phishing exercise completion and result | |||
| Incidents and near misses, by category | |||
| Open findings from the last assessment, penetration test, or audit, by age |
Changes since the previous review
Information, services, providers, or access added:
Incidents / exercises / significant findings:
Policy documents due for review or approval this period:
Obligations calendar (regulatory filings, attestations, investor questionnaires, insurance renewal, contract commitments) due in the next two periods:
Exception decision
Affected service and information:
Consequence / compensating measures:
Remaining exposure:
Accepting owner / review date:
Actions
| Improvement | Owner | Due date | Budget or resource needed | Evidence of completion |
|---|---|---|---|---|
Common failure modes
- The review reads a dashboard nobody can trace to evidence.
- Exceptions accepted in a hurry are never re-examined.
- Vendor reviews are counted as done when the questionnaire was sent, not answered.
- Metrics are reported without the denominator.
A dashboard status should be traceable to evidence. Mark a check as unknown or untested when that is what the record supports.
Next review date / cadence:
This review supports leadership decisions. It does not replace a risk assessment, an independent assessment, or legal advice on which obligations apply.