Quick orientation, so we start on the same page

• To start, what's the immediate trigger that brought you to consider external compliance support today?
• Which regulatory area is highest risk for your organization right now? Options: Data privacy and protection, Anti-money laundering and sanctions, Consumer protection and disclosures, Export controls and trade sanctions, Anti-bribery and corruption, Other
• Who on your leadership team will need to sign off on any corrective program or budget increase?
• When did the triggering event, examination finding, or new regulatory requirement surface? Options: Within the last 2 weeks, Within the last month, 1-3 months ago, 3-12 months ago, More than 12 months ago
• How soon does your board or regulator expect demonstrable progress or a remediation plan? Options: Within 2 weeks, Within 4 weeks, Within 3 months, Within 6 months, No formal deadline known
• Describe the single worst outcome you fear if remediation is handled poorly.

Where the pressure actually shows up in operations

• When regulatory pressure rises, which everyday process or team tends to break first in your operations?
• How often do material control failures or repeat findings occur across your highest-risk business lines? Options: Almost every month, Quarterly, A few times a year, Rarely, Not sure
• Which stakeholder typically learns about enforcement risk first, and how do they usually respond? Options: General counsel, Chief compliance officer, Head of the affected business unit, Chief risk officer, Board or audit committee, Other
• Tell me about the last time a business unit bypassed a control, what happened and why it was permitted to continue.
• How much of the remediation workload does your internal team absorb today, and where do you run out of capacity? Options: All work internal, Mostly internal with external periodic help, Split evenly, Mostly external partner led, Unsure
• Is there a board or regulator imposed deadline that would require you to pause other projects and prioritize this remediation? Options: Yes, hard deadline that cannot move, Yes, soft deadline that can be negotiated, No formal deadline, Unsure

How you actually do the work today

• Walk me through the last time an examiner flagged a gap, from the initial report to the point you considered it closed.
• How many full time people does your compliance or remediation team have dedicated to this regulatory area? Options: 0, 1-3, 4-9, 10-24, 25 or more
• List the systems or repositories that store the evidence and control artifacts we would need to review.
• Who currently documents and signs off on remediation acceptance, and how is that acceptance recorded? Options: Written sign off (email or PDF), Ticketing system acceptance, Board or committee minute, No formal acceptance process, Other
• If remediation workload exceeds your team's capacity, what typically happens to priorities and timelines?

The other options you are weighing

• Name the other firms or internal options you are seriously considering to address this work. Options: Your internal team only, Incumbent advisory firm, Large global consulting firm, Specialist boutique advisory, Technology vendor with managed services, No other options
• For any option you name, what three results would it need to deliver for you to keep that option instead of changing providers?
• Has anyone inside your organization proposed solving this entirely without an outside partner, and who advocated for that approach? Options: Yes, senior leadership, Yes, business unit, Yes, internal compliance team, No one has proposed internal only, Unsure
• What would have to be true about your current approach for you to decide to stay with it rather than engage an external partner?
• Of the options you are weighing, which one most credibly reduces regulatory escalation risk within six months and why?

If this works, what the regulator, board, and your business will notice

• If a regulator inspected you in 12 months and said remediation succeeded, what specific evidence would they point to?
• How will your team measure success month to month during remediation? Options: Number of repeat findings, Time to close high risk findings, Percentage of controls tested and passing, Regulator feedback status, Other
• List the quantitative metrics leadership currently uses to assess compliance program health.
• If a pilot failed to reduce repeat examination findings by 50% within six months, would you continue funding the program? Options: Yes, continue and refine, No, pause and reassess, Depends on other metrics, Unsure
• What is the maximum budget range you can commit in the first 12 months to reach the outcomes you described? Options: Under $100k, $100k to $500k, $500k to $1M, Over $1M, Undisclosed/need internal approval
• Identify the person or committee that must approve the SOW to unlock budget, and how long that approval usually takes in business days.

Readiness and constraints that will speed you up or stop progress

• Name the internal systems, data sources, or teams that must be available on day one for work to proceed.
• Are automated exports or APIs available for the evidence repositories you listed? Options: Yes, APIs available, Yes, scheduled exports available, Only manual exports, No programmatic access, Unsure
• Identify the owner of service accounts, credentials, or legal approvals needed to extract data, and how quickly they can grant that access.
• List any legal, contractual, or regulator imposed restrictions that would prevent sharing control evidence or remediation details with an external advisor.
• How clean and centralized is the data we would rely on, on a scale from 1 to 5 where 1 is fragmented and poor quality and 5 is consolidated and analysis ready? Options: 1, 2, 3, 4, 5

Decision moments, timing, and how we actually get to yes

• If the assessment confirms the exposure we suspect, what immediate actions would your leadership take in the following week?
• What is the formal procurement or contracting path we would follow to get an SOW signed? Options: Direct procurement with CCO sign off, Standard vendor procurement process, Competitive bid required, Master services agreement already in place, Other
• How quickly can your legal and procurement teams turn around a standard SOW, measured in business days? Options: 3-5 days, 6-10 days, 11-20 days, More than 20 days, Unsure
• If internal funding does not become available within four weeks, will you pause, delay, or stop the project? Options: Pause until funding is available, Delay scope and continue limited work, Stop the project, Find alternate funding source
• Name the day to day point of contact who will coordinate scheduling for fieldwork and evidence requests.
• What single decision or missing approval would accelerate this deal to a signed SOW within 14 days?

• Non-Disclosure Agreement (NDA)
• Master Services Agreement (MSA)
• Statement of Work (SOW)
• Data Access Authorization
• Fee Schedule & Payment Terms
• Data Processing Agreement (DPA)
• Regulatory Compliance Addendum
• Change Order Agreement

• Fieldwork Kickoff and Scope Confirmation
• Structured Stakeholder Interviews, Process Mapping
• Evidence Collection and Traceability Build
• Control Testing Execution and Results Capture
• Findings Validation and Root Cause Prioritization

• Publish the completed control test workbook with linked evidence for review.
• Issue formal follow-up evidence requests for each documented gap with expected delivery dates.
• Record chain-of-custody notes for all submitted files and evidence artifacts.
• Confirm test procedures and sample list
• Completed control test workbook entries for the agreed sample with pass or fail status recorded.
• Failed tests logged with initial root cause hypotheses and evidence links for validation.
• Determination on whether additional samples or retests are required for any failed control areas.
• Reconfirm engagement objectives and success criteria
• If required, document expanded sampling or retest windows and the criteria that trigger them.
• Log all preliminary root cause hypotheses with supporting notes for the findings validation session.
• Recap scope, test approach, and evidence standards
• Each finding is either validated, disputed with a defined evidence request, or closed as not applicable.
• A prioritized list of validated findings with root cause statements and a regulatory impact label for each.
• Clear follow-up actions defined for disputed findings and an agreed timeline for resolution.
• Deliver the validated and prioritized findings register with root cause statements and evidence links.
• Issue specific follow-up evidence requests for disputed findings with required deadlines.
• Prepare a short briefing summary of high-priority regulatory risks to support the assessment deliverable.
• Fieldwork scope and sample frame documented and agreed for execution.
• Complete evidence request list and access plan accepted for the first test window.
• Fieldwork schedule and communication norms established and recorded.
• Publish final fieldwork schedule and sample frame to the shared workspace.
• Circulate the evidence request tracker with delivery method and deadlines.
• Confirm daily check-in time and escalation contacts for the fieldwork period.
• A documented current-state process map for the scoped process that stakeholders accept as complete.
• Session objective and interview protocol
• A control inventory with named control owners and location references for primary evidence.
• A preliminary list of suspected control gaps or exception patterns to be tested.
• Upload the documented process map and control inventory to the shared workspace.
• List specific evidence items referenced during interviews and link or request missing items.
• Log example exceptions with timestamps and any supporting notes for follow-up testing.
• Review evidence inventory and status
• A completed traceability matrix linking evidentiary items to each control and test criterion.
• All evidence gaps recorded with clear follow-up items and deadlines.
• Evidence integrity checks and required metadata standards agreed for the assessment record.
• Deliver the populated control-evidence traceability matrix to the shared workspace.
• Agree scope and in-scope sites, units, and processes
• Execute tests and record results
• Present each finding with evidence and root cause
• Map each evidence item to control and test criteria
• Walkthrough of the process end to end
• Record client acceptances, disputes, and required follow-up evidence
• Identify controls, control owners, and procedures
• Validate evidence integrity and chain of custody
• Establish sampling frame and sample sizes
• Document failures and initial remediation hypotheses
• Confirm evidence request list and access mechanisms
• Log evidence gaps and follow-up requests
• Confirm next steps for retests or expanded sampling
• Prioritize findings by regulatory impact and remediation urgency
• Capture known exceptions and evidence locations
• Finalize logistics, timelines, and communication norms

• current_state
• decision_readiness
• success_criteria
• desired_state
• gaps
• stakeholders
• gaps
• stakeholders
• desired_state
• decision_readiness
• success_criteria
• current_state
• gaps
• current_state
• desired_state
• success_criteria
• stakeholders
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness
• decision_readiness

• Draft and Deliver Compliance Policy Library
• Create Role-Based Procedures and Playbooks
• Implement Monitoring and Alerting Controls
• Configure AML Transaction Monitoring Rules
• Deploy Sanctions and PEP Screening Rules
• Execute Remediation for Examination Findings
• Run Examiner-Facing Mock Examination Exercises
• Build Audit-Ready Evidence and Documentation Packages
• Migrate Compliance Records to Central Repository
• Integrate Third-Party Due Diligence Workflows
• Deploy Privacy Data Subject Request Workflow
• Operate Ongoing Monitoring and Quarterly Reports
• Design Regulatory Reporting Templates and Schedules

Draft and Deliver Compliance Policy Library

• Do you have an existing policy library already mapped to specific regimes (for example HIPAA privacy rule, GDPR articles, or banking examination frameworks)? Options: Yes, No
• Which regulatory regimes must the new or updated policies explicitly reference for regulator review? Options: Financial services exam frameworks, Healthcare (HIPAA), Data privacy (GDPR / CCPA), Sanctions and export controls, Other
• How many core policies require drafting or redrafting (for example privacy policy, AML program, sanctions policy)? Options: 1-5, 6-15, 16+
• Which delivery artifacts do you require alongside policy text (policy document, executive summary for the board, approval matrix)? Options: Policy document, Executive summary, Approval matrix, Policy change log
• Provide the review and approval workflow you use for policy sign-off (for example legal review, compliance committee, board approval, change ticket ID).

Create Role-Based Procedures and Playbooks

• Are defined role titles and RACI matrices in place for incident response, escalation, and remediation tasks? Options: Yes, No
• Which operational playbooks are highest priority: data breach incident response, AML SAR triage, sanctions-hit investigation, or privacy DSR handling? Options: Data breach incident response, AML SAR triage, Sanctions-hit investigation, Privacy data subject request (DSR) handling, Other
• Who in your organization currently performs control testing and who should be named the process owner in each playbook?
• How many distinct role-based procedures do you need as step-by-step runbooks (for example customer onboarding KYC runbook, suspicious activity investigation runbook)? Options: 1-3, 4-7, 8+
• What handoff artifacts must be included with each playbook (for example escalation email templates, case labels in your case management system, approval checklists)?

Implement Monitoring and Alerting Controls

• Identify the SIEM or log aggregation endpoints that must receive monitoring alerts (for example your centralized log collector, cloud audit logs, transaction ledger exports).
• Do you already have alert thresholds defined for anomalous access, large value transfers, or privilege escalations? Options: Yes, No
• What MTTA (mean time to acknowledge) and MTTR (mean time to resolve) targets should alerts meet for high-priority incidents? Options: MTTA <1 hour / MTTR <24 hours, MTTA <4 hours / MTTR <72 hours, Custom
• List the telemetry sources that must be onboarded for monitoring: transaction logs, authentication logs, API call traces, application audit trails.
• How will you validate alert efficacy during testing (for example injected test transactions, synthetic log generation, or red-team scenarios)?

Configure AML Transaction Monitoring Rules

• Identify the product lines and channels that generate the transaction flows to be monitored (for example wire transfers, ACH batches, card settlement feeds).
• Estimate the baseline daily transaction volume and average transaction size we should use when configuring rule thresholds.
• Are there specific rule types you require: velocity rules, amount thresholds, geo-mismatch patterns, or typology-specific indicators? Options: Velocity rules, Amount thresholds, Geolocation mismatch, Typology-specific patterns, Other
• Who will be the adjudication owner for alerts generated by these rules in your case management system?
• List the regulatory filing thresholds that the rules must align with or escalate to (for example internal SAR thresholds, regulator-mandated reporting levels).

Deploy Sanctions and PEP Screening Rules

• Identify the sanctions lists and politically exposed person (PEP) sources screening must cover (for example domestic regulator lists, global consolidated watchlists).
• Indicate the match-confidence thresholds and auto-block versus manual review rules you require for screening matches. Options: High-confidence auto-block, Manual review below high-confidence, Hybrid (auto-filter + manual review)
• Provide the onboarding systems and batch processes that need screening integration (for example customer onboarding form, nightly batch refresh jobs).
• How frequently must PEP and sanctions lists be refreshed in your screening engine (for example real-time, daily, weekly)? Options: Real-time, Daily, Weekly, Custom
• Name the role or contact who will be responsible for documenting false positive decisions and escalation to compliance.

Execute Remediation for Examination Findings

• Confirm whether you have a prioritized list of open examination findings and the corresponding SOW line items to remediate. Options: Yes, No
• Specify the corrective action owners assigned to each finding (for example business unit security lead, legal counsel, IT operations).
• By when do regulators expect completion for high-severity corrective actions according to the examination letter or supervisory timeline? Options: 30 days, 60 days, 90+ days, Custom
• Select the remediation delivery mode you require: full execution of configuration/code changes, advisory-only remediation plans, or a mixed approach. Options: Execution (configuration / code changes), Advisory plans only, Mixed (execution + advisory)
• Describe the acceptance criteria that will confirm a finding is remediated for regulator review (for example control test pass rate, validated evidence logs, re-test results).

Run Examiner-Facing Mock Examination Exercises

• Specify the regulatory examination scope the mock should replicate (for example privacy program assessment, AML readiness, sanctions compliance). Options: Privacy program, AML readiness, Sanctions compliance, Other
• Name the participants from your side who must attend mock interviews and indicate which executive (for example CCO, CRO) should join the tabletop session.
• Select the typical session duration and number of control areas to simulate per mock examination session. Options: Half day / 2-3 areas, Full day / 4-6 areas, Multiple days / Custom
• Indicate which artifacts should be available to simulated examiners during the mock (for example policy pack, control test logs, links to evidence repository).
• Would you like a written examiner-style findings memo with severity ratings and regulator-facing language after the exercise? Options: Yes, No

Build Audit-Ready Evidence and Documentation Packages

• Specify the systems-of-record and log sources that must be captured in the evidence package (for example transaction ledger, authentication logs, case management entries).
• Choose the retention window and snapshot date the evidence should reflect for the audit period (for example rolling 12 months, snapshot as-of a specific quarter end). Options: Rolling 12 months, Rolling 24 months, Custom
• How many findings or control tests must each package cover per regulatory request? Options: 1-5, 6-15, 16+
• Describe the deliverable formats you require for audit packages (for example signed declarations, exported logs with checksums, redacted screenshots).
• Explain the evidence that will validate that the package is audit-ready (for example signed attestations, hash-verified logs, chain-of-custody notes).

Migrate Compliance Records to Central Repository

• State the repository technology that will host migrated compliance records (for example document management, GRC database, secure cloud bucket).
• Estimate the number of documents, emails, and case records to be migrated (provide count or GB).
• Confirm if migrated records require PII/PHI redaction, encryption at rest, or access-restriction tagging during the migration. Options: PII/PHI redaction required, Encryption at rest required, Access tagging required, None
• State the migration completeness percentage that will be the acceptance threshold and the verification method (for example 99% with checksum validation). Options: 98%, 99%, 100%, Custom
• Supply the contact roles who will provide export access from legacy systems and who will sign off on migration cutover.

Integrate Third-Party Due Diligence Workflows

• Define the third-party categories that require due diligence (for example vendors, correspondent banks, benefits administrators).
• Outline the due diligence artifacts that must be captured per vendor (for example AML questionnaire, SOC reports, KYC documents).
• Are automated risk scoring and renewal alerts required based on vendor responses and external watchlists? Options: Yes, No
• Outline the procurement or vendor management systems that must be integrated for data exchange (for example vendor portal, ERP, contract repository).
• Choose the SLA you expect for completion of a new vendor due diligence intake (for example number of business days). Options: 5 business days, 10 business days, 30 business days, Custom

Deploy Privacy Data Subject Request Workflow

• Define the types of data subject requests (DSRs) you expect to process: access, deletion, portability, rectification. Options: Access, Deletion, Portability, Rectification, Other
• For DSR fulfilment, which systems contain the personal data that you need to search (for example CRM, marketing database, HR system)?
• Explain the legal verification steps you require before fulfilling a DSR (for example identity verification, account matching, proof of authority).
• Would you like automation for intake, status tracking, and deadline reminders tied to statutory timelines (for example 30 days)? Options: Yes, No
• Detail the export formats and redaction rules that must be applied when delivering personal data to requestors (for example CSV with field-level redaction, PDF with audit trail).

Operate Ongoing Monitoring and Quarterly Reports

• Enumerate the monitoring KPIs that should appear in quarterly reports (for example false positive rate, alerts per 1,000 transactions, SAR filing counts).
• Define the number or scope of rules and controls that should be covered in each quarterly review (for example all critical controls, top 10 by risk). Options: All critical controls, Top 10 controls by risk, Custom subset
• Set the maximum acceptable false positive rate you require for core monitoring rules. Options: <5%, 5-10%, >10%, Custom
• How frequently should you run control effectiveness validations (for example monthly rule tuning, quarterly sampling)? Options: Monthly, Quarterly, Biannually, Custom
• Designate the recipients of the quarterly reports and the preferred distribution channels (for example secure portal link, encrypted email).

• Transition Health Check
• First Monitoring Measurement
• Quarterly Monitoring Review
• Annual Reassessment and Regulatory Update

• Schedule the next year's quarterly review dates and assign owners for each checkpoint deliverable.
• Publish the prioritized remediation backlog with target resolution dates.
• Schedule a checkpoint to validate the effect of runbook and alert changes after two monitoring cycles.
• Quarterly metric trends
• Validate whether monitoring coverage of high-risk controls meets the agreed threshold or document remediation needed.
• List persistent exceptions with escalation actions and target close dates.
• Agree operational adjustments that will be implemented before the next review.
• Deliver the quarterly compliance checkpoint report with metric trends and persistent issue log.
• Open escalation cases for exceptions that have recurred over two cycles and document resolution timelines.
• Implement agreed runbook/process adjustments and report back on impact at the next review.
• Yearly outcomes and metric summary
• Confirm annual reassessment is complete or document remediation plan and deadlines for any outstanding high-risk gaps.
• Agree the SLA for implementing regulatory updates and confirm the number implemented within the 30-day SLA or remediation plan for misses.
• Finalize the monitoring cadence and shared-channel operating procedure for the coming year.
• Publish the annual reassessment report with open-gap remediation plans and deadlines.
• Implement agreed regulatory updates within the SLA or document exceptions with timelines.
• Activate and document the shared channel for ongoing issues and regulatory alerts with response SLAs.
• Re-confirm success criteria and ownership
• Monitoring environment validated as operational and documented runbooks have named owners.
• Decision recorded on incumbent system (decommission or retain read-only) and data archive status confirmed.
• All critical onboarding blockers captured with remediation actions and target dates.
• Publish the monitoring runbook with named owners and escalation paths.
• Complete legacy system archive or decommission actions and publish confirmation of status.
• Resolve user access and notification routing blockers identified in the session.
• Schedule the First Monitoring Measurement meeting within 4 to 10 weeks.
• Present monitoring dashboard for key metrics
• Agree corrective actions for each metric gap and set target completion dates.
• Tune alerts and runbooks to reduce noise and improve signal-to-action.
• Establish a prioritized backlog with target resolution dates for top open exceptions.
• Tune alert thresholds and update runbook entries based on diagnosis.
• Regulatory landscape update
• Root-cause diagnosis for variances
• Monitoring configuration and integration validation
• Persistent issues and blockers review
• Open high-risk gaps and remediation status
• User access and role review
• Control testing and remediation effectiveness
• Alert and runbook tuning
• Next-year monitoring cadence and SLA review
• Incumbent system wind-down checkpoint
• Operational adjustments and minor scope changes
• Prioritize remediation backlog
• Confirm next quarter checkpoint schedule
• Confirm shared channel and escalation procedure
• Early alert signals and triage workflow test
• Confirm stabilization timeline
• Open issues and immediate remediation actions