Policy gap analysis
Reading a firm’s policies against the rules that apply to it, and recording each requirement the policies do not meet.
A gap analysis takes each requirement in a regime and asks whether the firm’s policies and procedures meet it, partly meet it or miss it. The output is a list of gaps, each with its severity, the requirement it cites and the change it needs.
Done by hand, it is usually a once-a-year spreadsheet that is out of date as soon as either side changes.
Where the rules use it.
- GFSC Handbook on Countering Financial Crime (AML/CFT/CPF)The Bailiwick's AML/CFT/CPF rules and guidance for financial services businesses and prescribed businesses, issued under the Criminal Justice (Proceeds of Crime) regulations.Guernsey · 8 controls
- ISO/IEC 27001 — Information security managementThe certifiable ISMS standard; Annex A controls per ISO/IEC 27002:2022.Global · 9 controls
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls