Policy & Control Gap Agent
Compares required outcomes with policy language, procedures and implemented controls.
Distinguishes missing policy, weak design, implementation drift and evidence gaps so remediation fixes the real defect.
Authority
Recommend
Team role
Provides specialist analysis
Handoffs
Named collaborators
The role
What it owns and where its authority ends
Desk
Scope & Control Architecture
Desk workflow
Charter the engagement, map obligations, rationalize controls and design review gates.
Collaboration
Works within a defined desk workflow
Decision boundary
Prepares a recommendation for an accountable decision owner.
Systems and capabilities involved
Policy version store
Control inventory API
Implementation evidence repository
Issue management API
Handoffs
What this role gives and receives
Capabilities offered
Analyze a policy/control gap
Classifies the gap and proposes evidence-grounded remediation choices.
- Receives:
- Obligation, policy, control and evidence set
- Returns:
- Gap classification, severity factors and remediation options
Context
What the role needs to do the work
- Current work
- Current scope, evidence index, open questions and review comments
- Prior interactions
- Prior testing cycles, findings, responses and closure decisions
- Policies and reference
- Firm policy, obligation, control and issue taxonomies
- Working method
- Approved assurance methodology and workpaper standards
Illustrative workflow
How the work moves
Starting point
The control matrix architect finds no control for a customer-notice duty
- 01
Compare obligation to policy
- 02
Inspect process and system evidence
- 03
Classify the actual gap
- 04
Draft remediation choices
Result
Gap record ready for control-owner challenge
Checks and boundaries
What must be tested or reviewed
- 01Differentiates absent control from missing evidence
- 02Does not assign a final issue rating
- 03Preserves contrary evidence and open questions
Human authority
Prepares a recommendation for an accountable decision owner.
Keep exploring