Distribution control register
Register
Key controls operating in distribution processes. Frequencies and owners are reviewed quarterly at the distribution committee.
Control lifecycle
flowchart TD
A[Control identified] --> B[Control designed]
B --> C[Assigned owner and evidence]
C --> D[Monthly operation and testing]
D --> E[Self-assessment completed]
E --> F{Any failures?}
F -- Yes --> G[Remediation tracking]
F -- No --> H[Committee reporting]
G --> HControl categories
Controls designed to stop issues before they occur.
Examples include approval segregation, validation checks and system restrictions.
Control register
ID | Control | Process | Type | Frequency | Owner | Evidence |
|---|---|---|---|---|---|---|
CTRL-D-03 | Four-eyes review of fit-and-proper assessment | Intermediary onboarding | Preventive | Per application | Distribution Ops Manager | Second reviewer sign-off on review template |
CTRL-D-04 | FSCA licence validation before activation | Intermediary onboarding | Preventive | Per application | Distribution Ops Manager | Dated register screenshot |
CTRL-D-07 | Segregation: reviewer cannot activate record | Intermediary onboarding | Preventive | Per application | Distribution Ops Manager | CRM audit trail of distinct users |
CTRL-D-09 | Commission structure restricted to approved codes | CRM administration | Preventive | Continuous | Channel Manager | CRM validation rule + exception log |
CTRL-D-11 | Call-back verification for banking detail changes | Agreement administration | Preventive | Per change | Channel Manager | Call log reference on amendment record |
CTRL-D-14 | Dormant intermediary review | Panel management | Detective | Semi-annual | Channel Manager | Dormancy report with decisions |
CTRL-D-16 | Referred-quote queue cleared within SLA | Quote and bind | Detective | Daily | Distribution Ops Manager | Queue-age report |
Evidence standard
🧾 Evidence quality standard
Control evidence should be reviewable by an independent party without requiring additional explanation from the owner.
Governance expectations
- Every control must have a named owner and defined evidence requirement.
- Changes to control ownership require approval at the operational risk forum.
- Retired controls remain visible in the register for audit traceability.
- Evidence retention periods align to regulatory and audit obligations.
Change control
Additions and retirements of controls go through the operational risk forum — see the Risks and Controls space. The register version history is the audit trail; do not delete rows, mark them retired with a date.