---
title: Monthly control self-assessment
slug: distribution-controls/monthly-control-self-assessment
icon: {"lucideIcon":"ClipboardCheck"}
docTags: 
createdAt: 2026-08-17T11:14:25.400Z
---

## 🛡️ Purpose

Monthly attestation cycle in which each control owner in the *Control register: Distribution* confirms their controls operated, with evidence, and records any failures.

**Owner:** Distribution Operations Manager · **Cycle:** calendar month, attestations due by working day 5

## 🔄 Monthly attestation lifecycle

```mermaid
flowchart LR
A[Coordinator issues workbook] --> B[Control owners test controls]
B --> C[Ratings and evidence submitted]
C --> D{Any failures or exceptions?}
D -- Yes --> E[Root cause and remediation logged]
E --> F[Compliance escalation if regulatory impact]
D -- No --> G[Coordinator consolidates results]
F --> G
G --> H[Monthly ops review]
```

## 👥 Roles and responsibilities

::::Tabs
:::Tab{title="Coordinator"}
- Issue attestation workbook on working day 1
- Validate completeness of submissions
- Consolidate monthly results
- Escalate overdue attestations
- Table outcomes at monthly ops review
:::

:::Tab{title="Control Owner"}
- Test assigned controls for the month
- Retain evidence supporting control operation
- Record honest effectiveness ratings
- Document remediation actions for failures or exceptions
:::

:::Tab{title="Compliance"}
- Review escalated failed controls with regulatory impact
- Monitor remediation progress for material issues
- Support regulatory reporting obligations where required
:::
::::

## 📋 Procedure

::::WorkflowBlock
:::WorkflowBlockItem
On working day 1, the coordinator issues the attestation workbook listing each control, its owner and its evidence requirement.
:::

:::WorkflowBlockItem
Each control owner tests their control for the month:

- Sample-based for per-transaction controls (minimum 5 items or 10% of volume, whichever is greater)
- Report-based for continuous and detective controls
:::

:::WorkflowBlockItem
The owner records a rating: **✅ Effective**, **⚠️ Effective with exceptions**, or **❌ Failed**, and attaches evidence.
:::

:::WorkflowBlockItem
For any rating other than Effective: record root cause, remediation action, action owner and target date. Root cause means the underlying reason, not a restatement of the failure.
:::

:::WorkflowBlockItem
The coordinator consolidates results by working day 5 and tables them at the monthly ops review (see **Process Performance Reviews**).
:::

:::WorkflowBlockItem
Failed controls with regulatory impact are escalated to Compliance within 24 hours of identification — do not wait for the monthly cycle.
:::
::::

## 🔄 Remediation lifecycle

| Status             | Definition                                | Owner Expectation                          | Escalation                              |
| ------------------ | ----------------------------------------- | ------------------------------------------ | --------------------------------------- |
| Open               | Failure identified and remediation agreed | Action owner updates progress weekly       | Coordinator monitors                    |
| In progress        | Remediation execution underway            | Evidence retained for validation           | Escalate if target date at risk         |
| Pending validation | Action implemented awaiting retest        | Control owner provides supporting evidence | Coordinator validates closure readiness |
| Closed             | Remediation validated and effective       | Evidence archived with attestation record  | No further escalation required          |

## 🧾 Evidence expectations

- Evidence must be retained in a centrally accessible repository.
- Screenshots must include visible timestamps or report run dates.
- Sampling support must identify the tested population and selected sample.
- Evidence links should remain accessible for a minimum of 24 months.

## ⚠️ Honesty rule

:::hint{type="warning"}
**⚠️ Governance expectation**

Ratings are never negotiated. A failure honestly recorded and remediated is the process working as designed. Overdue remediation actions appear on the distribution scorecard until closed.
:::

## 🕘 Revision history

:::Changelog
::ChangelogItem{type="added"}

::ChangelogItem{type="fixed"}
:::