Solvency II

Every control below is one this framework asks for. The right hand column counts how many other frameworks in our corpus carry the same control, which is the difference between doing this work once and doing it again for the next standard.

There is no implementation kit for this framework yet. The control list and the overlap above are free and complete.

What you already have

Frameworks whose controls overlap this one, most first. If you run any of them, the count is roughly what you have already evidenced.

Every control

What an auditor will ask you to produce

The artefacts named on the failure modes this framework speaks to.

• Approved governance policy with documented scope and accountabilities
• Board or steering committee minutes evidencing oversight
• Roles and responsibilities matrix (RACI)
• Risk register with treatment plans and owner sign-offs
• Risk appetite statement approved by the board
• Periodic risk review reports
• Third-party risk assessment dossier per vendor
• Signed contracts with required protection clauses
• Ongoing assurance reports (SOC 2, ISO, audit findings)
• Internal audit charter and annual audit plan

How programmes fail on this

Failure modes named by this framework and others. Each opens the full record.

• Accountabilities defined on paper but not reflected in performance objectives named by 4 frameworks
• Policy document exists but lacks evidence of board approval or refresh cycle named by 4 frameworks
• Vendor risk assessments not refreshed at the required cadence named by 3 frameworks
• Subcontractor flow-down clauses absent or weak in contracts named by 3 frameworks
• Internal audit coverage skews to financial controls rather than full scope named by 3 frameworks
• Log retention periods inconsistent across systems named by 3 frameworks

Measure this against what you already run · All frameworks · Today's edition