Banking
Take the part you need. Keep the rest.
You already watch for regulatory change, and you already write policy centrally. What you do not have is one jurisdiction’s regulation set against your own policies, obligation by obligation, per entity, in a form you can put in front of that jurisdiction’s examiner. GapSure comes in parts: mapping, horizon scanning, the policy editor. You take the ones that close your gap. What your team already runs well, it carries on running.
Where this gets hard
A group compliance function is not short of people who read regulation or people who write policy. It is short of the one join between them, and that join multiplies by every jurisdiction you hold a licence in.
A feed tells you a regulation moved. It does not tell you which of your paragraphs now says the wrong thing, in which entity, in which jurisdiction. That second question is the one your board asks.
Group policy is authored once. Each jurisdiction then adds its own layer: an addendum, a carve-out, a higher local standard. That layer is what the local examiner tests. Group policy alone is not the answer; group policy plus the local layer, in that entity, is.
The perimeter multiplies with each jurisdiction you hold a licence in. The team does not. So the join gets done for the jurisdiction with the next examination and deferred everywhere else.
A coverage exercise in a spreadsheet is accurate on the day it is finished. Then the regulation moves, or the policy does, and the whole exercise has to be done again by hand.
The parts, and what each one is for
Three parts. Take one, take all three, add another later. Each one answers a different question.
Mapping — the join itself
Your policies against the regulator’s own text, obligation by obligation. Coverage scored, Comprehensive to None, per entity, with the reasoning written on every row. Where a procedure is thin, GapSure returns a systems-generated improvement your team reviews, accepts or rejects.
Take it if the join is currently a spreadsheet, or a Big Four engagement, or an exercise you have put off for a jurisdiction you are licensed in.
Horizon scanning — the watch, if you want it
What changed, in which regulation, and what it means for the obligations you are already mapped against.
Leave it if your own watch works. Most group functions have this covered by a feed and a team, and a feed you trust is better than one you have to learn. Nothing else here depends on it.
The policy editor — where the change gets made
Accept an improvement and the wording lands in the document, with version history and the record of who changed and accepted what.
Leave it if your authors would rather keep working where they work. Export the policy to Word, Excel or PDF.
What stays yours
This is a shorter list than you are used to being shown, and that is deliberate.
GapSure stops at policy coverage. We map regulation to policy; your controls, and the evidence that they operate, stay in the tool you already deployed for them. We do not ask you to move them and we do not model them.
The policies are yours to keep, in your words and in your format. GapSure proposes an improvement; one of your people reviews it, and accepts or rejects it. Nothing changes in a policy because a system decided it should.
Your feeds, your analysts, and your own judgement about which changes matter. Nothing in the mapping depends on ours.
Govix supports the work. Your firm remains responsible for its obligations.
GapSure works alongside the GRC you already use.
When a regulation changes
-
1
The new text goes in
Your team uploads the new edition, or we publish it.
-
2
The mapping runs against it
Obligation by obligation, per entity.
-
3
You read the position
Coverage scored, the gaps named, the reasoning on every row.
So the answer to “what does this do to our policies” is produced rather than assembled.
Start with one regulation, in one jurisdiction
Pick the jurisdiction with the next examination and the one regulatory domain that worries you most. That text goes in, with the policy set for one entity. You read what comes back: the gaps, the coverage score, the improvements, and the reasoning behind each. Then the next entity, or the next jurisdiction, or neither.
Start a pilot on one regulation
One jurisdiction, one regulatory domain, one entity’s policy set. Tell us which and we will tell you what it takes.
- ✓ Gaps found against the regulator’s own text
- ✓ Coverage scored: Comprehensive to None
- ✓ The reasoning on every row
- ✓ Systems-generated procedure improvements
- ✓ Per entity, per jurisdiction, per licence
- ✓ One jurisdiction, and the regulatory domain that worries you most
- ✓ That regulation’s text, or we publish it
- ✓ One entity’s policy set, in whatever format it is in now
- ✓ Your company profile, so the mapping knows what applies to you
- ✓ One person who can say whether an improvement is right
Find gaps. Close them. Prove it.
See what GapSure returns for one regulation, in one entity, before you decide anything about the perimeter.