Mandate, risk and scope

The specialist first asks which authority a text has: international standard, verified local rule or approved institutional procedure. A requirement matrix links each instruction to its trigger and decision owner. Next, assess relationship risk using customer, product, channel and activity factors, with evidence for every rank and a sensitivity interval when a material fact is missing. The score prioritises work; it neither proves crime nor replaces an independent obligation. Choose a control that addresses the actual driver, with a named input, output, operator and operating test. Distinguish an ordinary evidence request from an exception requiring authorised approval. Route urgent signals promptly rather than waiting for routine scoring. Practice comparing consistent time periods, avoiding unsupported blanket exclusion and recording exactly what remains unknown.

Read the whole first subject without an account: its lessons, summary and review questions.