Purpose
Monitor and test the ABC framework, train relevant persons, report to governance bodies, retain evidence and improve the program.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Establish monitoring and testing plan | Establish a risk-based monitoring and testing plan covering the Gifts and Hospitality Register, third-party due diligence and renewal files, commissions, invoices, reimbursements, unusual payments, incidents, exception reporting from finance and approval processes, thematic reviews of higher-risk activities or relationships, tracking of incidents and allegations, and remediation actions. | Monitoring and testing plan |
| 2 | Perform second-line testing | Perform periodic second-line testing of documentation quality, operating effectiveness and approval or escalation timeliness — Compliance or Risk may conduct periodic second-line testing of ABC controls. | Testing results |
| 3 | Arrange independent review | Arrange competent independent review periodically based on risk and previous findings — Internal Audit or a competent independent party may periodically review the ABC program and report findings to the appropriate governance body. | Independent review report |
| 4 | Deliver ABC training | Deliver mandatory, role-appropriate ABC training to relevant Board members and senior management, first-line staff, second-line staff, third-line or independent review functions, contractors and consultants, and outsourced parties where ABC exposure exists. Training topics may include definitions and examples of bribery and corruption, public-official risk, gifts and hospitality rules, third-party risk, books-and-records expectations, escalation and whistleblower obligations, and role-specific case studies and red flags. | Training completion records |
| 5 | Record and refresh training | Record completion and refresh training periodically and after material framework changes. | Training refresh records |
| 6 | Report to management and Board | Report ABC EWRA results and changes in residual risk, incidents, allegations and investigations, gifts and hospitality trends, third-party risk issues, training completion, testing results, and remediation status to Senior Management and the Board regularly. The Board must receive sufficient information to assess and challenge the effectiveness of the ABC framework. | Board reporting pack |
| 7 | Retain ABC evidence | Retain EWRA documentation, gifts and hospitality entries, third-party due diligence files, investigation files, training records, testing and review outputs, management and Board reporting packs, and remediation trackers for at least the period required by applicable law or internal policy, and longer where there is litigation, investigation, audit, or regulatory need. | Retention inventory |
| 8 | Review manual annually | Review the manual at least annually and after material change in law or regulation, business activities or jurisdictions, governance structure or ownership, third-party operating model, or findings from incidents, investigations, audits, or regulator feedback. | Annual review record |
| 9 | Apply lessons and improve | Apply lessons learned and scale governance, tooling, specialization and formality as Bitkaya’s risk and operations develop — as Bitkaya grows, enters new markets, or increases reliance on third parties, the ABC framework shall become more detailed and formalized where required to remain effective. | Improvement actions record |
Exceptions and Escalation
Overdue training, missing evidence, repeated control failures, material findings or overdue remediation shall be escalated to management and the Board.
Records
- Monitoring and testing plan and results
- Independent review report
- Training materials, attendance and completion
- Management and Board reporting
- Retention inventory
- Remediation and verified closure evidence
- Annual policy review
Relationships
- Policy: POL-ABC-001 Anti-Bribery and Corruption Manual
- Process: PRC-FCI-001 Financial Crime and Integrity
- Control: CTRL-ABC-007 Ensure ABC Monitoring Training Reporting and Improvement Are Maintained
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Frequency: periodic risk-based monitoring and training; annual policy review; event-driven improvement
History
- 2026-07-28: Enriched steps with the full monitoring activity list (section 15), training audience and topic list (section 16), Board reporting content (section 17), recordkeeping inventory (section 18), and continuous-development guidance (sections 20–21).
- 2026-07-26: Created from sections 15 through 21 of the approved ABC Manual.