Objective
Ensure the ABC framework is monitored, tested, understood, reported, evidenced and improved.
Control Activity
Compliance maintains a risk-based monitoring and testing plan covering the Gifts and Hospitality Register, third-party due diligence and renewal files, commissions, invoices, reimbursements, unusual payments, exception reporting from finance and approval processes, thematic reviews of higher-risk activities or relationships, and tracking of incidents, allegations, and remediation actions. Compliance or Risk may conduct periodic second-line testing of ABC controls, including documentation quality, operating effectiveness, and timeliness of approvals and escalations. Internal Audit or a competent independent party may periodically review the ABC program and report findings to the appropriate governance body. Compliance tracks role-appropriate training — provided to Board members and senior management, first-line staff, second-line staff, third-line or independent review functions, contractors and consultants, and outsourced parties where ABC exposure exists — with topics including definitions and examples of bribery and corruption, public-official risk, gifts and hospitality rules, third-party risk, books-and-records expectations, escalation and whistleblower obligations, and role-specific case studies and red flags. Training completion must be documented and refreshed periodically. Compliance reports program status — ABC EWRA results and changes in residual risk, incidents, allegations and investigations, gifts and hospitality trends, third-party risk issues, training completion, testing results, and remediation status — to Senior Management and the Board regularly; the Board must receive sufficient information to assess and challenge the effectiveness of the ABC framework. Required evidence is retained — ABC EWRA documentation, gifts and hospitality entries, third-party due diligence files, investigation files, training records, testing and review outputs, management and Board reporting packs, and remediation trackers — for at least the period required by applicable law or internal policy, and longer where there is litigation, investigation, audit, or regulatory need. Annual and event-driven policy review is completed, and remediation is tracked. As Bitkaya grows, enters new markets, or increases reliance on third parties, the ABC framework becomes more detailed and formalized where required to remain effective.
Evidence
- Expected evidence: Monitoring and testing plan and results
- Expected evidence: Independent review report
- Expected evidence: Training content and completion records
- Expected evidence: Management and Board reporting
- Expected evidence: Record-retention inventory
- Expected evidence: Policy review and remediation tracker
- Evidence location: source evidence in SYS-ECM-001 Compliance Framework Library, SYS-ECM-002 Compliance Reporting and Evidence Repository, SYS-OUT-001 Outsourcing Register; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: inspect the annual program pack and sample monitoring, training and findings through reporting and verified closure
- Testing frequency: periodic risk-based monitoring and training; annual framework review; event-driven improvement
Relationships
- Requirements: REQ-VASP-003 Maintain Governance and Fit and Proper Oversight, REQ-VASP-005 Maintain Integrity Based Business Operations, REQ-OUT-009 Monitor Audit and Control Outsourcing Arrangements
- Policy: POL-ABC-001 Anti-Bribery and Corruption Manual
- Process: PRC-FCI-001 Financial Crime and Integrity
- Procedure: PROC-ABC-007 Monitor Test Train Report and Improve ABC
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
History
- 2026-07-28: Enriched control activity with the full monitoring activity list (section 15), training audience and topic list (section 16), Board reporting content (section 17), recordkeeping inventory (section 18), and continuous-development guidance (sections 20–21).
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved ABC Manual version 1.0.