Purpose
Provide assurance that new and transferred personnel receive required training and are competent before performing higher-risk work independently.
Objective
Ensure onboarding is assigned and completed on time and that knowledge, practical readiness, supervision and access decisions are documented.
Normative
Bitkaya shall not permit unsupervised higher-risk work or equivalent privileged access until required onboarding, assessment and manager readiness sign-off are complete.
Descriptive
The control covers foundational orientation, role-specific content, knowledge checks, scenario or observed exercises and documented interim restrictions where readiness is incomplete. Upon hiring or role transfer, the baseline assessment may consider prior experience, qualifications, regulatory exposure, control responsibilities, and system access level. Where a role involves elevated risk, client onboarding, transaction handling, approval authority, or access to compliance-sensitive systems, role readiness must be confirmed before the employee performs the function unsupervised.
Evidence
- Expected evidence: Joiner and transfer population
- Expected evidence: Module assignments and due dates
- Expected evidence: Attendance, completion and assessment records
- Expected evidence: Practical exercise and manager sign-off
- Expected evidence: Supervision or access restriction evidence
- Evidence location: source evidence in SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: sample joiners and transfers and compare start, access and independent-work dates to completion and readiness evidence
- Testing frequency: quarterly
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
Assurance Assertions
- Every joiner and role transfer receives required modules.
- Higher-risk work remains supervised until readiness is confirmed.
- Assessment and manager sign-off precede independent activity.
- Exceptions and restrictions are documented and time-bound.
Relationships
- Policy: POL-TRAIN-001 Training and Awareness Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-TRAIN-002 Deliver Onboarding and Confirm Role Readiness
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Training & Awareness Manual version 1.1.