Purpose
Provide assurance that Bitkaya maintains timely risk awareness between formal training cycles.
Objective
Ensure at least one approved, relevant awareness activity occurs each quarter and material events trigger timely targeted updates.
Normative
Compliance shall maintain and evidence quarterly awareness activity and shall escalate material topics to formal assessed training where awareness alone is insufficient.
Descriptive
Topics may include phishing, privacy, fraud, AML/CFT, sanctions, client protection, operational vulnerabilities, incidents, near misses and regulatory changes. Awareness measures may include security bulletins on cyber threats, phishing, fraud patterns, and operational vulnerabilities; short compliance updates on regulatory changes, sanctions developments, and control reminders; thematic awareness campaigns on topics such as insider risk, fraud, client protection, escalation quality, and documentation discipline; scenario-based reminders based on actual incidents, near misses, audit findings, or regulatory observations; and targeted reminders following material updates to systems, procedures, sanctions lists, onboarding requirements, or escalation workflows. Where relevant, awareness communications should reinforce the distinction between internal case escalation, internal case classification, external UTR reporting, and other regulatory or supervisory notification obligations.
Evidence
- Expected evidence: Quarterly awareness calendar
- Expected evidence: Approved content and subject-matter review
- Expected evidence: Release date, audience and distribution evidence
- Expected evidence: Event-driven communication and trigger record
- Expected evidence: Escalation to formal training where required
- Evidence location: source evidence in SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: inspect each quarter for approved content, complete audience coverage and timely event response
- Testing frequency: quarterly
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented
Assurance Assertions
- Awareness occurs in every quarter.
- Content is current, approved and relevant to the audience.
- Delivery evidence is retained.
- Material learning needs are converted to assessed training.
Relationships
- Policy: POL-TRAIN-001 Training and Awareness Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-TRAIN-004 Conduct Quarterly Awareness and Event Driven Updates
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Created from the approved Training & Awareness Manual version 1.1.