audit packs
Assembled after the request, so they say what someone remembers.
Reporting, retention and the four artefacts a supervisor asks for — generated from the work rather than assembled after the request.
Reporting is the visible part. The record underneath it is the work.
Not whether the control works today — whether it worked in March, what data it held, who decided, and on what basis. Most programmes demonstrate the first and reconstruct the rest badly.
Assembled after the request, so they say what someone remembers.
A threshold with no history can be asserted but not defended.
Reports in one system, the reasoning in another, the data in a third.
Alerts, dispositions and reason codes recorded as the work happens, not afterwards.
Every threshold change is dated, attributed and reversible, with the measured effect attached.
SAR and STR built from the case rather than retyped, with jurisdiction differences handled per entity.
Per case or per period, containing list versions, decisions and the people behind them.
Retention rules are unglamorous and absolute. Archived and unreadable does not satisfy any of them.
Read the compliance guidesA quarterly evidence-assembly exercise became an export. The review turned into a reading exercise, and the parameter history answered questions that used to require a meeting.
Yes. List versions, parameter history and decision logs are dated and retrievable per period.
No. Drafts are generated from the case trail; the filing decision and the submission remain yours.
Formats and deadlines are handled per entity while the underlying suspicion process stays single.
To your retention policy — five years in most regimes, ten where required, and retrievable for the whole period.
We will show you where the answer lives, and what the export looks like.