The gap assessment scores 94 questions across sixteen areas, on the same 0 to 4 maturity scale used by the DORA, ISO 42001 and CPS 234 modules. Eight areas come from the consumer protection instruments and eight from the governance instruments.
What it is for, and how it differs from the requirements
The 295 requirement rows record whether each regulation, section or guide element is implemented. The assessment measures how well the firm discharges the judgement calls the instruments leave to it, which is where a Central Bank inspection or a consumer protection risk assessment concentrates.
The questions deliberately do not restate the rows. They ask how the firm decides which customers are consumers near the five million euro turnover threshold, whether it has mapped Reg. 9 to its own activities, whether any sales incentive rewards volume without a consumer outcome measure, how vulnerability identified by one team reaches collections and digital support, whether there is an inventory of the algorithms that affect consumer outcomes, whether cancelling is as easy as signing up, how the affected population is searched after an error, whether contracts with outsourcers require Code compliance, how the firm decides which roles are controlled functions, how deep ongoing fitness and probity due diligence goes, what stops a PCF appointee starting before written approval, whether whistleblowing deadlines are tracked case by case, and on what Data Protection Act condition the firm holds criminal offence data.
The sixteen areas
| Area | Questions | What it tests |
|---|---|---|
| Scope and governance | 6 | Consumer classification, the Reg. 9 mapping, ownership of the Standards, risk appetite, control function influence, disclosure to the Bank |
| Culture, people and incentives | 5 | Incentives, speak-up, the training population, board training, the people lifecycle |
| Vulnerability and financial abuse | 5 | Identification flow, digital alternatives, trusted contact persons, abuse controls and customer warnings |
| Digital channels and distance contracts | 8 | Platform scope, algorithm inventory, pacing, dark patterns, information timing, the withdrawal right, the cancellation function, human intervention |
| Information, advertising and unregulated activities | 6 | Comprehension testing, approval and substantiation, influencers, free claims, the regulated and unregulated distinction, trading names |
| Complaints and errors | 7 | The definition applied, the payment services timeline, online acknowledgement, root cause, significance, the error population, unclaimed refunds |
| Records, outsourcing and compliance monitoring | 6 | The applicable record types, the retention trigger, retrieval, conduct clauses in contracts, the monitoring plan, CPRA readiness |
| Products, sales and the Consumer Protection Act | 6 | The product forum, the exploitation test, bundle savings, the blacklist, contact cessation, unsolicited calls |
| Fitness and probity scope and mapping | 5 | The CF methodology, outsourcing, the PCF list, exemptions, register quality |
| Due diligence and certification | 8 | Role standards, evidence quality, adverse matters, ongoing depth, certificate timing, the agreement, MCC overlap, retention |
| PCF approvals and Central Bank engagement | 7 | Board approval, the IQ procedure, no early start, payment and e-money evidence, escalation and notification, the annual return, ownership and testing |
| Conduct Standards and accountability | 6 | Population mapping, tailored training, the HR link, the accountable owner, reasonable steps evidence, breach handling |
| SEAR (SEAR firms only) | 4 | The scope decision, the gap check on the map, statement specificity, version control |
| Whistleblowing and protected disclosures | 7 | Headcount scope, designated person independence, deadline tracking, confidentiality, external routes, penalisation controls, the PCF statutory duty |
| Irish data protection specifics | 5 | The conditions inventory, criminal data for fitness and probity, the rights restriction log, child consent, DPC readiness |
| ePrivacy: marketing and cookies | 3 | Cookie governance, consent proof, channel rules |
Scoring
| Score | Meaning |
|---|---|
| 0 | Not Implemented |
| 1 | Initial |
| 2 | Developing |
| 3 | Defined |
| 4 | Optimized |
Questions are weighted 1 to 3 by how much a reviewer cares about them: the Reg. 9 mapping, the disclosure trigger, incentives, financial abuse controls, the algorithm inventory, dark patterns, the error population search, outsourcing clauses, the fitness and probity evidence quality and whistleblowing confidentiality carry the highest weight. The overall percentage is computed against every question, answered or not, so an unanswered question reads as a gap rather than being excluded from the denominator. A score of 80 percent or above shows as substantially aligned, 50 to 79 as partial alignment, and below 50 as significant gaps.
Open Gap Assessment and start a new one. Work through the areas in the order shown or jump to the one you are reviewing; answers save automatically.
Each answer takes a note and an evidence URL. Write the specific fact: which Reg. 9 mapping the firm uses, when the trusted contact person process went live, how many whistleblowing cases met the three month feedback deadline. Those notes are what make next year's re-assessment meaningful.
Once every question has a score, complete the assessment. The overall score is recorded, the assessment becomes read-only and the dashboard shows the maturity beside the requirement coverage.
Open the requirements for the areas that scored lowest, read the guidance and attach the evidence or raise the actions. Completing the assessment does not change the status of any requirement; the two records are kept separate on purpose, so a good maturity score never silently marks a requirement implemented.