The gap assessment scores 48 questions across the eight areas of the programme, on the same 0 to 4 maturity scale used by the DORA, ISO 42001 and CPS 234 modules.
What it is for, and how it differs from the requirements
The 137 requirement rows record whether each duty is implemented. The assessment measures how well the programme is run. Those are different questions. A firm can have a monitoring procedure, a sanctions policy and a refresh schedule and still fail an inspection, because the inspector does not ask whether the documents exist; the inspector asks who approved the detection criteria, how old the oldest higher-risk file is, and how many days pass between a suspicion and the report.
The questions deliberately do not restate the articles. They target the judgements the Regulation and the guidelines leave to the firm, which is where an inspection concentrates: whether the compliance officer could be blocked by a business line, whether the business-wide risk assessment was built from the firm's own data, who the customer is for each product, which flows sit outside monitoring and why, which decisions a vendor takes without the firm, and what happens in the first hour after a true sanctions match.
The eight areas
| Area | Questions | Example |
|---|---|---|
| Governance and the three lines | 7 | To whom does the compliance officer report, and could a business line head block or delay the filing of a report? |
| Business-wide risk assessment | 6 | Can the customer risk model rate a PEP or a high-risk third country customer as low through weighting, and who can override a score? |
| Customer due diligence standards | 7 | What are the refresh intervals per risk tier, how many files are overdue, and how are trigger events detected? |
| Enhanced due diligence, PEPs and high-risk countries | 5 | Who approves PEP relationships, at what seniority, and is the approval dated before onboarding? |
| Monitoring, investigation and reporting | 8 | Who approved the current detection scenarios and thresholds, and when were they last tuned on evidence? |
| Outsourcing, reliance, agents and groups | 6 | Which decisions in onboarding and monitoring are made by vendors or automated rules without the firm, and are any on the reserved list? |
| Records, data protection and training | 5 | From which date does the five year retention run, and when did the last deletion run execute? |
| Sanctions and restrictive measures | 4 | What testing supports the current fuzzy matching thresholds, and when was the screening system last reviewed for performance? |
Scoring
| Score | Meaning |
|---|---|
| 0 | Not Implemented |
| 1 | Initial |
| 2 | Developing |
| 3 | Defined |
| 4 | Optimized |
Questions are weighted 1 to 3 by how much an inspection cares about them: the compliance manager's seat, the officer's independence, audit independence, the specificity of the risk assessment, model dilution, customer definitions, verification standards, refresh cycles, PEP approval timing, monitoring coverage, detection criteria ownership, report timeliness, the outsourcing inventory, reserved decisions, screening scope and true match handling carry the highest weight. The overall percentage is computed against every question, answered or not, so an unanswered question reads as a gap rather than being excluded from the denominator. A score of 80 percent or above shows as substantially aligned, 50 to 79 as partial alignment, and below 50 as significant gaps.
Notes and evidence on answers
Each answer takes a note and an evidence URL. Use the note to record the specific fact behind the score: the number of overdue higher-risk files, the date the detection criteria were last approved and by which committee, the median number of days from alert to report, the vendor whose methodology has not been assessed. Those notes are what make a re-assessment next year meaningful rather than a fresh guess, and they are the sentences the compliance officer's annual activity report is built from.
Using the result
Read the per-area scores next to the coverage bars on the dashboard. An area with high coverage and a low maturity score is the pattern to look for: the duties are marked implemented, but the way they are run would not survive the questions. Open the requirements in that area, read the guidance on what gets rejected, and set the review dates and owners where the work needs to happen. The board report brings the coverage, the maturity and the open gaps together for the management body that Article 11 makes accountable.