Control mapping connects each statement in a bank’s policies to the regulatory requirement it implements, the control that enforces it, the person who owns that control, the test that checks it and the evidence the test leaves behind.
This article covers the map’s scope, the fields in each record, a Regulation E worked example, the triggers for updates, the gaps examiners find and how a risk and compliance platform implements the map.
What Policy-to-Control Mapping Covers
Control mapping works one layer below policy mapping, which ties each policy to the regulations it answers. The Committee of Sponsoring Organizations of the Treadway Commission (COSO) states the relationship in Principle 12 of its 2013 Internal Control–Integrated Framework: control activities are deployed “through policies that establish what is expected” and through procedures that put those policies into action.
Consumer compliance, BSA/AML and operational policies at banks and credit unions all fall within the method. The links usually sit in a risk and control matrix, the register of internal controls that compliance testing and internal audit already use.
Fields in a Control Mapping Record
A mapping record carries eight fields, one row per policy statement:
- Obligation: the regulation and section the statement implements.
- Policy statement: the policy name, version and section.
- Control: who does what, and when.
- Control type: preventive or detective, manual or automated.
- Owner: a named role accountable for the control operating.
- Frequency: per transaction, daily, monthly or annually.
- Test method: how the control is tested, including sample size.
- Evidence: the record the control produces and where it is retained.
Regulation E requires evidence of compliance to be kept for at least two years (12 CFR 1005.13(b)). When one control serves several statements, each statement gets its own row pointing to the same control, so a single test result answers all of them.
Worked Example: Mapping Regulation E Error Resolution
Regulation E error resolution shows control mapping on a rule with fixed deadlines. The table maps four statements from a typical error-resolution policy.
| Policy statement | Control | Test | Evidence |
|---|---|---|---|
| Start on oral or written notice | Intake logs the first-contact date | Intake date vs call record | Case log |
| Decide in 10 business days or credit provisionally | System flags open claims before the 10-business-day deadline | Business days from notice to decision | Aging report |
| Notify provisional credit within 2 business days | Notice issued when credit posts | Notice date and content | Dated notices |
| Report results within 3 business days | Second review of no-error findings | Re-perform sampled reviews | Signed checklist |
Keeping the Control Map Current
A control map goes stale whenever a link in the chain changes. A policy revision is one trigger that causes changed statements to be re-mapped before the board or committee approves the new version.
Regulatory change adds, amends or removes obligations. Control changes arrive with new systems and vendor updates, such as a revised notice template. Owners leave or change roles, and a test exception can show that a control no longer operates as written.
Each updated row records the policy version it maps to. The risk and control self-assessment (RCSA) reads control descriptions and test results from the same rows, so a stale map produces stale RCSA ratings.
Gaps Examiners Find in Control Maps
A compliance gap analysis run against the map surfaces three gap types:
- Orphan policy statements
A commitment in a policy with no control behind it.
- Unanchored controls
A control that traces to no policy statement or obligation, so no one can say what it proves.
- Stale links
Controls mapped to a superseded policy version or a retired rule.
The CFPB Supervision and Examination Manual asks whether policies and procedures “are maintained and modified to remain current and complete” and directs examiners to review compliance monitoring and corrective action reports.
Consumer compliance exams beginning after March 31, 2017 use the FFIEC’s Uniform Interagency Consumer Compliance Rating System. It rates the compliance program (policies and procedures, training, monitoring and/or audit, and consumer complaint response) and, under board and management oversight, change management.
In 2026, the Federal Reserve’s Consumer Compliance Outlook reported that Regulation E error-resolution violations were among the top-cited consumer compliance violations in its 2024 examinations of state member banks.
Cited problems included late or incomplete provisional-credit notices produced from vendor templates. The article also found that “gaps in internal reviews and audit coverage caused these violations to go undetected” and suggested periodic reviews of a sample of error investigations.
Frequently Asked Questions
What Is a Risk and Control Matrix?
A risk and control matrix is a register that lists each risk, the controls that mitigate it, the control owner, the testing frequency and the latest test result. Adding columns for the obligation and the policy statement turns the same matrix into a control map.
What Is a Common Control Framework in Banking?
A common control framework is a single set of controls, each mapped to every obligation and policy statement it satisfies. The control is tested once and the result is reused.
How Does Control Mapping Support an RCSA?
Control mapping supplies the control inventory that a risk and control self-assessment rates. Each mapped control already has an owner, a test method and recent test results, so business units rate control effectiveness against recorded evidence. Gaps found in the map appear in the RCSA as risks with no mitigating control.
A cloud-based document management system for financial organizations with workflow management and controls.
Request Demo- Document Lifecycle Management
- Automated Library Management
- Fast Implementation
- Reduced Costs