DISCOVER → INSPECT
Map products, systems, counterparties, processes, policies, data flows and reporting obligations before testing.
DERIVATIVES · CONTROL MATRIX · AUDIT READINESS
From derivatives risk to testable controls.
A practical control matrix for reviewing derivatives governance, counterparty exposure, valuation, margin and collateral, reporting, financial crime controls, exceptions and evidence. Use it as a structured review aid—not as a substitute for applicable law or institutional policy.
01 · CONTROL MATRIX
Risk → Control → Evidence → Test
The matrix is designed around a simple audit chain: identify the risk, identify the expected control, request evidence, then test whether the control is designed and operating effectively.
| Risk / area | Control objective | Illustrative evidence | Test / challenge |
|---|---|---|---|
| Product governance | Only approved derivative products and permitted activities are undertaken. | Product approval, limits, governance minutes, approved product inventory. | Trace sampled trades to approval and applicable conditions. |
| Underlying exposure | Hedging activity is supported by an identifiable and evidenced underlying exposure where required. | Contracts, invoices, exposure schedules, hedge documentation. | Reconcile sampled trades to underlying exposure and stated purpose. |
| Counterparty risk | Counterparty eligibility, creditworthiness and exposure limits are controlled. | KYC/CDD, credit assessment, limits, collateral agreements, exposure reports. | Recalculate selected exposure and compare with approved limits. |
| Execution & confirmation | Trade terms are captured completely and confirmed accurately. | Trade tickets, confirmations, timestamps, approval records. | Match front-office records to confirmations and source documentation. |
| Valuation | Valuations use appropriate models, inputs and independent challenge. | Valuation reports, model documentation, market data, IPV records. | Reperform selected valuations or challenge key assumptions and inputs. |
| Margin / collateral | Margin calls and collateral are calculated, settled and reconciled correctly. | Margin statements, collateral schedules, eligibility rules, dispute logs. | Reconcile selected calls, collateral balances and disputes. |
| Regulatory reporting | Required reports are complete, accurate, timely and traceable. | Submission records, reporting extracts, validation logs, exception queues. | Trace a sample from source trade through report and submission evidence. |
| AML/CFT & sanctions | Applicable customer, counterparty and transaction controls operate effectively. | KYC/CDD, beneficial ownership, screening results, alerts, investigations. | Sample relevant activity and test alerting, escalation and disposition. |
| Reconciliation | Trade, valuation, collateral and reporting records are reconciled and exceptions resolved. | Reconciliation reports, breaks, aging, approvals and remediation evidence. | Review aged breaks and verify timely resolution and escalation. |
| Governance | Management and Board receive meaningful information on material derivatives risks. | Risk dashboards, committee packs, minutes, limit-breach reports. | Assess whether reporting supports challenge, decisions and escalation. |
| Audit trail | Material decisions, exceptions and remediation actions remain evidentially traceable. | Decision logs, approvals, tickets, correspondence, remediation records. | Trace selected exceptions from identification through closure and retest. |
02 · AUDIT EXECUTION
Apply the RegTech Nexus audit method
VERIFY → TEST → CHALLENGE
Verify authoritative requirements, test samples and challenge unsupported assumptions, exceptions and management assertions.
ASSESS → RISK-RATE
Assess design and operating effectiveness, then risk-rate findings based on evidence, impact and likelihood.
REMEDIATE → RETEST
Agree evidence-based corrective actions, owners and target dates, then retest closure rather than relying on management confirmation alone.
ASSURE
Confirm that material findings are resolved, residual risk is understood and evidence supports the conclusion.
Evidence status
Classify conclusions as Fact, Observation, Inference, Assumption, Unverified or Recommendation. Where evidence is insufficient: INSUFFICIENT EVIDENCE — VERIFICATION REQUIRED.
03 · MODEL & CALCULATION ASSURANCE
Controls for the calculator layer
| Risk area | Control objective | Illustrative evidence | Test / challenge |
|---|---|---|---|
| Model governance | Each calculator has an identified model, assumptions, intended use and limitations. | Model card, methodology, version, owner/reviewer, validation date. | Verify the published model against source code and documented scope. |
| Calculation integrity | Material formulas produce reproducible outputs within defined tolerances. | Regression vectors, expected outputs, tolerances and test results. | Independently recompute selected outputs and challenge rounding or convention differences. |
| Input / unit control | Invalid values, unit mismatches and ambiguous conventions are identified before calculation. | Validation rules, unit labels, error handling and boundary tests. | Test blank, zero, negative, extreme and inconsistent inputs. |
| Change management | Formula or interface changes remain traceable and are regression-tested before release. | Git history, change log, version, test evidence and reviewer record. | Trace a material change from commit through validation and release. |
| Data / evidence | Calculator inputs and outputs used for professional review can be reconstructed. | Timestamp, inputs, units, output, model/version and evidence pack. | Attempt to reproduce a prior result from retained evidence. |
| Convention governance | Day-count, compounding, sign and unit conventions are explicit and consistent with the stated model. | Model notes, input labels, regression vectors and convention checks. | Recompute using the stated convention and challenge any cross-calculator sign or unit ambiguity. |
| Export integrity | Exported inputs, results and timestamps remain structured and traceable to the displayed calculation. | CSV field/value rows, UTC timestamp, print/PDF report and retained test evidence. | Compare on-page results with exported TXT/CSV/print outputs and verify metric-level separation. |
| Use boundary | Users do not mistake educational outputs for production valuation, regulatory capital, CCP margin or automated trading decisions. | Visible scope statements, result-level notices and methodology page. | Challenge whether a reasonable professional user could misinterpret the output. |
Model assurance boundary: A visible formula or disclaimer does not establish independent validation. Where evidence is unavailable: INSUFFICIENT EVIDENCE — VERIFICATION REQUIRED.
03 · MANAGEMENT VIEW
Questions senior management should be able to answer
Exposure
- Where are the material derivative exposures?
- Which counterparties and products drive them?
- Are limits and risk appetite respected?
Control
- Which controls are preventive vs detective?
- Which exceptions remain open?
- Can key decisions be evidenced?
Change
- What regulatory changes affect the portfolio?
- Which policies and controls need updating?
- Has implementation been independently verified?
Use boundary: This matrix is an illustrative control-review framework. It does not determine legal or regulatory applicability. Requirements must be verified against current primary sources, the institution's regulatory status, product characteristics and transaction facts.
04 · CONNECTED RESOURCES