Model policy · version 1
Issues Management
Put every finding, complaint pattern, audit result, and bank concern into one log, rate it, fix it on a clock that matches its severity, and prove the fix held before closing it. This is how you show the sponsor bank and an examiner that what testing finds gets corrected.
What’s in this policy14 sections · Issues Management · Read the full policy
9Obligations · things you must do
18Evidence · records that prove it
2Monitoring · checks and deadlines
2Reporting · reports you must send
Does this apply to you?
Answer a few questions and each obligation is marked applies, likely, or needs more information.
Tell Leela about your companyHand over the whole policy
Every obligation in this policy, in one request.
What the policy requires
Automate
Leela can perform the work through your connected systems.
Monitor
Leela can watch for the trigger, keep the clock, and flag what is late.
Prepare for review
Leela can prepare the artifact and hand it to a person for review.
Human required
A person must do the work; Leela can track it and file the evidence.
TriggerEvent-driven · Each issue, on receipt through any intake channel
EvidenceIssues Log entry, Source record
TriggerEvent-driven · Each issue, at registration; re-rated if the investigation changes the picture
EvidenceSeverity rating
TriggerEvent-driven · Investigation opens same day (Critical), 1 to 2 business days (High), 5 (Moderate), 15 to 30 days (Low); the plan follows the investigation
EvidenceIssues Investigation Report, Remediation plan
TriggerEvent-driven · Each Critical issue: escalation within 1 business day, written summary within 2, daily updates until remediation is under way
EvidenceEscalation record, Critical issue summary, Regulatory notification assessment
TriggerEvent-driven · Each High issue: written report within 5 business days, weekly updates until remediation is under way
EvidenceHigh issue escalation, Weekly status updates
TriggerEvent-driven · Promptly on self-identified non-compliance; immediately on a material data integrity failure; within 5 business days of regulatory criticism
EvidenceBank notification, Regulator response approval
TriggerContinuous · Each open issue against its remediation due date; escalation the day it goes overdue
EvidenceIssues Log status history, Overdue escalation or extension record
TriggerEvent-driven · Each issue, when remediation is reported complete and before closure
EvidenceClosure validation record, Implementation evidence
TriggerQuarterly · Quarterly, in the month after quarter end; annually to the board
EvidenceQuarterly issues summary, Annual issues summary