Every financial crime risk covered by a control, and the evidence that it works
Almanac, developed by Kompass, is a complete three-level risk taxonomy for money laundering, terrorist financing, sanctions, fraud, bribery, tax evasion and the enablers behind them, with a matching control library. Link controls to risks, track how each control is monitored, assessed and audited, and see coverage and evidence on one map. Start free in your browser, or talk to us about the hosted team edition. Almanac works alongside Sextant, the enterprise-wide risk assessment solution developed by Kompass and already in use with clients. A full description of Sextant will follow here.
One taxonomy, three levels
11 Level 1 categories, 76 Level 2 themes and 324 Level 3 risk events. Controls sit at the same three levels, so a framework control, a programme control and an operational control can each be tied to the risk it addresses.
Coverage you can see
A coverage map shows every Level 3 risk as a square, colored by whether it has a control, whether that control has been assessed, and whether accepted evidence is stored against it. Gaps stand out at once.
Effectiveness with a clear rule
Each control's rating comes from the most independent current evidence, reduced by open regulatory findings and overdue remediation. The steps are shown on screen, so you can explain a rating to an auditor.
What is in the library
411 risks and 798 controls across 11 categories. Every risk has at least one control at its own level.
- Money laundering
- Terrorist financing
- Sanctions and proliferation financing
- External fraud
- Internal fraud and insider misconduct
- Bribery and corruption
- Facilitation of tax evasion
- Governance and compliance management
- Digital, technology, data, AI and model risk
- Third parties and outsourcing
- Market abuse and insider dealing
Each control has an objective, description, type, frequency, owner role, the evidence an assurance reviewer would expect, a test procedure and common failure modes. Regulation is referred to by topic only. You can add, edit and delete risks and controls to fit your institution.
What you can track against each control
- Continuous monitoring: results of automated and manual checks, with the latest result counting toward effectiveness while it is current.
- Control owner self-assessments: design and operating ratings with an owner attestation.
- Assurance reviews and audits: second-line testing and internal or external audit opinions.
- Regulatory findings: findings from supervisors and monitors that relate to the control. Open Critical and High findings reduce the rating.
- Remediation: actions with owners and due dates. An overdue action prevents an Effective rating.
- Evidence: upload documents and test results, or link to them, and mark each as Draft, Reviewed or Accepted.
An owner for every risk and every control
Every risk and control, at every level, has an owner. Add as many risks and controls as you need, at any level. Each owner has a profile that summarizes the risks and controls they own and their status: coverage, effectiveness, self-assessments due, open regulatory findings and remediation actions assigned to them. During remediation, the owners of the impacted controls and risks are the people accountable for the actions.
- Assign in bulk: by risk category, by level, or by the suggested owner role on each control, or import owners and assignments from a spreadsheet.
- Owner profiles: print or export a profile to send to an owner. The hosted team edition gives each owner their own sign-in, and limits them to updating their own assessments, actions and evidence.
Connect to your enterprise risk assessment engine
Import control effectiveness data from your engine as a file or from a secured endpoint, map its field names, and see it alongside your own monitoring and assessments. Export the computed effectiveness and risk links for your engine or data warehouse to load. The hosted edition exposes the same structure as an API.
Two editions
Local edition
- Runs in your browser; the library and evidence stay on your device
- Full taxonomy and control library, editable
- Coverage map, dashboard and printable report
- File and endpoint import of effectiveness data
- CSV and JSON export, with backup and restore
Team edition (hosted)
- Several users with roles, and sign-in with your corporate identity
- Control owners update their own assessments and upload evidence
- A server-side audit log that users cannot edit
- A secured API to exchange effectiveness data with your risk engine
- Hosting in the UAE and encrypted evidence storage
Thank you. A Kompass partner will be in touch.
How we handle your data
- In the local edition everything you enter, and every file you upload, stays in your browser on your device. Kompass does not receive it.
- We ask for your work email once, so we can follow up. That is the only thing we receive.
- Clearing your browser data deletes the workspace. Export a backup regularly.
- Do not enter passwords, keys or customer data. Keep sensitive evidence in your own systems and link to it.
Questions
Does this replace a governance, risk and compliance platform?
No. It is a focused library for financial crime risks and controls. If you already have a platform, export the library as CSV to load into it, or use the two side by side.
Does using the library make us compliant?
No tool does. The library supports your own control framework. Whether your controls meet your obligations depends on your business, your jurisdictions and how the controls actually operate.
Is the content verified against regulation?
Regulation is cited by topic, not by section, and the library shows when its sources were last checked. Review it against the rules that apply to you.
Can Kompass help us tailor and test the controls?
Yes. See our financial crime compliance services, and our readiness assessments.