M4 — Path
Where to intervene first.
Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.
Off track
0
At risk
2
Controls stale
15
Unowned controls
0
| Status | Regulation | Deadline | Buffer | Controls | Stale | Unowned | Score |
|---|---|---|---|---|---|---|---|
| At risk | Consumer Duty — Annual Board Report UKFCA · 6 stale | 31 Jul 2026 | 15d | 12 | 6 | — | 63 |
| At risk | HMT Cryptoasset Regime — Perimeter UKHMT · 4 stale | 31 Jan 2027 | 22d | 6 | 4 | — | 52 |
| On track | Operational Resilience — Impact Tolerances Refresh UKPRA · 5 stale | 31 Aug 2026 | 30d | 9 | 5 | — | 15 |
| Not started | Sustainability Disclosure — Consultation UKFCA · no controls | — | 90d | — | — | — | 10 |
Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.