M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

Unowned controls

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score
On track	Operational Resilience — Impact Tolerances Refresh UKPRA · 9 stale	31 Aug 2026	30d	9	9	—	27
On track	CSRD — Sustainability Reporting EUEBA · 8 stale	31 Dec 2026	60d	8	8	—	24
On track	OSFI B-10 — Third-Party Arrangements CAOSFI · 6 stale	30 Nov 2026	55d	6	6	—	18
On track	BCBS CVA Framework — Basel Finalisation GLOBALBCBS · 6 stale	1 Jan 2027	70d	6	6	—	18
On track	OCC Third-Party Risk Management Guidance USOCC · 6 stale	31 Mar 2027	80d	6	6	—	18
On track	SFC Virtual Asset Licensing Regime HKSFC · 5 stale	28 Feb 2027	50d	5	5	—	15
On track	MAS Enhanced Due Diligence Rules — VA SGMAS · 5 stale	31 Oct 2026	40d	5	5	—	15

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.