M4 — Path

Where to intervene first.

Ranked by RAG, buffer days, stale controls and unowned dependencies. Named dependencies. Named owners. No status-report abstraction.

Off track

At risk

Controls stale

Unowned controls

Status	Regulation	Deadline	Buffer	Controls	Stale	Unowned	Score
On track	Operational Resilience — Impact Tolerances Refresh UKPRA · 5 stale	31 Aug 2026	30d	9	5	—	15
On track	CSRD — Sustainability Reporting EUEBA · 4 stale	31 Dec 2026	60d	8	4	—	12
On track	SFC Virtual Asset Licensing Regime HKSFC · 4 stale	28 Feb 2027	50d	5	4	—	12
On track	OCC Third-Party Risk Management Guidance USOCC · 4 stale	31 Mar 2027	80d	6	4	—	12
On track	OSFI B-10 — Third-Party Arrangements CAOSFI · 3 stale	30 Nov 2026	55d	6	3	—	9
On track	BCBS CVA Framework — Basel Finalisation GLOBALBCBS · 2 stale	1 Jan 2027	70d	6	2	—	6
On track	MAS Enhanced Due Diligence Rules — VA SGMAS · 2 stale	31 Oct 2026	40d	5	2	—	6

Score combines RAG (0–100), buffer penalty, stale controls (×3) and unowned dependencies (×5). Higher scores need attention first.