{"text_format":"1","workbook":"xlsx","n_sheets":4,"sheets":["Home","IT Controls Form","QA ","Issue Tracking"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":4,"defined_names":41,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Home","index":0,"n_rows":15,"n_cols":9,"rows_kept":15,"cut":false,"hidden":true,"merged":[]}
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,"Options",null,"Description"]
[]
[null,null,null,null,null,null,null,null,"IT Assessment form for firms applying for MiFID permissions"]
[]
[]
[null,null,null,null,null,null,null,null,"IT Assessment form for all other firms"]

{"sheet":"IT Controls Form","index":1,"n_rows":39,"n_cols":13,"rows_kept":39,"cut":false,"hidden":false,"merged":[[2,9,4,9],[5,9,8,9],[9,9,10,9],[11,9,15,9],[16,9,22,9],[23,12,25,12],[26,9,29,9],[30,9,32,9],[33,9,36,9],[37,9,38,9],[33,12,36,12],[37,12,38,12],[26,12,29,12],[30,12,32,12],[23,9,25,9],[2,12,4,12],[5,12,8,12],[9,12,10,12],[11,12,15,12],[16,12,22,12],[26,1,29,1],[30,1,32,1],[33,1,36,1],[37,1,38,1],[2,1,4,1],[5,1,8,1],[9,1,10,1],[11,1,15,1],[16,1,22,1],[23,1,25,1]]}
["MIFID",null,"       Detailed IT Controls Form ",null,null,null,null,null,"Hidden from public view",null,null,"                   Hidden "]
["Scope","Domain","Control","Response","Evidence","Supporting Narrative (include evidence reference)"," Evidence Guidelines","Meets expectations?","Reviewer Comments (include name and date)","Section Status",null,"     Scoring Section"]
["SYSC","Governance, Strategy & Culture","Do you have a documented and formalised governance structure for operational resilience that is consistent with the organisation's s governance and controls? ","Select","Select",null,"Organisation and governance  structure depicting roles and responsibilities\n","Select",null,{"$f":"IF(M3<=-9000,\"Review Pending\",IF(M3>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,{"$f":"IF(OR(H3=\"Yes\",H3=\"Not-Applicable\"),10,IF(H3=\"No\",-100,-10000))","v":-10000},{"$f":"SUM(L3:L5)","v":-30000}]
["SYSC",null,"Do you provide your Board / senior management with appropriate information to enable them to have shared understanding, oversight and decision making on areas of security and operational resilience?","Select","Select",null,"Recent Board packs & board MI","Select",null,null,null,-10000]
["SYSC",null,"Have you obtained independent assurance (internal or external) about how far your IT\nconforms with relevant policies, practices and regulations ","Select","Select",null,"Recent Internal / External assurance reports (audit / 2nd line)","Select",null,null,null,-10000]
["SYSC","Risk Management","Do you have an established risk management process to identify, evaluate, assess, prioritise, categorise risks?","Select","Select",null,"1. Risk framework / policy\n2. Risk Report showing key IT / cyber risks ","Select",null,{"$f":"IF(M6<=-9000,\"Review Pending\",IF(M6>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L6:L9)","v":-40000}]
["SYSC",null,"Do you have established processes to monitor IT risk action plans and obtain assurance on whether IT risk is being managed in line with risk appetite and tolerance? ","Select","Select",null,"1.Recent assurance report on effectiveness of the risk function.\n2.Board packs & board MI","Select",null,null,null,-10000]
["SYSC",null,"Are your management aware of the  key IT risks and have access to key risk indicators to monitor their status?","Select","Select",null,"Board packs & board MI","Select",null,null,null,-10000]
["SYSC",null,"Are IT systems and controls regularly reviewed/ audited/ self-assessed / validated by an independent and qualified audit function with appropriate management oversight?","Select","Select",null,"1.Audit / Validation / Self-Assessment / Compliance Assessment frequency and reports\n2.Management oversight, reporting and  escalation mechanism of outstanding audit issues & breaches","Select",null,null,null,-10000]
["SYSC","Service Mapping and Design","Do you have written policies and procedures for identifying, delivering and maintaining resilient business services?","Select","Select",null,"1.Service Design policy and procedures\n2. Configuration and Asset Management policy and procedures\n","Select",null,{"$f":"IF(M10<=-9000,\"Review Pending\",IF(M10>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L10:L11)","v":-20000}]
["SYSC",null," Have you identified all important business services, required resources and interdependencies, and their criticality?","Select","Select",null,"1. Service Design policy and procedures\n2. Configuration Management policy and procedures","Select",null,null,null,-10000]
["SYSC","Service continuity and Testing","Is there documented  Service Continuity plan and testing policies and procedures in place?","Select","Select",null,"Service Continuity policy and procedures","Select",null,{"$f":"IF(M12<=-9000,\"Review Pending\",IF(M12>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L12:L16)","v":-50000}]
["SYSC",null,"Do you have an effective crisis communication plan in place to notify relevant internal and external stakeholders?","Select","Select",null,"Crisis communication plans","Select",null,null,null,-10000]
["SYSC",null,"Do you carry out IT continuity tests on a regular basis or after major changes in IT infrastructure or to the business and related applications?","Select","Select",null,"IT Continuity test results","Select",null,null,null,-10000]
["SYSC",null,"As part of the IT continuity framework is a business impact analysis (BIA) completed regularly for critical services?","Select","Select",null,"Service Continuity Plan showing planned tests","Select",null,null,null,-10000]
["SYSC",null,"Based on the BIAs, have you developed response and recovery plans based on plausible scenarios that may prompt activation of actions to meet the recovery time objectives of the firm's critical services","Select","Select",null,"BIA for critical service's","Select",null,null,null,-10000]
["SYSC","Change Management","Do you have documented change management policies and procedures in place? ","Select","Select",null,"1. Change Management policies and procedures\n2. Change Management process and controls document","Select",null,{"$f":"IF(M17<=-9000,\"Review Pending\",IF(M17>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L17:L23)","v":-70000}]
["SYSC",null,"Do you have visibility of timelines/scope/risks of changes and projects across your IT estate and 3rd parties. ","Select","Select",null," Briefly explain how do you track this information","Select",null,null,null,-10000]
["SYSC",null,"Are your internal and 3rd party changes approved from both a business and technical perspective. ","Select","Select",null," Briefly explain how do you track this information","Select",null,null,null,-10000]
["SYSC",null,"Do you test your changes before deploying them into a production environment?","Select","Select",null,"1. Change testing policy\n2. Incident report highlighting incidents caused by change","Select",null,null,null,-10000]
["SYSC",null,"Do you report change management metrics and KPI's to management?","Select","Select",null,"1. Board / Exec report extracts.\n2. Change Reporting and Management Information","Select",null,null,null,-10000]
["SYSC",null,"Do you ensure that changes meet the firms security policy and procedures?","Select","Select",null," Briefly explain how do you track this information","Select",null,null,null,-10000]
["SYSC",null,"Do you keep an audit trail of all changes to ensure that they follow agreed procedures so changes can be tracked?","Select","Select",null," Briefly explain how do you track this information\n","Select",null,null,null,-10000]
["SYSC","Incident Management","Do you have documented  policies and procedures in place to manage incidents?","Select","Select",null,"Incident Management policy and procedures","Select",null,{"$f":"IF(M24<=-9000,\"Review Pending\",IF(M24>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L24:L26)","v":-30000}]
["SYSC",null,"Do you have Internal / External  communications plans and documentation in place for incident response scenarios?","Select","Select",null,"Incident communication plan","Select",null,null,null,-10000]
["SYSC",null,"Do you perform adequate post-incident reviews and take steps to identify the root cause and lessons learnt?","Select","Select",null,"Incident Management and Problem Management policy and procedures","Select",null,null,null,-10000]
["SYSC","Third Party Management","Have you established supplier management policies and procedures that address specific concerns such as roles and responsibilities, service levels, monitoring and reporting, transition arrangement, security standards and controls, right to audit etc?","Select","Select",null,"1. Third Party / Supplier Management Policy\n2. Outputs from recent due diligence reviews e.g. risk and issue reports\n","Select",null,{"$f":"IF(M27<=-9000,\"Review Pending\",IF(M27>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L27:L30)","v":-40000}]
["SYSC",null,"Have you identified and categorised all your suppliers according to the service delivered, criticality and significance?","Select","Select",null,"1. Supplier assessment / categorisation policy and procedures\n","Select",null,null,null,-10000]
["SYSC",null,"Do you regularly review service levels and underpinning contracts with both internal and external service providers?","Select","Select",null,"1. MI / Delivery reports for key suppliers\n2. Board pack showing 3rd party KPI's","Select",null,null,null,-10000]
["SYSC",null,"Have you established a process to monitor service delivery to ensure that suppliers are meeting contracted requirements?","Select","Select",null,"1. MI / Delivery reports for key suppliers\n2. Board pack showing 3rd party KPI's\n3. Risk report highlighting 3rd party risks ","Select",null,null,null,-10000]
["SYSC","Identity and Access Management (IAM)","Do you have established policies and procedures to ensure that all access users have the least privileged level of access required, to enable and protect business services?","Select","Select",null,"IAM policy and procedures","Select",null,{"$f":"IF(M31<=-9000,\"Review Pending\",IF(M31>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L31:L33)","v":-30000}]
["SYSC",null,"Do you monitor, log and review access user rights and activities to detect and respond to inappropriate activity?","Select","Select",null,"1. IAM assurance policy and monitoring mechanisms\n2. 2nd / 3rd line IAM reviews\n","Select",null,null,null,-10000]
["SYSC",null,"Do you review user access rights regularly to ensure that users have the least privileged level of access required?","Select","Select",null,"1.IAM assurance policy and monitoring mechanisms\n2. 2nd / 3rd line IAM reviews","Select",null,null,null,-10000]
["SYSC","Threat and Vulnerability Management (TVM)","Have you established policies and procedures to identify, assess, and prioritise threats and vulnerabilities?","Select","Select",null,"Vulnerability management policy and procedures\n","Select",null,{"$f":"IF(M34<=-9000,\"Review Pending\",IF(M34>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,-10000,{"$f":"SUM(L34:L37)","v":-40000}]
["SYSC",null,"Do you gather and evaluate threats and address vulnerabilities, making continuous improvements to reduce the likelihood and impact of exploitation?","Select","Select",null,"1.Threat scenario testing and outcomes\n2. Management and Risk reports highlighting  threats","Select",null,null,null,-10000]
["SYSC",null,"Do you assess the effectiveness of your security controls on a regular basis?","Select","Select",null,"1. TVM Review / Assurance reports\n2. Risk Register highlighting key risks related to security controls","Select",null,null,null,-10000]
["SYSC",null,"Do you carry out penetration testing of your IT estate at regular intervals?","Select","Select",null,"1. Latest Penetration testing report\n2. Penetration testing policy ","Select",null,null,null,-10000]
["SYSC","Physical Environment Management (PEM)","Do you monitor, log and review environmental and security controls to detect and respond to inappropriate activity (e.g. using a security operations centre )?","Select","Select",null,"Relevant MI and KRIs are distributed to the relevant senior management and Boards or subcommittees (Board and subcommittees packs and relevant minutes). ","Yes",null,{"$f":"IF(M38<=-9000,\"Review Pending\",IF(M38>10,\"Meets Expectations\",\"Does not meet expectations\"))","v":"Review Pending"},null,10,{"$f":"SUM(L38:L39)","v":-9990}]
["SYSC",null,"Do you have proportionate controls  to maintain the operation and security of business services. This includes controls around physical access, document management, asset protection, hazard protection etc)","Select","Select",null,"Policy and procedures related to physical access, assets and related physical environments","Select",null,null,null,-10000]

{"sheet":"QA ","index":2,"n_rows":17,"n_cols":6,"rows_kept":17,"cut":false,"hidden":true,"merged":[]}
[null,null,null," Peer Review and QA"]
[]
[null,"Category","Question","Guideline","Response","Peer Review Comments"]
[null,"Records Management","Was key information stored correctly? ","Key documents which provide evidence supporting the assessment are stored in the INTACT case, or LiveLink folder where appropriate (e.g. sensitive documents or email correspondence). ","Select"]
[null,"Records Management","Was the case labelled/categorised correctly?","Was the controls form completed with relevant information for all sections with appropriate comments from reviewer.","Select"]
[null,"Handling Sensitive Information","Was sensitive information related to a case handled correctly? ","Where sensitive information is relevant to the assessment (e.g. controlled distribution documents,  watch list entries etc.), this is managed in line with the FCA’s records management policies. ","Select"]
[null,"Adherence to Process","Was the case proactively managed?","Did the TRC case worker review the application in a timely manner? \n","Select"]
[null,"Adherence to Process","Have the right people been involved in the assessment process?","Where the TRC case worker had to assess areas outside his/her area of expertise,  did the case worker involve relevant specialists either from TRC or other areas within the FCA ","Select"]
[null,"Exercising Judgement","Is the assessment of the information received appropriate?","The supervisor identified and gathered the relevant information required to complete the assessment. This may include information gathered during Reactive cases, multi-firm supervisory work, previous TRC assessments on this firm (if applicable), or trends identified from other cases.","Select"]
[null,"Exercising Judgement","Are the actions proposed to respond to areas of concern sufficient to mitigate the risk? ","The TRC case worker has identified key areas of concern and recommended action for the firm and authorisation team to mitigate the risk of harm.","Select"]
[null,"Exercising Judgement","Was the overall decision reasonable based on the information available for the assessment?","The assessment was proportionate based on the information available.\nWhere key information could not be obtained, it is clear why this was not available and how it could have altered the case worker's overall decision. \nThe conclusions are logical and the authorisation team has clear direction as to whether there is a risk if harm.\nAny recommended actions are sufficient to address the issues and proportionate.\n","Select"]
[null,"Evidencing ","Did we clearly record the rationale for actions/decision?","The assessment demonstrates that the key issues have been understood and articulated in sufficient detail. Evidence is factual rather than supported by subjective opinion.\n","Select"]
[null,"Communications","Were key communications to the of good quality?","Key communication with the firm and/or the supervisory team were clear, concise and constructive.\nThe comments and closure report are clearly written, using language a non-TRC expert can understand. \n","Select"]
[]
[]
[]
[null,"Review Date","Peer Reviewer Name"]

{"sheet":"Issue Tracking","index":3,"n_rows":38,"n_cols":5,"rows_kept":38,"cut":false,"hidden":true,"merged":[]}
[null,null,null,null,"ISSUE TRACKER"]
["No. ","Date","Issue Status","Issue Title","Resolution Steps"]
[1,null,"Select"]
[2,null,"Select"]
[3,null,"Select"]
[4,null,"Select"]
[5,null,"Select"]
[6,null,"Select"]
[7,null,"Select"]
[8,null,"Select"]
[9,null,"Select"]
[10,null,"Select"]
[11,null,"Select"]
[12,null,"Select"]
[13,null,"Select"]
[14,null,"Select"]
[15,null,"Select"]
[16,null,"Select"]
[17,null,"Select"]
[18,null,"Select"]
[19,null,"Select"]
[20,null,"Select"]
[21,null,"Select"]
[22,null,"Select"]
[23,null,"Select"]
[24,null,"Select"]
[25,null,"Select"]
[26,null,"Select"]
[27,null,"Select"]
[28,null,"Select"]
[29,null,"Select"]
[30,null,"Select"]
[31,null,"Select"]
[32,null,"Select"]
[33,null,"Select"]
[34,null,"Select"]
[35,null,"Select"]
[36,null,"Select"]