Description

A focused course, tailored for you

The Business Unit Risk Manager's Quarterly Attestation Pack

A repeatable kit for the BU risk lead who owns the quarterly attestation, the issue log, and the second-line evidence trail at a US broker-dealer.

The quarterly attestation cycle eats two weeks every quarter and still arrives at the CCO's desk with gaps the second line catches in challenge.

$199 one-time

Tailored to your situation. Access within 24 hours. 30-day money-back.

Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.

Why this course

Business unit risk managers in a US broker-dealer environment sit at a hard junction. The first line owns the control and produces the evidence. The second line challenges it. Internal audit grades it. The regulators inspect it on cycle. You sit in the middle and have to assemble an attestation pack that all three accept, against a calendar that does not move. The issue log lives in one system, the audit findings in another, the supervisory exam items in a third, and the operational loss register in a fourth. The cover memo has to reconcile all four and stand up to challenge questions about residual risk ratings, control design changes mid-quarter, and overdue remediation. The work is not hard. The work is repetitive, evidence-heavy, and unforgiving when one control owner is late.

What you walk away with

A repeatable quarterly attestation pack template you can run cycle after cycle without rebuilding it.
An issue-log reconciliation method that ties open audit findings, supervisory items, and remediation status into a single view.
A second-line memo structure that survives CCO challenge without rework.
A control-owner request kit that gets evidence back inside the cycle, not after.
A residual risk rating method that holds up under internal audit and exam scrutiny.

The 12 modules

Module 1. The attestation cycle map

Lays out the full quarterly cycle from control inventory refresh to CCO sign-off. Names every artefact, every owner, every handoff, and every cycle-killing dependency. Includes a calendar template you can drop into Outlook and a control-owner request schedule that prevents the Wednesday-before-sign-off scramble. Tuned to the cadence of a US broker-dealer second-line review, not a generic GRC cycle.

Module 2. Control inventory reconciliation

Walks through reconciling the BU control inventory against the enterprise control taxonomy, the operational risk taxonomy, and whatever the SOX or 17a-5 scope mandates. Includes a worked example of a control that lives in three taxonomies with three different IDs and the mapping table that keeps the attestation pack coherent. The mapping is the foundation of every later module.

Module 3. Exception report narrative

The system-generated exception reports arrive as raw output. The second line wants a narrative. This module gives you a narrative template for each common exception type: failed reconciliation, late approval, override, threshold breach. Includes the four sentences the CCO reads first and the appendix the auditor reads after. Tuned to broker-dealer exception types, not generic IT exceptions.

Module 4. The issue log reconciliation method

The hardest piece of the cycle. Three sources: open audit findings, supervisory exam items, internal issues raised by the first line. Three systems. One BU-level view that has to reconcile all three by Wednesday of attestation week. This module gives you the reconciliation query, the exception treatment for items in one source but not another, and the BU-head dashboard that the head will actually use.

Module 5. Operational loss register integration

Brings the operational loss register into the attestation pack. Names which losses get attested against which controls, how to treat near-misses, and how to reconcile the loss register against the issue log when an issue gave rise to a loss. Includes the materiality threshold conversation you have to have with the CCO before the next cycle starts.

Module 6. The second-line memo structure

The memo is the pack. This module gives you a memo structure that holds: executive summary, residual risk position, exception narrative, issue status, loss register integration, and the sign-off page. Includes three worked memo examples at three different risk levels and the rewrite that survived a CCO challenge cycle. The rewrite is the lesson.

Module 7. Residual risk rating defence

The residual risk rating is the line where internal audit and the BU disagree most often. This module walks through the rating method, the supporting evidence for each level, and the conversation script for the CCO and internal audit when the rating moves cycle-over-cycle. Includes the four questions internal audit will ask and the answers that close them out cleanly.

Module 8. Control-owner request kit

Half the cycle delay is control owners returning evidence late or in the wrong shape. This module gives you a request kit: one email template per control type, a self-service evidence checklist, and an escalation path that does not burn relationships. Tested against control owners in trading, operations, technology, and compliance. The kit is what gets evidence back on time.

Module 9. Mid-quarter control design changes

A control changes mid-quarter and you have to attest against both the old and new design. This module gives you the treatment: when to split the attestation, when to attest against the new design with a footnote, when to escalate to the CCO before sign-off. Includes the change-control evidence the auditor expects and the version-control method on the control inventory.

Module 10. Internal audit pre-read

Internal audit reads the pack before the CCO signs it. This module gives you the pre-read kit: the cover note, the key reconciliations, the open items list, and the meeting structure. The goal is no surprises in the audit committee read-out two months later. Includes the three questions audit asks first and how to answer them on the pack.

Module 11. Supervisory exam alignment

FINRA, SEC, and the prudential supervisor inspect slices of the attestation pack on cycle. This module names which artefacts each regulator wants, the format they expect, and the cross-reference between your internal pack and the supervisory exam request list. Includes the request-tracker template that survives a multi-month exam without losing the audit trail.

Module 12. The next-cycle handoff

The cycle ends with a handoff to the next cycle. This module gives you the handoff pack: open items carried forward, control design changes flagged for the next attestation, lessons learned that change the request kit, and the calendar update for the next quarter. The handoff is the difference between a cycle that compounds and a cycle that resets.

How this addresses your situation

Specific modules that map to what you said you are dealing with.

Q-end attestation pack assembly inside a US broker-dealer business unit

Issue log reconciliation across audit findings, supervisory items, and BU-raised issues

Second-line memo defence under CCO and internal audit challenge

Supervisory exam request handling alongside the internal attestation cycle

What you get with this course

12 written modules in the Art of Service learning environment with downloadable templates
The quarterly attestation pack template, control inventory mapping table, issue log reconciliation query, and second-line memo skeleton
Worked examples drawn from broker-dealer BU risk cycles
The hand-built implementation playbook tailored to the artefacts and systems you currently use
30-day money-back guarantee

What you will have in hand by Day 1, Week 1, Month 1

Hour 1: account in the Art of Service learning environment provisioned, all 12 modules unlocked.

Within 24 hours: the hand-built implementation playbook is delivered alongside course access, tailored against the artefacts you name at intake.

Self-paced thereafter. Most learners run the course alongside one live attestation cycle.

Before and after

Before

Two weeks of cycle assembly, a memo that gets rewritten under CCO challenge, an issue log that reconciles differently every quarter, and control owners returning evidence in the wrong shape.

After

A repeatable cycle that runs to template, an issue log that reconciles the same way every quarter, a second-line memo that survives challenge on the first read, and control owners returning evidence inside the cycle.

What happens if you do not address this

Every cycle that runs ad-hoc compounds rework. The supervisory exam will hit on a cycle when the pack is thin, and the BU head will hear about it from the CCO before you do. The cost is not the rework. The cost is the credibility hit that takes two cycles to recover.

Who it is for

You are a Manager-level business unit risk professional inside a US broker-dealer or registered investment adviser. You own the quarterly attestation cycle for one or more business lines. You report into a BU head and dotted-line into the CRO function. You have between 8 and 30 control owners in the first line that you collect from. Internal audit reviews your pack. The CCO signs off on it. SEC, FINRA, and the prudential regulators see slices of it on cycle.

Who this is NOT for. Not for first-line control owners who only produce evidence. Not for internal audit. Not for the CRO at an enterprise level. Built specifically for the BU risk manager who assembles, reconciles, and defends the pack.

How it arrives

Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.

Time investment. Roughly 8 to 12 hours of reading and template work across the 12 modules. Most learners run the course in parallel with one live attestation cycle and complete it inside one quarter.

Why $199 is the right number

The alternative is buying a generic operational risk framework or sitting through a GRC vendor demo. Neither produces a quarterly attestation pack you can run cycle after cycle. This course is built around the artefacts a BU risk manager actually assembles.

FAQ

Is this specific to broker-dealers or does it cover banking too?

Built around the BU risk cycle inside a US broker-dealer or registered investment adviser. The reconciliation logic and memo structure translate to bank BU risk cycles, but the supervisory exam alignment module is broker-dealer specific.

Does the course assume a specific GRC platform?

No. The templates are platform-agnostic. The implementation playbook is tailored to your current platform at intake.

What does the per-buyer playbook actually contain?

A hand-built mapping of the course templates against the artefacts and systems you currently use, plus the rewrites of two of your existing artefacts to the standard the course defines.

Refund policy?

30-day money-back if the course does not earn its place in your cycle.

30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.

Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.