Domain F · Area F-CA1 · Reporting risk, controls, evidence and working papers
F.2Design, operate and evidence reporting controls
Working Draft version 1.1
Purpose and scope
This unit covers the capability to design, implement, perform, review and evidence preventive, detective and corrective controls over sustainability reporting processes. It includes control precision, frequency, ownership, segregation, automated and manual elements, evidence, exception handling, reviewer competence, design evaluation, operating performance and controlled change.
Applied competency statement
Can design, operate, review and evidence proportionate sustainability reporting controls that address defined risks and control objectives and produce a clear record of performance, exceptions and follow-up.
Boundary and escalation
This unit concerns management and reporting controls and does not provide internal audit or independent assurance. Formal testing conclusions about enterprise IT general controls, cyber-security, legal compliance or assurance reliance require the appropriate qualified functions. The control owner remains accountable for operation and evidence.
Key quality risks
Controls not linked to defined risks; review controls without sufficient precision; reliance on sign-off without evidence; control owner and reviewer not competent or independent enough for the risk; automated controls assumed to work without testing; manual workarounds bypassing the approved process; exceptions not investigated; controls performed after publication; evidence created retrospectively; and control changes made without approval or impact assessment.
F.2-K01
Understands preventive, detective, corrective, manual, automated, hybrid, entity-level, process, application, review and monitoring controls.
Knowledge Type: Control types · Normative Weight: Core
F.2-K02
Understands control objective, risk linkage, owner, performer, reviewer, frequency, population, threshold, precision, evidence, exception and escalation fields.
Knowledge Type: Control design · Normative Weight: Core
F.2-K03
Understands expectations, data used, level of aggregation, investigation thresholds, reviewer competence, documentation and what makes a review control sufficiently precise.
Knowledge Type: Review controls · Normative Weight: Core
F.2-K04
Understands system configuration, access, interfaces, reports, spreadsheets, source data, IT dependencies and the need to validate information used in a control.
Knowledge Type: Automated and dependent controls · Normative Weight: Core
F.2-K05
Understands contemporaneous evidence, timestamps, preparer and reviewer identification, exceptions, follow-up, re-performance, sign-off and retention.
Knowledge Type: Operating evidence · Normative Weight: Core
F.2-K06
Understands design effectiveness, implementation, operating performance, deviations, frequency, sampling where relevant, compensating controls, change control and the boundary with audit and assurance.
Knowledge Type: Design and operation evaluation · Normative Weight: Core
F.2-S01
Translate a control objective into a specific control activity with defined owner, frequency, precision, evidence and escalation.
Skill Type: Core applied capability · Observable Output or Result: Reporting control design
F.2-S02
Develop the procedure, tools, templates, system configuration and training needed for consistent control operation.
Skill Type: Implementation · Observable Output or Result: Reporting control design and procedure
F.2-S03
Perform or coordinate the control, retain contemporaneous evidence and identify, investigate and escalate exceptions.
Skill Type: Operation and evidence · Observable Output or Result: Control performance and evidence record
F.2-S04
Evaluate whether the control is designed appropriately, implemented and operating as intended and distinguish a deviation from a design gap.
Skill Type: Review and evaluation · Observable Output or Result: Control design and operating-effectiveness assessment
F.2-S05
Control changes to the control, evidence, system or process and define compensating actions and follow-up where performance is deficient.
Skill Type: Change and remediation · Observable Output or Result: Control change and remediation record
F.2-B01
Does not recreate control evidence after the event or treat an unsigned checklist as proof that the control operated.
Behaviour Type: Contemporaneous evidence · Non-compensable Requirement: No
F.2-B02
Does not perform or approve a control without clarity about competence, segregation, decision authority and exception responsibility.
Behaviour Type: Control ownership · Non-compensable Requirement: No
F.2-B03
Records and investigates deviations rather than adjusting thresholds, deleting evidence or passing the control to meet the timetable.
Behaviour Type: Exception transparency · Non-compensable Requirement: No
Typical tasks · 4
F.2-T01
Define the control activity, population, owner, frequency, threshold, precision, evidence, review and escalation from the approved control objective.
Primary Output Link: F.2-O01
F.2-T02
Document and implement the procedure, template, system or workflow and train control performers and reviewers.
Primary Output Link: F.2-O01
F.2-T03
Operate the control, retain evidence and investigate and route exceptions and late or failed performance.
Primary Output Link: F.2-O02
F.2-T04
Evaluate design and operating performance, record deviations and changes and define compensating controls and remediation.
Primary Output Link: F.2-O03
Level 1 · Foundation
F.2-L1-01
Can perform an established reporting control, retain the specified evidence and record and escalate exceptions using the approved procedure.
Indicator Dimension: Task execution
F.2-L1-02
Can identify obvious missing evidence, late operation, threshold or segregation issues and distinguish a failed control from an unresolved exception.
Indicator Dimension: Quality, judgement and accountability
Level 2 · Practitioner
F.2-L2-01
Can independently design, implement and operate proportionate controls for a moderately complex reporting process and evaluate routine design and operating issues.
Indicator Dimension: Task execution
F.2-L2-02
Can determine control precision and evidence, resolve routine deviations and explain compensating actions, residual risk and remediation to management.
Indicator Dimension: Quality, judgement and accountability
Level 3 · Advanced Practitioner
F.2-L3-01
Can design or critically review enterprise control methodologies across complex groups, systems, estimates, disclosures and assurance-sensitive processes.
Indicator Dimension: Method design and review
F.2-L3-02
Can challenge ineffective or symbolic controls, resolve significant design and operation failures and advise governance bodies on residual risk, compensating controls and remediation priorities.
Indicator Dimension: Leadership and governance
Illustrative evidence · 6
F.2-E01
Reporting control design and procedure linked to risk, objective, owner, frequency, precision and evidence.
Evidence Type: Work product
F.2-E02
Control performance and evidence record with timestamps, performer, reviewer, exceptions and follow-up.
Evidence Type: Work product
F.2-E03
Control design and operating-effectiveness assessment with deviations and residual risk.
Evidence Type: Work product
F.2-E04
Re-performance, control-change, exception and compensating-control trail.
Evidence Type: Process evidence
F.2-E05
Documented control-owner, IT, finance, legal, quality, internal-audit or management review and the practitioner's response.
Evidence Type: Review evidence
F.2-E06
Observed performance or evaluation of a reporting control and exception.
Evidence Type: Observed performance
Assessment · 3
F.2-A-L1
Control-operation exercise, evidence review and situational judgement
Correct control performance; evidence completeness; exception recognition; segregation and escalation awareness.
F.2-A-L2
Integrated control-design case and professional memorandum
Risk linkage; control precision; evidence and operation; design-versus-operation judgement; remediation and communication.
F.2-A-L3
Complex control-environment case, portfolio and oral defence
Method design; precision and evidence; automation dependencies; challenge of symbolic controls; governance advice and oral defence.
| From | To | Type | Rationale |
|---|---|---|---|
| C.2 | F.2 | Risk and control linkage | Control ownership, performance and review depend on clear reporting roles and segregation. |
| D.4 | F.2 | Risk and control linkage | Submission, review and exception workflows implement reporting control activities. |
| E.7 | F.2 | Risk and control linkage | Validation and reconciliation procedures may operate as formal reporting controls. |
| E.10 | F.2 | Risk and control linkage | Spreadsheet, application and interface controls are part of the reporting control environment. |
| F.1 | F.2 | Feeds into | Control objectives are operationalised through specific reporting controls. |
| F.2 | F.1 | Prerequisite | Control design should respond to a defined reporting risk and control objective. |
| F.2 | E.7 | Risk and control linkage | Validation and reconciliation procedures may operate as preventive or detective reporting controls. |
| F.2 | E.10 | Risk and control linkage | Spreadsheet and application controls form part of the reporting control environment. |
| F.2 | F.5 | Risk and control linkage | Control performance and exceptions inform management review and sign-off. |
| F.2 | F.6 | Risk and control linkage | Design and operating failures become inputs to deficiency assessment and remediation. |
| F.6 | F.2 | Prerequisite | Deficiency classification depends on the expected design and operation of the reporting control. |
| H.9 | F.2 | Risk and control linkage | Supervision and review quality affect the design, operation and evidence of reporting controls. |
| I.2 | F.2 | Risk and control linkage | Automation procedures may operate as reporting controls and require contemporaneous evidence. |
| Role | Target level | Relevance | Evidence expectation |
|---|---|---|---|
| Corporate Sustainability Reporting Practitioner | Practitioner | Required? | A case or work sample demonstrating independent performance, documented judgement and a reviewable professional output. |
| Sustainability Reporting Manager or Lead | Advanced Practitioner | Role-defining? | A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability. |
| Sustainability Reporting Adviser or Consultant | Advanced Practitioner | Role-defining? | A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability. |
| Sustainability Data, Systems and Controls Specialist | Advanced Practitioner | Role-defining? | A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability. |
| Assurance Readiness and Reporting Quality Specialist | Advanced Practitioner | Role-defining? | A complex case or verified portfolio, supplemented by oral or observed defence, demonstrating method design, challenge and governance capability. |
| Investor, Capital Markets and Ratings Disclosure Specialist | Foundation | Supporting? | A supervised or defined work sample showing correct application, traceability and recognition of escalation needs. |