Compliance Control Register
Also: control register · control matrix · obligations register
A living map of each obligation to a named control, an accountable owner, and the evidence that proves it works.
Why CCAR-P tests this
The exam checks whether you can turn abstract compliance requirements into auditable, owned, evidenced controls.
A compliance control register is the structured record that connects what you must do to what you actually do. Each row links four things: an obligation (a regulatory, contractual, or policy requirement) → a named control (the specific mechanism that satisfies it) → an owner (a named, accountable person or role) → evidence (the artifact — log, test result, config, sign-off — that proves the control operates).
The discipline forces every requirement to be implemented, owned, and provable. An obligation with no control is a gap; a control with no owner drifts; a control with no evidence cannot survive an audit. For AI systems the register captures items like PII-redaction, human-escalation policies, fail-closed guardrails, and model-usage logging.
The register is living: reviewed on a cadence, updated when the system or the obligations change, and used to demonstrate coverage to auditors. It is the governance backbone that ties the technical controls in this domain to accountability.
Exam trap
Treating a written policy as a control is the trap — an obligation is only satisfied when it maps to a named control with an owner and produced evidence, not just prose in a document.
Commonly confused with
Independent, unofficial study material from Claude Cert Prep. Not affiliated with Anthropic.