# Compliance Control Register

A living map of each obligation to a named control, an accountable owner, and the evidence that proves it works.

## Why the CCAR-P exam tests this

The exam checks whether you can turn abstract compliance requirements into auditable, owned, evidenced controls.

## Definition

A **compliance control register** is the structured record that connects what you *must* do to what you *actually* do. Each row links four things: an **obligation** (a regulatory, contractual, or policy requirement) → a **named control** (the specific mechanism that satisfies it) → an **owner** (a named, accountable person or role) → **evidence** (the artifact — log, test result, config, sign-off — that proves the control operates).

The discipline forces every requirement to be *implemented, owned, and provable*. An obligation with no control is a gap; a control with no owner drifts; a control with no evidence cannot survive an audit. For AI systems the register captures items like PII-redaction, human-escalation policies, fail-closed guardrails, and model-usage logging.

The register is **living**: reviewed on a cadence, updated when the system or the obligations change, and used to demonstrate coverage to auditors. It is the governance backbone that ties the technical controls in this domain to accountability.

## Exam trap

Treating a written policy as a control is the trap — an obligation is only satisfied when it maps to a named control with an owner and produced evidence, not just prose in a document.

## Commonly confused with

- **alignment-boundary** — The register is your app-layer accountability record; the alignment boundary defines which risks the app layer must own in the first place.
- **least-privilege** — Least-privilege is a control that appears in the register, not the register itself.

## Related

- alignment-boundary
- least-privilege
- pii-redaction
- escalate-on-policy-not-confidence

---

Source: Claude Cert Prep — an independent, unofficial CCAR-P study resource (domain P5). Not affiliated with Anthropic.