# The SAMA CRFR Domain 9 Evidence Gap That Adds Four Months: Why Policy-Approval Records Do Not Prove Implementation
When a compliance head at a SAMA-regulated financial institution commissions a SAMA CRFR compliance gap analysis evidence review, the expectation is straightforward: identify where the organization stands against each Domain 9 sub-control, quantify the gaps, and produce a roadmap. Yet most gap analyses we inherit conclude with a finding that surprises no one but delays remediation by four months: the institution possesses board-approved policies, a compliance register, and a risk-assessment calendar, but cannot demonstrate that compliance obligations are identified, assigned, monitored and reported in the operational manner Domain 9 requires.
The Saudi Central Bank's Cyber Resilience and Fraud Risk Framework Domain 9 addresses compliance management. It requires regulated institutions to establish and maintain processes that identify regulatory obligations, assign ownership, monitor adherence, track exceptions, and report status to senior management and the board. The domain does not ask whether a policy exists; it asks whether the institution can prove that the policy is implemented, that controls are operating, and that governance bodies receive timely, accurate information about compliance posture.
This article explains which twelve evidence artifacts Domain 9 sub-controls actually require, the format SAMA examiners accept during assessments, and how to structure a compliance-assessment project that collects implementation proof in parallel with policy review, avoiding the extended evidence-gathering phase that follows most initial gap analyses.
What Domain 9 Actually Requires: Obligations, Ownership, Monitoring and Reporting
Domain 9 sub-controls establish four operational requirements that go beyond documentation.
Identification of obligations. The institution must maintain a current inventory of all applicable regulatory, legal and contractual compliance obligations. This inventory must be reviewed and updated when regulations change, when the institution enters new markets or launches new products, and at defined intervals. The evidence is not a static list; it is a register with version history, change logs, and records of periodic reviews.
Assignment of ownership. Each compliance obligation must be assigned to a named control owner who is responsible for ensuring adherence. The evidence is not an organizational chart or a RACI matrix in a policy appendix; it is a record that each control owner has acknowledged the assignment, understands the obligation, and has accepted accountability.
Monitoring of adherence. The institution must operate a process that periodically assesses whether each obligation is being met. This typically takes the form of control self-assessments, compliance testing, or internal-audit reviews. The evidence is not a monitoring policy; it is the logs, test results, self-assessment questionnaires, and findings registers that prove monitoring occurred.
Reporting to governance. Senior management and the board must receive regular reports on compliance status, including identified gaps, exceptions, remediation progress, and emerging obligations. The evidence is not a reporting policy; it is the actual board packs, management dashboards, and meeting minutes that show what was reported and when.
The Twelve Evidence Artifacts That Prove Implementation
Based on the sub-controls in Domain 9, examiners look for the following operational evidence during SAMA CRFR assessments.
Obligation Identification
- Compliance obligations register. A current inventory listing each applicable regulation, the specific requirements, the business units or systems affected, and the date of last review.
- Change-log records. Documentation showing when the register was updated in response to regulatory changes, new products, or periodic reviews, including the trigger for each update and the person responsible.
- Regulatory horizon-scanning records. Evidence that the institution monitors for upcoming regulatory changes, such as subscription records to SAMA circulars, NCA updates, or legal briefings, and records of how emerging obligations are assessed for applicability.
Ownership Assignment
- Control-owner acknowledgment records. Signed or electronically acknowledged records showing that each control owner has been informed of their assigned obligations and has accepted responsibility.
- Ownership register. A current list mapping each compliance obligation to a named individual, with contact details and the date of assignment.
Adherence Monitoring
- Control self-assessment logs. Quarterly or periodic logs completed by control owners, documenting the status of each assigned obligation, any issues identified, and evidence reviewed.
- Compliance testing results. Records of tests performed by the compliance function or internal audit, including scope, methodology, findings, and follow-up actions.
- Exception and deviation records. A register of instances where the institution did not meet a compliance obligation, including the reason, risk assessment, approval of the exception, and remediation plan.
- Remediation tracking logs. Evidence that identified gaps are tracked through to closure, with assigned owners, due dates, status updates, and verification of completion.
Governance Reporting
- Board and management reporting packs. The actual presentations, dashboards, or reports submitted to the board and senior management, showing compliance status by domain or obligation, trend analysis, and key issues.
- Meeting minutes. Extracts from board or risk-committee minutes showing that compliance reports were presented, discussed, and that decisions or directions were recorded.
- Escalation records. Documentation of how significant compliance gaps or breaches were escalated to senior management or the board outside of regular reporting cycles.
Why Gap Analyses Miss This Evidence—and What Happens Next
Most initial gap analyses focus on policy review and high-level interviews. The assessor asks whether a compliance management policy exists, whether a compliance officer is appointed, and whether the institution maintains a compliance register. The answer to all three is usually yes. The gap analysis concludes that Domain 9 is "partially compliant" or "largely compliant," with recommendations to enhance the policy or update the register.
Four months later, when the institution begins remediation or faces a regulatory examination, the compliance head discovers that the evidence examiners actually want does not exist. Control owners were never formally notified of their assignments. Self-assessments were conducted informally or not at all. Exception tracking was managed in email threads. Board reports summarized compliance activity but did not present obligation-by-obligation status. The institution must now design and implement the monitoring and reporting processes, then operate them long enough to generate a credible evidence trail.
This four-month delay is avoidable. A gap analysis structured to collect implementation evidence in parallel with policy review identifies the absence of operational artifacts during the assessment phase, allowing remediation planning to address process design, not just documentation updates.
Structuring a Compliance Assessment to Collect Implementation Proof
A compliance assessment that avoids the evidence gap follows a four-phase process.
Scope and Evidence Request
During scoping, the assessor defines not only which frameworks and entities are in scope but also which evidence types will be requested for each sub-control. For Domain 9, the evidence request list includes the twelve artifacts above. The institution is given advance notice of what will be required, allowing compliance and internal-audit teams to locate existing records or acknowledge gaps early.
Questionnaire, Interviews and Evidence Collection
The assessment uses a structured questionnaire that asks not whether a process exists but whether specific evidence can be provided. For example: "Provide the compliance obligations register, including the last three change-log entries." "Provide acknowledgment records for five randomly selected control owners." "Provide the most recent quarterly compliance report submitted to the board."
Interviews with control owners and compliance officers focus on how processes operate in practice, not how they are described in policy. The assessor asks to see the tools, templates, and logs used day-to-day.
Control Testing and Maturity Scoring
The assessor tests a sample of obligations end-to-end: Is the obligation in the register? Is an owner assigned and acknowledged? Is there evidence of monitoring? Was status reported to governance? Each sub-control is scored based on the presence, quality, and consistency of operational evidence, not on policy completeness.
Findings, Roadmap and Presentation
The assessment report documents which evidence exists, which is missing, and which is present but insufficient in quality or coverage. The gap register lists each missing artifact as a distinct finding, with a clear description of what must be created or improved. The remediation roadmap sequences the work logically: design the process, implement the tools, operate for one cycle, then collect and review the evidence.
How a Compliance Assessment Addresses Domain 9 Evidence Requirements
A comprehensive gap assessment against SAMA CRFR includes control-by-control assessment, evidence testing and sampling, and maturity scoring by domain. The assessment process follows four stages: defining scope, collecting evidence through questionnaires and interviews, assessing controls and scoring maturity, and reporting findings with a remediation roadmap. Deliverables include an assessment report and maturity scores, a gap register with evidence, a remediation roadmap, and a board and management summary. The assessment is completed in four to eight weeks.
When the assessment identifies that Domain 9 operational evidence is missing, the remediation roadmap specifies which processes must be designed, which tools or templates are needed, and how long the institution must operate the new processes before sufficient evidence accumulates. This approach allows the compliance head and internal audit to plan resources, set realistic timelines, and avoid the surprise of a four-month evidence-collection phase after the gap analysis is complete.
Closing the Evidence Gap
Domain 9 of the SAMA Cyber Resilience and Fraud Risk Framework requires proof that compliance obligations are identified, assigned, monitored and reported—not merely documented in policy. The twelve evidence artifacts examiners demand are operational records: registers with change logs, owner acknowledgments, self-assessment logs, testing results, exception tracking, and board-reporting packs. A gap analysis that treats board-approved policies as sufficient proof will miss these gaps, extending the remediation timeline by the months required to design processes, operate them, and generate credible evidence.
A compliance assessment structured to collect implementation proof in parallel with policy review identifies evidence gaps during the assessment phase, allowing remediation planning to address process design from the outset. For compliance heads, internal auditors and CISOs preparing for SAMA CRFR assessments, the lesson is clear: ask not only whether a compliance management policy exists, but whether the institution can produce the twelve artifacts that prove the policy is implemented.
How We Help: Compliance Assessments That Test for Implementation Evidence
Our Compliance Assessments service provides comprehensive gap assessments and readiness reviews against SAMA CRFR, SAMA CSF, NCA ECC, PDPL, and ISO 27001, designed to identify exactly where the institution stands and what to fix first.
The assessment follows a four-stage process: defining scope, including frameworks, entities and systems; collecting evidence through questionnaires, interviews and documentation review; assessing controls with testing and maturity scoring; and reporting findings, roadmap and presentation to management.
Deliverables include an assessment report and maturity scores, a gap register with evidence, a remediation roadmap, and a board and management summary. The service includes control-by-control assessment, evidence testing and sampling, maturity scoring by domain, cross-framework mapping, and a prioritized remediation plan. The assessment is completed in four to eight weeks.
For institutions that require support beyond the assessment, our Regulatory Compliance Remediation Program service runs the remediation program after an assessment or regulatory review, prioritizing gaps, coordinating owners, implementing controls and building the evidence that closes each finding.
