Art.47 Binding corporate rules
Binding corporate rules must be approved by the competent supervisory authority under the consistency mechanism, must be legally binding on and enforced by every member of the group including its employees, and must expr
5
artefacts
2
held by a system
1
at each review
moderate
to go live
Policy repository / GRC workspace
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- The audit programme the rules commit to, with completed audits, findings and corrective actions closed · Policy repository / GRC workspace
- The change log for the rules and for group membership, and evidence changes were reported to the supervisory authority as the rules require · SIEM / log platform
periodic reviewEvidence produced at each review
- Training records for personnel with permanent or regular access, and the complaint handling records operated under the rules · HR system / LMS
governing documentDocuments that govern the control
- The approval decision from the competent supervisory authority and the approved text as it currently stands · Document repository
- The internal instrument making the rules binding on each group member and on employees, such as an intra-group agreement and employment terms · HR system / LMS
First move
Start with the 2 of 5 artefacts that already live in a system (Policy repository / GRC workspace); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Rules approved years ago while the group has since acquired entities never brought inside the binding instrument
- The verification and audit mechanism written into the rules and never operated, which is the commitment authorities test first
- Changes to the rules or to the group made without the reporting to the supervisory authority the rules commit to
- Binding corporate rules treated as covering every transfer, including to third parties outside the group, which they cannot
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetArt.46 Transfers subject to appropriate safeguards · Art.48 Transfers or disclosures not authorised by Union law