Contract-to-Control Intelligence
Most third-party control frameworks are tested against the policy rather than the paper. The paper is what will be produced. This surface reads the executed estate clause by clause, maps each clause to the control it makes enforceable, and names the controls resting on nothing at all.
The estate, clause by clause
- Agreements read
- 4
- Clauses mapped
- 18
- Present
- 9
- Weak
- 5
- Absent
- 4
- Controls with no clause
- 5
Master services agreement — primary infrastructure provider
Supports Payments, Settlement, Data platform · governed by England and Wales · Rolling, 12-month notice
- Supervisory and audit accessPresentC25 · Legal risk and contractual enforceability
Direct right retained; exercised through pooled audit in practice.
- Subcontracting consent and notificationWeakC11 · Third-party and outsourcing risk
Notification only, no objection right. This is why the chain map stops at the third party.
- Exit and transition assistancePresentC12 · Operational resilience
Clause is sound; the plan resting on it has never been rehearsed.
- Processing locations and change controlWeakC08 · Data privacy and protection
Change permitted on notice rather than consent — the transfer assessment can be overtaken.
- Service levels and remediesPresentC12 · Operational resilience
Tolerances align to the impact tolerance stated in the resilience position.
- Security incident notification windowPresentC23 · Incident and regulatory reporting
Window is shorter than the shortest regulatory filing window. Correct order.
Controls resting on no clause
- — Concentration exit within tolerance — depends on a successor being available, which no clause secures
Demonstration estate. Client readings run against the institution's own executed agreements inside the engagement environment, and clause interpretation remains the responsibility of the institution's counsel.
Why it is read this way
A control without a clause is an intention
Exit plans, audit rights, model-change visibility and location control all rest on contractual language. Where the language is absent, the control cannot be exercised — however well it is documented internally.
Weak is more dangerous than absent
An absent clause is visible. A clause that gives notification where the control needs consent reads as coverage on a matrix and fails at the only moment it is needed. Both states are shown separately for that reason.
The estate is read once, into the same spine
Clauses map to the same C01–C40 domains as regulatory obligations. Contractual and regulatory duties sit in one register, because the institution answers for both in the same examination.