MAINSYSTEMS 
assess programme implementation using proportionate evidence
1. Regulatory Concept & Core Standards
This video focuses on how to assess programme implementation using proportionate evidence. Follow the sequence of decisions in the example rather than simply memorising a list. Notice who is involved, what information is needed and the expected result. These points help turn the content into a practice that another person can verify. Governance connects risk owners, controls and evidence. Entities subject to an integrity plan follow ZIntPK and current KPK guidelines defining the head, integrity officer and other participants’ roles. Recommended models for others are not automatically statutory duties.
Monitoring must distinguish existence, implementation and effectiveness. An approved procedure exists, a record shows application, and a test may show whether it prevented or detected the intended risk. No single indicator describes the entire programme. Few reports could mean few problems, poor awareness or a lack of trust.
Apply the following rule: Article 7 generally requires register data to be kept for five years after the procedure ends, unless another Act provides otherwise. Personal data and the report’s contents are then destroyed; register metadata and the article 12(5) report may be retained longer under internal rules. This does not permit indefinite retention of the entire case. Clearly unnecessary personal data must not be collected and, if collected accidentally, must be deleted without undue delay.
2. Practical Implementation & Procedure
Choose indicators linked to objectives, such as training coverage, implementation, delays and record quality. Define source, owner and frequency. Use aggregated channel information and restrict case details. Check samples where appropriate and state limitations. Absence of incidents alone does not prove effective controls. Before moving on, turn this procedure into a sequence you could explain to a colleague. Identify the first check, the action that depends on its outcome and the record that allows the decision to be reconstructed. Follow the sequence on screen and identify the point where an error would change the result.
3. Case Study & Compliance Action
Training attendance is complete but employees fail to recognise a conflict in the exercise. Reporting must show the application gap. Now read the case carefully. Separate established facts from information you would still need to confirm. Do not add motives or events that have not been described. This distinction matters when choosing a response proportionate to the information available.
The exercise is as follows: Does high attendance alone prove effective training? Choose an answer and write one sentence explaining it. During the pause, compare your choice with the criteria we have just considered. Also think about the material you would retain to explain the decision later.
No. Add a practical test and establish why the decision is not understood. Report both results.
One mistake to avoid is: using favourable percentages without checking what they measure.
Now apply the national rule to a second decision. The system deletes every item two years after receipt. Is this suitable?
No. Two years since the breach ceased concerns protection, not retention. Article 7 generally uses five years after the procedure ends unless another Act provides otherwise. Distinguish destruction of personal data and contents from possible longer retention of permitted metadata and the report.