CII AF6 Management Controls: Turn a Case into an Action Plan

Table of Contents

• • Use the AF6 case-to-action framework
• • Classify the case before writing
• • Worked case: weak evidence behind competence sign-off
• - 1. Separate facts from assumptions
• - 2. State the risks precisely
• - 3. Identify control gaps
• - 4. Build the action plan
• • Distinguish design, operation and outcome
• • Common AF6 assessment traps
• • A compact writing structure

The quickest way to handle an AF6 management-control case is to build a chain from observed fact to verified outcome:

fact → risk → requirement → owner → containment → evidence → remediation → review

Do not start with a generic list of policies. Start with what happened, who or what may be affected, and what evidence is still missing. That gives you a proportionate action plan instead of a pre-written answer looking for a case.

The official CII AF6 unit page places management controls within regulation, business practice, operational risk, competence governance, leadership and culture. AF6 is assessed through three written coursework assignments, so a supported management judgement matters more than a recital of definitions.

Use the AF6 case-to-action framework

Link	Question to answer	Useful output
Fact	What is known, and what is only alleged or inferred?	Short evidence statement
Risk	Which customer, conduct, people, operational or strategic outcome is exposed?	Specific harm or failure
Requirement	Which rule, policy, objective or risk appetite is relevant?	Decision standard
Owner	Who owns the risk, control and independent challenge?	Named role, not “management”
Containment	What must happen now to stop further harm?	Time-bound immediate action
Evidence	What would confirm scale, cause and control operation?	MI, observation, testing or review
Remediation	What change addresses the cause rather than the symptom?	Corrective action with resources
Review	How will success, residual risk and escalation be tested?	Measure, threshold and date

One sentence per link is enough for an initial plan. Add depth only where the case and command word require it.

Classify the case before writing

Use the tool below to classify the case signals and produce a structured starting point. Make selections that match the facts actually given. Treat the output as a planning prompt: it cannot decide whether evidence is reliable or whether a proposed action is proportionate.

After using the tool, add three items manually:

1. the fact that most strongly supports your classification;
2. the important information that is still missing; and
3. the measure that would prove the response improved the relevant outcome.

This prevents a label such as “people risk” from becoming the conclusion. The label is only the start of the analysis.

Worked case: weak evidence behind competence sign-off

Assume a retirement-advice team has rising file-review failures. Several recommendations do not show how capacity for loss affected the strategy. The team supervisor says every adviser is competent because all mandatory learning was completed and revenue remains above target.

1. Separate facts from assumptions

Known facts are the rise in file-review failures, the missing capacity-for-loss reasoning, completed learning and strong revenue. It is not yet known whether the cause is knowledge, skill, workload, process design, incentive pressure, weak supervision or deliberate conduct.

2. State the risks precisely

The immediate risk is not simply “poor performance”. It includes unsuitable or poorly evidenced recommendations, weak customer outcomes, unreliable competence decisions and an incentive signal that may favour revenue over advice quality.

3. Identify control gaps

Training completion is an input. It does not demonstrate competent performance. Revenue is also not valid evidence of advice quality. The sign-off control lacks sufficient performance evidence, while the supervisor’s dashboard appears unbalanced.

4. Build the action plan

Timing	Action	Owner	Evidence and success test
Now	Pause unsupervised activity where the evidence indicates material customer risk; identify potentially affected files	Advice operations lead	Defined population and recorded rationale
Within days	Review a risk-based sample and observe the relevant advice skill	Competence supervisor with compliance challenge	Valid, current evidence by adviser and failure type
After diagnosis	Provide targeted coaching, process correction or conduct action according to the established cause	Relevant manager	Reassessment against the role standard
Governance cycle	Rebalance MI to include file quality, customer outcomes, complaints, overrides and competence exceptions	Senior manager	Dashboard thresholds, actions and minutes
Follow-up	Retest affected work and review whether harm and residual risk remain	Second line; independent assurance where proportionate	Sustained improvement and closed remediation evidence

The response is conditional. If observation shows a narrow skill gap, coached practice and reassessment may be suitable. If instructions were deliberately ignored, the case may require investigation and conduct action. If advisers were following a defective template, changing individuals alone would leave the system failure in place.

Distinguish design, operation and outcome

AF6 cases often hide three different questions:

• Design: could the control reasonably address the stated risk?
• Operation: was the control performed by the right person, at the right time and to the required standard?
• Outcome: did it prevent, detect or correct the problem in practice?

A policy can be well designed but ignored. A file check can be completed but use an unrepresentative sample. A dashboard can be accurate but never trigger action. Write which layer has failed; “the control is ineffective” is too broad unless the evidence supports all three.

Common AF6 assessment traps

Jumping from incident to cause. A complaint or failed file is a signal. Establish pattern, scale and cause before prescribing a permanent response.

Treating more training as a universal fix. Training cannot repair a broken workflow, unmanaged conflict, unclear ownership or reward structure.

Listing actions without verification. Add completion evidence, an outcome measure, a threshold and a review date.

Ignoring immediate containment. Long-term redesign does not protect customers while investigation is under way.

A compact writing structure

For each major issue, write four short paragraphs:

1. Diagnosis: cite the case fact and explain the risk.
2. Evaluation: assess the present control and evidence.
3. Action: set out containment and cause-based remediation with ownership.
4. Verification: define the success measure, challenge, escalation and review.

Use the AF6 study plan to connect this case method to the six study chapters. For current technical positions and coursework requirements, use the CII material supplied for your enrolment and the relevant regulator or legislation. This tool is an educational framework, not a substitute for professional, legal, compliance or employment advice.