From a regulation clause to a risk score: turning SPK BSY into code

The Information Systems Management communiqué of Turkey's Capital Markets Board (SPK) means dozens of clauses, and for each clause the question "is it being done, and is there evidence". Run in Excel, this work turns into a hunt for evidence on audit day. The goal was to turn a clause first into a question, then into a score, then into a task.

First, the question

Each clause becomes a question whose owner is known. The owner sees only their own question and cannot submit; the right to submit stays with whoever runs the assessment. That keeps "who said what" in the audit trail.

Then, the score

An answer gives birth to a risk record made of likelihood and impact. The organisation picks its own scale: 4+2 or 5+3. Score and level thresholds are configurable; which cell of the matrix counts as "critical" is decided by the organisation, not the communiqué.

A regulation tells you what it wants, not how to measure it. The scale should be the organisation's decision.

Finally, the work

A risk above a given level is opened as a ticket for its owner; public follow-ups on the ticket flow back into the risk record. The acceptance flow is tied to an approver: who accepted the risk, on which date, with what justification. When the auditor asks, the answer comes out of the system.

• Ready-made sets: SPK BSY VII-128.10, ISO 27001, KVKK, BDDK, EPDK
• Cross-regulation mapping: one answer closes more than one clause
• Evidence as GLPI documents, linked to assets