Maintaining a register of the organisation's internal controls: what each control does, who owns it, how it is tested, and how it maps to the regulatory framework it satisfies.