One TRM domain. Closed.One TRM domain. Closed.

One open MAS TRM Domain finding, closed by a senior MAS-fluent partner in four weeks. Evidence packs the supervisor recognises. Cover-note language that lands as design, not retrofit.

You have a finding from a thematic inspection, an internal audit report, or a routine supervisor letter. The finding is real, the remediation is in flight, and the documentation in front of MAS does not yet read as a closed loop. The next supervisory engagement is six to ten weeks out and the institution’s appetite for another open item is zero.

The standard consulting answer is a domain-wide assessment that rebuilds everything around the finding over a quarter. That model is the right one when nothing is binding; it is the wrong one when one specific control needs to land in a supervisor pack in four weeks. Hourly billing rewards scope creep into adjacent domains; the supervisor reads scope creep as a posture problem.

The right answer is the opposite shape. One open finding, one TRM domain, one senior partner in the room from day one, four weeks from intake to response pack, written in the language the supervisor uses, with the control depth a MAS reviewer recognises.

MAS TRM is read on language as much as on control depth. Cover notes that translate a SOC2 control into a Notice 658 expectation, evidence packs that mirror the Annex structure the supervisor reads, remediation plans dated against the institution’s board cycle. We write to the supervisor; the firms that write to their own delivery teams produce remediation that reads as remediation.

The partner who scoped the sprint sits every working session, every supervisor pre-meeting, and every escalation. Four weeks is the right shape because the supervisor cycle is six to ten; we want the response pack on the desk before the next thematic inspection scope is set, not after.

1. Week 1

   Finding triage.

   We read the supervisor letter or the internal audit finding in the language MAS wrote it. We map the actual gap against the TRM domain control set, not the consultant restatement. The first deliverable is the right question, agreed in the room: what control evidence does the supervisor need to see, and at what depth.

2. Weeks 2 to 3

   Control build + evidence rebuild.

   We stand up the control to the standard the domain demands. Documentation, technical implementation, monitoring, the artefact set a MAS reviewer opens first. Where the existing posture has the shape but not the evidence, we rebuild the evidence layer so it reads as design, not retrofit.

3. Week 4

   Response pack + walk-through.

   We assemble the supervisor response pack: cover note, control narrative, evidence index, remediation plan with dates the team will actually hit. Partner walks your team through the response cadence and sits the first supervisor follow-up if needed.

4. Throughout

   Senior partner presence.

   The partner who scoped is the partner who delivers. MAS-fluent at every meeting. No analyst handoffs, no junior-led correspondence with the supervisor.

The artefact set for the closed domain becomes the template for the next finding your team handles internally. Evidence index layout, cover-note language, supervisor-pack format — all of it documented, all of it portable to adjacent domains.

A relationship with the senior partner who handled the response. When the next finding lands, you call the same person and the rebuild starts from the existing template, not from intake.

Tier-2 and Tier-3 banks, merchant banks, payment institutions, and capital markets services licence holders whose internal audit, a thematic MAS inspection, or a routine supervisor letter has put one specific TRM domain on the desk with a date attached. The buyer is the CISO, the Head of Technology Risk, or the Head of Compliance.

If the finding is the whole TRM domain rather than one control inside it, this is not the right shape; we will say so on the call.

This is not a TRM assessment. We do those on a vCISO retainer over a board cycle; this sprint closes one finding, not a domain rebuild.

This is not a writing exercise. The cover note is the smallest part of the work; the control depth is the work.

This is not a deliverable handed to a junior. The partner who scoped is the partner who sits the supervisor pre-meeting.