MAS TRM Gap Assessment

This page is the full transcript of our video explaining what a MAS TRM gap assessment covers and why regulated firms in Singapore use one before an audit or a MAS review. The video will appear here once published. Until then, the complete spoken script is below.

[Video embed: MAS TRM Gap Assessment, coming soon]

Full transcript

If you work in a bank, a payment firm or a fund manager in Singapore, you have probably heard the phrase MAS TRM gap assessment. It sounds like paperwork. It is not. It is the difference between hoping your technology risk controls hold up in front of the Monetary Authority of Singapore, and knowing they will.

In this video we explain what a MAS TRM gap assessment actually is, why so many firms struggle with it, and how we close the gaps when we run one.

So, what does the phrase mean? MAS TRM is the Monetary Authority of Singapore’s Technology Risk Management framework: the TRM Guidelines, and the legally binding notices that sit on top of them, covering everything from access control and change management to incident reporting, backups, and third party risk. A gap assessment is a structured review of your current technology environment against every one of those expectations. Control by control, we ask: does this exist, is it operating, and can you prove it with evidence?

The output is not a pass or fail. It is a map. Which controls are in place and working. Which exist on paper but not in practice. And which are missing entirely, ranked by the risk they carry and the effort to fix them.

Why do firms struggle with this? Three reasons come up again and again.

First, the framework is broad. The TRM Guidelines span governance, architecture, security operations, resilience, outsourcing and more. Most internal IT teams are deep in one or two of those areas and thin in the rest, so a self assessment tends to mirror what the team already knows rather than what MAS expects.

Second, evidence. Almost every firm we assess has more controls running than it can prove. Backups run, but restores are not tested on a schedule. Access reviews happen, but nobody kept the sign off. Under MAS TRM, a control you cannot evidence is treated as a control you do not have.

Third, the goalposts move. MAS updates its expectations, from the revised TRM Guidelines to newer notices on cyber hygiene and third party risk. A gap assessment done three years ago tells you very little about where you stand today.

So how do we solve it? When we run a MAS TRM gap assessment at Global ITN, we start with scope: which entities, systems and notices apply to you, because a capital markets services licence holder has different obligations from a payment institution. Then we assess each control area on three levels: the policy, the practice, and the proof. We interview the people who run the control, we look at the systems, and we test whether the evidence would survive a MAS inspection.

What you get at the end is a prioritised remediation plan. Not a hundred page report that sits in a drawer, but a clear list: here are your gaps, here is the risk each one carries, here is the order to fix them in, and here is what good looks like when each one is closed. And because we are the team managing IT for financial firms every day, we can fix the gaps with you, not just point at them.

If your firm has a MAS review coming up, or you simply do not know where you stand against the TRM Guidelines, a gap assessment is the fastest way to find out. Get in touch with us at globalitn.com and we will walk you through what one would look like for your environment.

See how we run this in practice on our MAS TRM compliance assessment page