The ESMA guidelines recommend several monitoring tools, notably aggregated risk indicators, which provide quantitative measures of non-compliance risk, and exception reports, which flag substantial deviations between expectations and the observed situation. These tools are essential for detecting trends and identifying problematic situations.

The third level of control consists of a periodic internal audit that evaluates the overall effectiveness of the framework. Unlike the first two levels, which are more operational and independent, this level provides a cyclical overview of the control system. It is crucial for identifying overall weaknesses and proposing improvements.

The anomaly register records problematic situations requiring treatment. Unlike aggregated risk indicators or exception reports that provide measures or flag deviations, the register focuses on detailed documentation of identified problems to facilitate their resolution. This enables effective traceability and follow-up of anomalies.

The annual compliance report must include both quantitative indicators (such as the number of anomalies detected) and qualitative elements (such as a summary of control activities). Article 321-36 of the AMF General Regulation and ESMA guidelines specify that this report must present a comprehensive view, also including corrective measures and regulatory developments. A purely quantitative approach would not suffice to fully evaluate the effectiveness of the framework.

The annual compliance report must include a summary of control activities and their results, identified breaches and significant risks, and measures taken to remedy deficiencies. Quantitative indicators, in turn, include measures such as the number of anomalies detected and the completion rate of the annual control plan. This distinction is essential for structuring the report and providing a comprehensive evaluation.

Permanent controls are applied to critical processes and must be carried out continuously, without interruption. This frequency is adapted to the critical nature of the processes concerned, as stipulated in the control programme. Other types of controls, such as regular and ad hoc controls, have different frequencies depending on specific needs.

First-level permanent controls are performed by employees themselves in the course of their duties. This first level is distinct from controls performed by the compliance function, which operate at the second level. This distinction is important as it separates operational controls from independent controls.

Non-compliance risk mapping begins with identifying all the institution's processes and activities. This step is crucial as it targets the sensitive areas where the risk of breach is highest. The AMF General Regulation specifies that this mapping must be carried out periodically to adapt the objectives and resources of the compliance function.