Challenging the Compliance Monitoring Report

In most regulated firms, the compliance monitoring report is the least challenged document in the board pack. The finance numbers get picked over line by line. The monitoring report gets a nod and a minute recording that it was received.

That is not because boards do not care. It is because most directors who are not compliance professionals have no framework for judging whether what they are reading is good, adequate or quietly alarming. A report full of green ratings reads as reassuring. A report full of amber ratings reads as honest. Neither impression is reliable.

This is written for the CFO, finance director or non-executive who receives these reports and wants to interrogate them properly. You do not need to be a compliance specialist to ask good questions about monitoring. You need to know which six things to look at.

What the monitoring report is actually for

Compliance monitoring is the second line’s planned, risk-based testing of whether the firm’s controls are working in practice. It is not the same as first-line quality assurance, where a team checks its own output, and it is not internal audit, which sits in the third line and tests whether the second line itself is effective. If those distinctions are hazy, our guide to the three lines of defence model sets them out, and SMF Capital has published a thorough guide to compliance monitoring covering how a programme is built and run.

The obligation sits in SYSC, which requires firms to maintain a compliance function with the necessary authority, resources and expertise, and to monitor and assess the adequacy and effectiveness of the measures put in place. For most firms it is the SMF16 Compliance Oversight holder who owns the programme, and that ownership is part of what they are personally accountable for under the senior managers regime.

The board’s job is not to run the programme. It is to be satisfied that the programme is real, that it covers the things most likely to harm customers or the firm, and that what it finds gets fixed. Everything below is a way of testing that.

Six things to look at

1. Coverage against the plan

Start with the simplest question: what was the programme supposed to test this period, and what did it actually test?

A monitoring plan that was eighty per cent delivered is a resourcing conversation. A plan that was forty per cent delivered, with the shortfall concentrated in the higher-risk areas, is a different conversation entirely — because the areas that get dropped are almost never random. They are the ones that are difficult, politically awkward, or owned by someone senior who pushed back.

If the report does not show planned versus completed, ask for it. Its absence is itself a finding.

2. The rating distribution

Most programmes rate findings high, medium and low, or red, amber and green. Look at the spread rather than the individual items.

A report where almost everything is green usually means one of three things: the firm genuinely is well controlled, the testing is too shallow to find anything, or the person doing the testing does not feel able to write down bad news. The first is possible. The second and third are more common, and you cannot tell them apart from the ratings alone — which is why you ask what the testing actually involved.

A report where almost everything is amber is a different problem. It often means the rating scale is not being used to discriminate, and amber has become the safe answer that avoids both complacency and confrontation. If nothing is ever red, the scale has no top end and the board has no way of knowing what urgent looks like.

3. Overdue actions

This is the single most diagnostic number in the report, and it is frequently buried in an appendix.

Findings generate actions. Actions have owners and deadlines. The proportion that are overdue, and by how long, tells you whether the monitoring programme has any teeth. A firm that identifies issues diligently and then does not fix them is arguably in a worse position than one that never looked, because it has documented knowledge of a problem it failed to address. That is precisely the evidence trail an enforcement case is built on.

Ask who closes actions, and on what evidence. “The business confirmed it was done” is not validation. Somebody in the second line should have retested.

4. Repeat findings

Look back at the previous two or three reports. Is the same issue appearing again under slightly different wording?

A recurring finding means the root cause was never addressed. Usually the action taken was a reminder email, a policy update or additional training, when the actual cause was a system that allows the wrong thing to happen, an incentive that rewards it, or a team without the capacity to do it properly. Root cause analysis is the step most often skipped, and repeat findings are how you detect that it was skipped.

5. Sample sizes and how they were chosen

You do not need to be a statistician to ask two questions: how many did you look at, and how did you pick them?

Ten files out of four thousand is not a basis for concluding that a process is working. Nor is a sample the business selected and handed over. Risk-based sampling should deliberately over-weight the cases most likely to be wrong — new staff, unusual products, vulnerable customers, high-value transactions — rather than taking a convenient slice of the easiest records to pull.

6. Process testing versus outcome testing

This is the one that separates a modern programme from a dated one, and it is where the Consumer Duty changed what adequate looks like.

Process testing asks whether the required steps were completed and the boxes ticked. Outcome testing asks whether the customer ended up in a reasonable place. A file can be fully compliant on process and still represent a customer who was sold something unsuitable, charged more than the product was worth, or left without the support they needed. If every finding in your report is procedural, the programme is testing the wrong thing. Our Consumer Duty guide covers what outcome-based evidence is expected to look like.

The independence question

There is a structural issue that boards at smaller firms almost never raise, and it deserves a place on your list.

At a great many firms, one individual holds both the SMF16 Compliance Oversight function and the SMF17 Money Laundering Reporting function. That is permitted, it is proportionate for a small business, and it is extremely common. But it means the person who designs the monitoring programme, decides what gets tested, performs the testing and rates the findings is also the person who owns the financial crime controls being tested.

That is self-review, and no amount of professional integrity makes it structurally sound. A supervisor will ask how independence is achieved, and there are only a handful of honest answers: periodic external testing, an internal audit function where the firm is large enough to have one, genuine challenge from a non-executive or audit committee, or splitting the two roles. Our post on whether SMF16 and SMF17 should be held by one person or two covers when the combination stops being proportionate, and SMF Capital’s combined SMF16 and SMF17 recruitment page sets out how firms structure the roles when they decide to separate them.

The board does not need to solve this. It needs to have asked the question and recorded the answer.

Five questions worth asking out loud

• What did we plan to test this period, and what did we not get to?
• How many of the open actions are past their due date, and what is the oldest one?
• Which of these findings have we seen before?
• What is the largest sample we tested, and how were those cases selected?
• Who checks the work of the person who wrote this report?

None of these is hostile. All of them are the kind of question a senior manager should expect from a board doing its job, and asking them creates a record that the board applied challenge — which matters if the firm’s governance is ever examined, whether through a supervisory visit or a section 166 review.

When the honest answer is resourcing

Ask these questions consistently and a pattern often emerges. The plan is not being delivered, actions are slipping, samples are small, and the testing is procedural rather than outcome-focused. In most cases this is not a competence problem. It is one person trying to own a monitoring programme alongside advice, training, financial promotions approval, regulatory reporting and everything else that lands on a small compliance function.

That is a budget decision, and it belongs to the finance leader as much as to the compliance officer. SYSC requires the compliance function to have the resources to do its job, and “we could not afford it” is not a defence that has ever worked. The realistic options are a second pair of hands in the compliance team, outsourced testing capacity bought in for specific reviews, or senior part-time capability — and reasonable steps under SMCR is the standard against which the decision will be judged.

The board that asks these questions, documents the answers and funds the gap is in a materially stronger position than the board that received the report and moved to any other business.

References and further reading

• FCA: Senior Managers and Certification Regime — the accountability framework behind the SMF16 function.
• FCA: Consumer Duty — the outcome-based standard that reshaped monitoring expectations.
• ICAEW — the professional body for chartered accountants in England and Wales.
• SMF Capital: Compliance Monitoring Explained — a full practitioner guide to building and running a programme.