Compliance monitoring
Also called compliance testing, compliance assurance
Compliance monitoring is the ongoing testing by a firm's compliance function of whether its business, staff and controls follow the rules that apply to it. It runs to a risk-based plan, checks files, calls and processes, and reports findings and fixes to senior management and the board.
How it works
Each year the compliance function writes a monitoring plan based on a risk assessment of the firm's regulated activities. Reviewers then sample client files, recorded calls, financial promotions, complaints and control evidence. Each finding gets a rating, an owner and a deadline. Results are reported to senior managers and the board, and repeat failures feed back into the next plan.
Monitoring is a regulatory requirement in the UK, EU and US, not an optional extra. It is how a firm shows supervisors that its compliance arrangements work in practice. Weak monitoring is a common finding in skilled person reviews and enforcement cases. Many firms now add automated surveillance and data analytics to manual file reviews to cover more activity.
The rules
Firms must have a permanent, independent compliance function that monitors and regularly assesses the adequacy and effectiveness of their compliance measures.
FCA-authorised firmsThe compliance function must run a risk-based monitoring programme and report to the management body at least annually.
Investment firms and banks providing investment servicesAdvisers must adopt written compliance policies, review their adequacy and effectiveness at least annually and designate a chief compliance officer.
SEC-registered investment advisersMembers must maintain a supervisory system, written procedures and periodic internal inspections reasonably designed to achieve compliance with securities laws.
FINRA member broker-dealersCommon questions
What is the difference between compliance monitoring and internal audit?
Compliance monitoring is a second-line activity that tests whether rules are being followed day to day. Internal audit is the third line. It independently assesses whether risk management, compliance and controls, including the monitoring programme itself, are designed and working effectively.
How often should compliance monitoring take place?
Rules require it to be ongoing and risk-based rather than at a fixed interval. In practice firms run an annual plan, with high-risk areas reviewed more often. MiFID rules require the compliance function to report to the management body at least once a year.
What does a compliance monitoring plan cover?
A plan lists the areas to be reviewed, the reasons each was chosen, the testing method, sample sizes and timing. Common areas include sales and advice, client onboarding, financial promotions, complaints handling, conflicts of interest and personal account dealing.
Can compliance monitoring be automated?
Parts can. Firms use rule-based and analytics tools to scan transactions, communications and system data for exceptions. Reviewers still judge whether an exception is a breach, and supervisors expect the firm to understand and test any automated monitoring it relies on.
