Compliance Monitoring: A Whole-Firm Responsibility

Compliance monitoring is usually described as a job for the compliance team, and day to day it is. The compliance officer designs the programme, runs the reviews and reports the results. But at an FCA or PRA-regulated firm, monitoring only works when the whole senior team plays its part: the board that challenges the results, the executives who own the areas being tested, the finance function that runs many of the controls, and the compliance team that ties it together.

Across FD Capital Group, our practices recruit for every one of those roles. That gives us an unusually wide view of how monitoring works in practice, and where it breaks down. This article sets out what each part of a regulated firm contributes, and introduces the new long-form guide from our specialist practice, SMF Capital: Compliance Monitoring Explained.

What Compliance Monitoring Is For

Compliance monitoring is the planned, regular testing of whether a firm does in practice what its policies and the rules require. Policies, procedures and training describe what should happen. Monitoring checks whether it does.

It is a regulatory requirement, not an optional extra. The FCA’s systems and controls rules in SYSC 6.1 require firms to have adequate arrangements to ensure they comply with their obligations, and investment firms within MiFID must run a permanent, risk-based monitoring programme. For retail firms, the Consumer Duty adds a duty to monitor the outcomes customers actually receive. Under the Senior Managers and Certification Regime, monitoring results are also part of the evidence that each Senior Manager took reasonable steps in their own area.

The Board: Challenge, Not Just Receipt

The board sets the firm’s risk appetite and is ultimately responsible for its compliance. When it comes to monitoring, its job is to understand what was tested, what was found and whether problems are being fixed, and to challenge when the picture doesn’t add up.

Non-executive directors play a particular role here. An experienced NED will ask why certain areas weren’t tested, why the same finding keeps appearing, or why actions are overdue. Boards that simply note the monitoring report each quarter, without questions, are a weakness in themselves. Our practice NED Capital recruits non-executive directors and committee chairs who bring exactly that kind of informed challenge, and SMF Capital recruits the chairs and committee chairs that hold Senior Manager Functions.

The Executive: Owning What Gets Tested

Monitoring tests the business, and the business is run by the executive team. The chief executive, chief operating officer and heads of business lines own the processes being reviewed and the actions that follow. When monitoring finds a problem in advice, lending, claims or onboarding, it is an executive who has to fix it.

The most effective executives treat monitoring findings as useful information rather than criticism. They agree realistic actions, assign owners and make sure fixes are retested. Our practice Exec Capital recruits chief executives, chief operating officers and other senior leaders, and at regulated firms we look closely at how candidates have responded to compliance findings in the past.

Finance: Running Many of the Controls

Some of the areas regulators care about most sit with the finance function. These include client money and custody assets under the CASS rules, safeguarding at payments and e-money firms, regulatory returns, capital and liquidity, and the evidence behind fair value assessments under the Consumer Duty. When compliance monitors these areas, it is testing the work of the CFO and the finance team.

Finance teams that keep evidence as they go, reconcile on time and fix root causes rather than symptoms make monitoring smoother and more valuable. Our practices FD Capital and Accountancy Capital recruit CFOs, finance directors, financial controllers and finance professionals for regulated firms, including people with specific CASS, safeguarding and regulatory reporting experience.

Compliance: Designing and Running the Programme

The compliance officer, who usually holds the SMF16 compliance oversight function, designs the monitoring programme, decides what to test and how, carries out or oversees the reviews, rates the findings and reports to the board. At smaller firms the same person is often the MLRO too, so financial crime monitoring falls to them as well.

Running a good programme takes specific skills: building a plan from the firm’s risk assessment, choosing sensible samples, testing outcomes rather than just paperwork, writing findings people will act on and presenting results to a board with confidence. Not every compliance officer has done it well before, which is why SMF Capital tests monitoring experience closely in every compliance officer search.

Who Does What

Resourcing Monitoring at Smaller Firms

Large firms have dedicated monitoring teams. Smaller firms rarely do, and monitoring is often the first thing to slip when the compliance officer is stretched. There are three realistic ways to resource it:

• In-house: the compliance officer runs the programme, with protected time in the diary.
• Outsourced: a specialist provider carries out reviews to an agreed plan, while someone in-house owns the programme and the actions.
• Fractional: an experienced, approved compliance officer works a set number of days a month, holds the function and runs monitoring as part of the role. SMF Capital’s page on the part-time compliance officer for small firms explains how this works.

Many firms combine these, using an outsourced reviewer for areas where independence matters most. Whichever route a firm takes, accountability stays with the firm and its Senior Managers.

Where We See Monitoring Break Down

Because we recruit across board, executive, finance and compliance roles, we often hear about monitoring problems from several angles at once. The same patterns come up again and again:

• The plan never changes. The same areas are tested every year, regardless of new products, systems or regulatory focus.
• Findings are softened. Ratings drift towards green before reports reach the board, so directors never see the real picture.
• Actions go overdue. Deadlines are quietly extended quarter after quarter, and repeat findings are treated as new ones.
• Finance is left out. Monitoring concentrates on conduct and advice, and CASS, safeguarding or regulatory returns are rarely tested.
• The compliance officer has no time. Monitoring slips behind day-to-day queries, and nobody notices until the regulator asks.

Most of these are people problems as much as process problems. A board without the experience to challenge, an executive who sees findings as criticism, or a compliance officer who has never run a programme before can each undermine monitoring that looks sound on paper. That is why we look for monitoring experience, and the ability to engage with it, in every regulated appointment we make.

Inside the Guide

SMF Capital’s Compliance Monitoring Explained is one of the most detailed free guides on the subject. It covers:

• what the rules require, and how monitoring differs from quality assurance and internal audit
• building a risk-based programme, and what to monitor by firm type
• testing methods, sampling, and rating findings
• reporting to the board, including Consumer Duty and financial crime monitoring
• an annual monitoring cycle, technology, and resourcing options
• the common weaknesses regulators find, and a getting-started checklist

It is written for compliance officers, but also for the directors, executives and finance leaders who rely on monitoring and fund it.