Compliance file review checklist: what a sound advice file contains

Every compliance manager has a mental list of what a good advice file should contain. The problem is that a mental list drifts. Two reviewers check the same file and reach different conclusions, a missing document goes unnoticed because nobody looked for it, and the file that matters most is the one that was never opened.

This compliance file review checklist sets out what a sound advice file contains, part by part, and ties each part to the FCA rule it supports. Use it as the backbone of your own file review standard, adapt it to your firm's processes, and apply it the same way to every file.

Why a written compliance file review checklist matters

The rules give you a clear reason to keep files in order. SYSC 9.1.1R says "A firm (other than a common platform firm) must arrange for orderly records to be kept of its business and internal organisation… sufficient to enable the FCA to monitor the firm's compliance" (SYSC 9.1). A file that cannot show what happened, and why, fails that test even if the advice itself was good.

A written checklist gives you three things a mental one cannot:

• Consistency. Every reviewer checks the same points in the same order.
• Coverage. Missing documents are found because someone was looking for them.
• Evidence. The checklist itself becomes a record that the file was reviewed against a defined standard.

The compliance file review checklist, part by part

The checklist below follows the order in which a file is usually built, from knowing the client to keeping the records. In each part, the rule we quote is what the FCA requires. The check items beneath it are our view of good practice for evidencing that rule in the file; they are not wording from the rules, and some (such as identity checks) come from other obligations, such as the money laundering regulations.

Part 1: knowing the client

Suitability starts with information. COBS 9A.2.1R requires the firm to obtain information about the client's knowledge and experience, their "financial situation including his ability to bear losses" and their "investment objectives including his risk tolerance" (COBS 9A.2).

Check:

• A completed fact find, dated, covering income, expenditure, assets, liabilities, dependants and health where relevant.
• Objectives recorded in the client's terms, with timescales.
• Knowledge and experience of the relevant investments, assessed and recorded.
• Attitude to risk, with the method used and the outcome discussed with the client.
• Capacity for loss assessed separately from attitude to risk, with the reasoning shown.
• Any characteristics of vulnerability noted, with any adjustments made to the service.
• Identity and anti-money laundering checks on file and current.

Capacity for loss is a frequent weak point. The FSA's guidance described it as "the customer's ability to absorb falls in the value of their investment" and found that "many fail to take appropriate account of their capacity for loss" (FG11/05). Our guide to capacity for loss vs attitude to risk covers this in more depth.

Part 2: the recommendation and the suitability report

The suitability report is the centre of the file. COBS 9.4.7R says it must "specify… the client's demands and needs", "explain why the firm has concluded that the recommended transaction is suitable" and "explain any possible disadvantages of the transaction for the client" (COBS 9.4).

For business within COBS 9A, COBS 9A.3.3R requires "an outline of… the advice given and how the recommendation is suitable… with reference to… the investment term required… their knowledge and experience… their attitude to risk and capacity for loss" (COBS 9A.3).

Check:

• The client's demands and needs stated clearly, matching the fact find.
• A personal explanation of why the recommendation suits this client, not generic product text.
• Disadvantages and risks of the recommendation set out honestly.
• The investment term, knowledge and experience, attitude to risk and capacity for loss each linked to the recommendation.
• Alternatives considered and why they were rejected, where relevant.
• Research supporting the product and provider choice, dated to the time of advice.
• Evidence the report was sent, and when.

Part 3: charges and disclosure

COBS 6.1A.4R requires a firm to "only be remunerated for the personal recommendation… by adviser charges". Where adviser charges are paid over time for an ongoing service, COBS 6.1A.22R requires it to be "an ongoing service for the provision of personal recommendations or related services", disclosed, with "a right to cancel the ongoing service… without penalty" (the rule also allows ongoing charges in some cases where the client makes regular payments into a product) (COBS 6.1A). The same section requires the charging structure to be disclosed "in good time before making the personal recommendation" (COBS 6.1A.17R) and the total adviser charge to be agreed with the client and disclosed in cash terms (COBS 6.1A.24R).

Check:

• The charging structure disclosed in writing "in good time before making the personal recommendation" (COBS 6.1A.17R), in cash terms as far as practicable.
• The total adviser charge agreed with the client, and disclosed in cash terms (COBS 6.1A.24R).
• The ongoing service described: what the client receives and how often.
• The right to cancel the ongoing service without penalty explained.
• Charges taken match the charges agreed.
• Product and fund charges shown alongside the adviser charge.

Part 4: ongoing service and annual review evidence

If a client pays for ongoing advice, the file should show the service promised was delivered. Where the firm has told the client it will provide a periodic suitability assessment, COBS 9A.3.9R says "A firm providing a periodic suitability assessment must review the suitability of the recommendations given at least annually" (COBS 9A.3). The FCA's review of ongoing advice found reviews delivered in about 83% of cases, with the client declining or not responding in 15% and the firm making no attempt in fewer than 2% (FCA ongoing advice review).

Check:

• The review or contact the ongoing service promised, with the date recorded (at least annually where a periodic suitability assessment is provided).
• Fact find and attitude to risk refreshed, or a note explaining why nothing changed.
• Suitability of the existing arrangements confirmed in writing.
• Evidence of attempts to contact clients who did not respond.
• Communication records: letters, emails and meeting notes in date order.

Note that CP26/10 proposes "Replacing the annual suitability review with periodic reviews based on clients' needs" (CP26/10). That is a consultation proposal, not a final rule, so review your files against the rules in force today.

Part 5: retention and file order

For business within COBS 9, COBS 9.5 sets minimum periods for keeping suitability records: pension transfers, conversions and opt-outs "indefinitely"; life policies and pensions "five years"; other cases "three years" (COBS 9.5). Business within COBS 9A has its own record-keeping provisions in COBS 9A.4, which point to SYSC 9, so check which periods apply to each file. These are minimums; your own retention policy may set longer periods.

Check (good practice for orderly records):

• Every document in a predictable folder, named and dated consistently.
• Scanned paperwork legible and complete.
• No duplicate or superseded versions left without a note.
• Meeting recordings or notes stored with the file they relate to.

Writing up findings that hold up

A checklist tells you what is missing. A good write-up tells the adviser what to do about it. For each finding, record:

1. The rule or standard engaged, for example COBS 9.4.7R or your own file standard.
2. The evidence, quoting the passage from the file, or naming the document that is absent.
3. The severity: does it affect suitability, disclosure, or only file quality?
4. The action, who owns it and by when.

Keep two scores apart: whether the file meets the FCA's requirements, and whether it meets your firm's own standard of quality. A file can be compliant and still untidy, or tidy and still unsuitable. Separating them stops one hiding the other. Our article on preparing for a file review covers how to turn findings into remediation.

Applying the checklist to every file, not a sample

The checklist above is long because a sound file has a lot in it. By our estimate, a thorough review worked through by hand takes half a day. That is why most firms check a sample.

Scrutineer applies this kind of review to the whole folder. It reads every document in every subfolder, including scanned paperwork, and gives each file a compliance score against FCA suitability and disclosure standards, a file-quality score against your own standard, and a verdict of Suitable, Unclear or Unsuitable. Each finding names the rule it engages, with the passage quoted, and every review comes with outstanding actions and a missing-document checklist. By our estimate, a review drops from half a day to minutes. The judgement on each finding stays with your compliance team.

Frequently asked questions

What should a compliance file review checklist include?

At a minimum: client information under COBS 9A.2.1R, the suitability report against COBS 9.4.7R or COBS 9A.3.3R, charges and ongoing service disclosure under COBS 6.1A, evidence of ongoing reviews, and orderly records that meet SYSC 9.1.1R and the retention periods that apply (COBS 9.5 for business within COBS 9).

How often should advice files be reviewed?

Set the frequency in your compliance monitoring plan, based on the risks in your business: new advisers, complex advice areas and ongoing service files all deserve attention. The more files you check, the less risk sits unseen in the back book.

Should compliance and file quality be scored separately?

Yes. Meeting the FCA's requirements and meeting your own standard of quality are different questions. Scoring them separately shows where a file is unsafe and where it is only untidy.

See how Scrutineer reviews a whole folder against a checklist like this one, or book a twenty-minute demo with Adam Booth on Microsoft Teams, run live on a demo firm with nothing to prepare.