Building a Year’s Compliance Monitoring Plan: A Worked Example

Most guidance on compliance monitoring explains the principles: be risk-based, test outcomes not just paperwork, report clearly to the board, follow up actions. All true, and all harder to apply than it sounds when a compliance officer sits down with a blank spreadsheet in January.

This article takes a different approach. It works through a single year’s monitoring plan for an illustrative small firm, step by step, to show how the principles turn into a practical programme. The firm is invented, but the decisions are the ones real compliance officers make every year. For the full framework behind it, including the rules, testing methods and common weaknesses, see SMF Capital’s guide, Compliance Monitoring Explained.

The Example Firm

Our firm is a directly authorised wealth management and financial advice business with around 30 staff, eight advisers, a discretionary investment service and roughly 2,000 retail clients. It does not hold client money. It has one compliance officer holding the SMF16 function, who is also the MLRO, supported by a part-time compliance assistant. The board meets quarterly.

This is a common profile, and a useful one, because it has to cover several regulatory areas with limited resources. That forces real choices about what to monitor and how often.

Step 1: Start From the Risks

A monitoring plan should start from the firm’s assessment of where things are most likely to go wrong and how much harm would result. The FCA’s systems and controls rules in SYSC 6.1 require adequate arrangements to ensure compliance, and a risk-based plan is how a firm shows its arrangements are proportionate.

The compliance officer scores each area for likelihood and impact on a simple 1 to 3 scale, drawing on last year’s findings, complaints data, regulatory focus and any changes in the business. For financial crime, the firm’s business-wide risk assessment provides the starting point.

The scores drive frequency. Areas scoring 6 are tested at least twice in the year, areas scoring 4 once, and areas scoring 2 once every two years unless something changes.

Step 2: Turn the Scores Into a Calendar

The compliance officer then spreads the reviews across the year, avoiding the busy periods around tax year end and board meetings, and making sure findings from the first half can be retested in the second.

Complaints handling and Conduct Rules are not tested this year, based on their low scores. The plan records that decision and the reason, so the board and the regulator can see it was deliberate rather than an omission.

Step 3: Decide How Each Review Will Test

Each review has a short terms of reference: scope, the rules or policies tested against, method, sample size and who will do it. For the suitability review, for example:

• Scope: new advice cases in the previous six months.
• Standard: the suitability rules and the firm’s advice process.
• Method: full file review, including the fact find, risk profiling, research, recommendation and the suitability report.
• Sample: 100% of the two new advisers’ cases, plus a risk-based sample of 10% of other advisers’ cases, weighted towards pension transfers and older clients.
• Reviewer: an outsourced file reviewer, because the compliance officer signed off some of these cases and independence matters here.

The Consumer Duty review looks different. It tests whether the firm’s outcome data is complete and whether the board’s view of fair value is supported by evidence, in line with the FCA’s Consumer Duty expectations. The vulnerable customers work draws on SMF Capital’s guide to what the FCA expects on vulnerable customers.

Step 4: Agree a Rating Scale

Consistent ratings make findings comparable across reviews and over time. Our firm uses a three-level scale:

Every finding has an owner, an agreed action and a date. High-rated actions are retested once closed, and any repeat finding is automatically raised one level.

Step 5: Report to the Board

Each quarter the board receives a short monitoring report: what was tested, the overall rating for each review, the high and medium findings with their owners and dates, and the status of every open action. Overdue actions are listed by name. Once a year, the compliance officer presents a summary of the whole programme and the proposed plan for the following year, with any changes explained. SMF Capital’s article on the compliance monitoring plan and what the board should see covers this in more detail.

Step 6: Close the Loop

At year end, the results feed back into the risk scores. Suppose the Q1 suitability review found weaknesses in one new adviser’s risk profiling, which were fixed by Q4. Suitability stays at a high score for next year, but the adviser-specific sampling can return to normal. If the financial promotions review found the social media process working well, that area’s likelihood score may drop. Each change is recorded, so the plan’s evolution can be followed from year to year.

What the Example Shows

Three lessons stand out. First, a small firm can run a credible, risk-based programme without a large team, provided it makes deliberate choices and records them. Second, independence can be bought where it matters most, such as reviewing files the compliance officer approved, without outsourcing the whole programme. Third, the plan is only as good as the follow-through: the action log and the retesting are what turn monitoring into evidence.

It also shows how much rests on the compliance officer. Designing the plan, writing terms of reference, reviewing files, rating findings and presenting to the board all need real experience. For firms recruiting into the role, SMF Capital’s compliance officer recruitment page explains what to look for.

For the complete framework, including testing methods, sampling, financial crime and Consumer Duty monitoring, technology, resourcing and a getting-started checklist, read Compliance Monitoring Explained.