Compliance Monitoring & Testing Checklist Template

Start about six weeks before the compliance committee meeting that will receive the result. The first task names the four people, says whether the area has been tested before and which rules on compliance monitoring apply to the firm; each answer adds what it needs. Every due date counts from the committee meeting, in working days.

• Set up the compliance test — the organisation, the test, the obligation area, the period tested, the date of the committee meeting that will receive the result (which every due date counts from), whether the area has been tested before, which rules on compliance monitoring apply, and the four people; later tasks are assigned from these fields
• Take the test from the compliance monitoring plan — the line in the monitoring plan this test comes from, the risk rating that put it there, and why it is due now
• Review the last test of this area and its open findings — the last workpaper and report, findings still open, actions overdue, and what has changed in the area since
• Confirm the obligations being tested — the rules, the firm’s own policies and procedures, and any contract terms the area must follow, with the reference for each, so every test step points back to a requirement
• Tell the business owner the test is coming — the scope, the period, the evidence that will be asked for and the dates, so the people who run the area can plan for it

Write down what the test must show and how, before anyone looks at the evidence, so the results cannot shape the method. The reviewer agrees the design before fieldwork starts.

• Write the test objective — what the test must show, in one or two sentences, for example that every complaint closed in the period had a final response that followed the firm’s procedure
• Map the controls the business relies on — the checks, approvals, system controls and reports in the business that should prevent or catch a breach, who runs each one and what record it leaves
• Set the test steps and what counts as an exception — the attributes checked on each item, the evidence that proves each one, and what makes an item an exception
• Choose how the test will be done — document review, re-performance of the control, analysis of system data, interviews, observation in the business or a review of customer contacts, with the reason for each
• Agree the test design with the reviewer — the reviewer reads the objective, the controls, the steps and the method before fieldwork starts, and records any change

A test is only as good as the list it samples from. Get the whole population for the period, show it is complete, then draw the sample in a way someone else could repeat.

• Request the population for the period — the full list of items in the period (every promotion issued, every complaint closed, every customer file opened), the system it comes from and the date it was run
• Check the population is complete — agree the count or the total to a second source, such as a finance report, a log or a system count, and record any gap and why
• Choose the sampling method and size — the whole population, a random sample, a sample chosen by risk, or a mix, and the reason for the size; this template sets no size, because none of the rules it cites does
• Select the sample and record how it was drawn — the items picked, with the random start or the risk criteria used, so a reviewer could draw the same sample again
• Request the evidence for each sample item — the list of records the business must provide for each item, where to put them and the date they are due back

The workpaper is the record of the test: what was checked, against what, on which evidence, and what was found. Someone who was not there should be able to follow it and reach the same conclusion.

• Open the workpaper — the header with the test reference, the area, the obligations, the period, the population and the sample, the preparer and the reviewer, and where the evidence is filed
• Provide the evidence for each sample item — the business owner sends the records for every item, says which cannot be found and why, and does not change a record after the request
• Test each sample item against the steps — each item checked against every step, marked pass or exception, with the evidence reference beside it
• Talk to the people who run the process — how the process works in practice compared with the procedure, observed where it can be, with notes of who said what and when
• Check every result points to its evidence — each pass and each exception traced to a record kept in the file, and any result without one tested again or removed
• Note anything found outside the scope — issues seen during the test that it was not designed to cover, passed to their owner or added to the monitoring plan, not rated as findings of this test

Count the results, then turn each exception into a finding with a root cause, a rating and an action. The answer on the results task adds the finding tasks when there are exceptions, and the rating task asks whether a finding may need reporting.

• Summarise the results — items tested, items passed, exceptions and the exception rate, and whether the exceptions share a cause
• Confirm each exception with the business owner — the owner sees each exception and can show evidence that was missed; an exception stands unless the evidence clears it
• Find the root cause of each exception — why it happened: a gap in the procedure, a step not followed, a training or resourcing gap, a system fault or a third party, and whether the same cause affects other areas
• Rate each finding — High, Medium or Low on this template’s scale, by the harm to customers or markets, the regulatory exposure and how widespread it is
• Agree an action, an owner and a date for each finding — the business owner proposes the fix for each finding, with a named owner and a due date set by its rating, and compliance agrees it
• Take advice on whether the finding must be reported — whether the law, a regulator’s rules or a contract requires it to be reported, by when and to whom, and who decides; access to the details restricted
• Draft the conclusion on the area — Effective, Needs improvement or Not effective on this template’s scale, with the reasons in two or three sentences

The reviewer, who did not prepare the workpaper, checks it and signs off the test and its findings. Nothing after the sign-off can be completed until the decision is recorded, so a decision on reporting a finding is recorded before it. Approved with changes and Not approved each add a task that says what to do next.

• Send the workpaper for review — complete, cross-referenced, and with every exception, rating and action in it
• Review the workpaper — the reviewer checks the population, the sample, the steps, the evidence behind each result, the ratings and the conclusion, and writes review notes
• Clear the review notes — the tester answers each note, changes the workpaper where needed and records what changed
• Record the decision on reporting the finding — the decision, who made it and when, the date and reference of any report made, and the committee told
• Sign off the test and its findings — the reviewer records the decision on the workpaper, the findings, their ratings and the conclusion; nothing after this task can be completed until it is done
• Make the reviewer’s changes — each change made in the workpaper and the report before it goes to the committee, and the reviewer told what changed
• Rework the test and ask for a fresh sign-off — the tester does the extra testing or rewrites the findings, and the reviewer changes the decision on the sign-off task to Approved, or un-completes and completes it again; nothing goes to the committee until it reads Approved

Report the result to the committee with the findings, their ratings and the actions agreed, and record what the committee asks for. Each rule ticked on the first task adds a task to put the result where that rule expects it.

• Write the test report for the committee — the objective, scope and period, the population and sample, the results, each finding with its rating and action, and the conclusion, sent by the committee’s paper deadline
• Present the results to the compliance committee — the conclusion, the High findings and any actions from earlier tests that are overdue, first
• Record the committee’s questions and actions — what the committee asked, the actions it set, their owners and dates
• Add the result to the compliance report to the management body — for a common platform firm, SYSC 6.1.3-A R(3) requires the compliance function to report to the management body at least annually on the overall control environment, the risks identified and complaints handling; add this test to the record for that report. Another FCA firm adds it to the report its compliance function makes to its board, if it makes one, or marks this task not applicable
• Add the result to the compliance function’s report to management — ESMA’s guidelines list what the mandatory compliance report should contain, including a summary of on-site inspections or desk-based reviews, the major findings and the actions taken; add this test to it
• File the workpaper with the annual review record — the adviser’s annual review under Rule 206(4)-7(b), whose records Rule 204-2(a)(17)(ii) requires it to keep; this template files each test’s workpaper and report with that record
• Add the result to the Rule 3120 report to senior management — the summary of the test results and significant identified exceptions, and any supervisory procedure created or amended because of them

Feed what the test found back into the monitoring plan, so the next test of this area is timed by its result, and file the workpaper where it can be found again.

• Compare the results with the last test — repeat findings, new findings, and actions from the last test that did not work
• Update the monitoring plan from the result — the area’s risk rating, the date of the next test and any change to how often it is tested, with the retest date if there are findings
• File the workpaper and the evidence — the signed-off workpaper, the evidence, the report and the committee’s actions, kept for the period your record-keeping rules set

Applies only when the test found exceptions. Track each action to its date, check the evidence that it is done, then retest the fixed control on items from after the fix before the finding is closed.

• Track the actions to their due dates — overdue actions chased with their owner and escalated to the committee when they slip
• Check the evidence that each action is done — the changed procedure, the training record, the system change or the corrected files, seen by compliance and not only reported by the business
• Retest the fixed controls — a fresh sample of items from after the fix, tested with the same steps, and the result recorded in a retest section of the workpaper
• Close the findings or escalate them — the reviewer closes each finding that passed its retest; any that failed goes back to the business owner with a new date and to the committee