#fca supervision

A compliance audit letter lands in the inbox. The reaction is often the same across advice firms of every size. Staff scramble for files. Someone asks who last updated the client review log. Nobody quite remembers. 

This need not be the case because most of the engagement between the FCA and its supervised firms is rather predictable, and those who have prepared for it will not suffer from the shock that takes the others by surprise. 

The Actual Look of an FCA Audit 

The FCA rarely surprises its supervised firms with a visit; most of the visits are routine and occur after information gathering, which can be in form of a Dear CEO letter or firm-specific questionnaire. 

There are generally three types of visits: 

Routine supervisory engagement, which follows the FCA's regular cycle for a firm 

Thematic visits, where the FCA studies a specific issue across many firms, such as Consumer Duty implementation 

Event-driven visits, triggered by something specific like a serious complaint or a whistleblower report 

Across all three, the Financial Conduct Authority tends to focus on the same core questions. Does the board understand the firm's risk profile. Is the compliance function genuinely independent. Is management information reliable. Are conduct obligations actually followed, not just written down somewhere. 

That last point matters more than most firms realise. A polished compliance manual means little if the people interviewed during the visit clearly do not operate that way day to day. 

Why Evidence Matters More Than Policy 

Compliance supervision has shifted. It is no longer enough to have the right policies sitting in a folder. The FCA increasingly wants proof that outcomes match what firms claim on paper. 

This is especially true for Consumer Duty. Board minutes, decision records, and file reviews are being scrutinised to see whether reviews actually happened, whether fees still match the service delivered, and whether firms can explain their reasoning when circumstances change. Template completion alone rarely satisfies this level of scrutiny anymore. 

For a smaller advice firm, this can feel overwhelming. The good news is that most of this comes down to habit, not budget. 

Build a Simple, Working Compliance Monitoring Plan 

A firm does not need an elaborate system. It needs a working one. 

An essential aspect of the compliance monitoring process should entail keeping a record of reviews of the client files on a consistent basis, documenting communications with providers all in one place and not several inboxes, as well as identifying any discrepancies before it becomes a trend for an auditor to notice. 

It is precisely the practice of recording everything as it happens, not trying to piece together everything after the fact, which is what makes for a relaxed audit. 

What Auditors Usually Ask For 

Supervisory visits almost always involve requests for specific evidence. Common examples include: 

Board minutes and meeting records 

Management information reports 

Training records for advisers and staff 

Documentation showing customer outcomes, not just policy statements 

If pulling these together takes days instead of minutes, that delay itself becomes a red flag. It signals that oversight is reactive rather than genuinely built into daily operations. 

Common Weak Points Firms Overlook 

A few gaps show up again and again during FCA engagement. 

Disconnected policies. Many firms have well-written compliance manuals that nobody actually follows in practice. This gap is one of the first things a visit tends to expose. 

Unclear ownership. Under the Senior Managers and Certification Regime, individual accountability matters. If nobody can clearly say who owns a particular compliance risk, that ambiguity gets noticed quickly. 

Scattered records. Provider correspondence, suitability notes, and client communication living across separate inboxes make it hard to produce a clean trail when asked. This is one of the most common and most avoidable weak points. 

A Practical Way to Stay Ready Year Round 

Firms that handle audits well rarely start preparing the week the letter arrives. They build small habits earlier. 

Review client files on a fixed schedule, not only when reminded 

Keep provider communication in a structured, searchable format instead of relying on memory or scattered emails 

Document decisions at the time they are made, including the reasoning behind them 

Check periodically whether policies still match how the team actually works day to day 

None of this requires a large compliance department. It requires consistency. 

Closing Thoughts 

An audit is not designed to catch firms out. It is designed to check whether good intentions actually show up in daily practice. Firms that treat recordkeeping and provider communication as an ongoing habit, rather than a once-a-year scramble, tend to walk into these visits with far less stress.