When Compliance Monitoring Tests Your Finance Function: What Actually Gets Reviewed
Most financial controllers who move into an FCA-regulated firm from unregulated industry discover compliance monitoring in the same way: an email arrives from the compliance officer saying that client money reconciliations are on the monitoring plan for Q2, and asking for a sample of twelve daily reconciliations with supporting evidence.
The reaction is usually a mix of irritation and mild alarm. Irritation because the request lands in the middle of month-end. Alarm because it is not obvious what “supporting evidence” means, what will be done with it, or what happens if the reviewer does not like what they find.
This guide is written for that moment. It covers what compliance monitoring actually is from the finance side of the table, which finance processes typically appear on a monitoring plan, what a reviewer is looking for, and what it means when a finding is raised against your function.
What monitoring is, and what it is not
Compliance monitoring is a planned, risk-based programme of reviews and tests carried out by the second line — the compliance function — to establish whether the firm actually does what its policies say it does, whether its controls work, and whether customers get good outcomes. It is a requirement rather than a preference: SYSC 6.1 of the FCA Handbook requires firms to maintain a permanent and effective compliance function, and for MiFID firms the Organisation Regulation sets out the monitoring obligation in more detail.
Three distinctions matter to a finance team, because conflating them causes most of the friction.
- Monitoring is not audit. Internal audit is the third line and reports to the audit committee; it assesses whether the whole control framework, including compliance monitoring itself, is adequate. Compliance monitoring is second line and tests the business directly.
- Monitoring is not your own checking. The reconciliation review your finance manager performs before sign-off is first-line quality assurance. It is part of the control being tested, not evidence that testing has happened.
- Monitoring is not advice. The compliance officer who helps you interpret a rule is doing something different from the compliance officer who tests whether you applied it. Good functions keep the two separate, and the reviewer who wrote your procedure should not be the one assessing it.
SMF Capital’s complete guide to compliance monitoring for FCA-regulated firms sets out how the programme is designed, risk-rated and reported to the board. It is worth reading in full if you are new to a regulated environment, because it explains the machinery your function is about to be assessed by.
Which finance processes land on the plan
Monitoring plans are risk-based, so what appears depends on the firm’s permissions and business model. Across the regulated FC searches we run, these are the finance-owned areas that recur.
| Area | What gets tested | Typical firm types |
|---|---|---|
| Client money and asset reconciliations | Internal and external reconciliations performed daily, differences identified and resolved within the required timeframe, records retained, segregation maintained | Investment managers, brokers, wealth managers, any CASS firm |
| Safeguarding reconciliations | Relevant funds correctly identified and segregated, reconciliation frequency and accuracy, evidence of the safeguarding method applied | Payments and e-money institutions |
| Regulatory returns | Accuracy against the underlying ledger, preparer and reviewer evidence, submission within deadline, resubmission history and why | All authorised firms |
| Prudential and capital monitoring | Own funds and liquidity calculations, headroom monitoring, escalation when thresholds are approached | Investment firms under IFPR, payment institutions |
| Fees, charges and value | Whether charges applied match the published schedule, whether fee structures support the fair value assessment | Retail firms under the Consumer Duty |
| Breach identification and escalation | Whether finance-identified errors reached the breach log, how quickly, and whether any met the notification threshold | All firms |
| Expenses, conflicts and inducements | Approval trails, gifts and hospitality recording, related-party transactions | All firms, higher focus in advice and brokerage |
Two things surprise people. The first is how often regulatory returns appear — finance frequently treats these as a filing exercise and is startled to find the figures traced back to the ledger. The second is that the Consumer Duty has pulled fee and charge data firmly into scope, which means finance data is now tested for customer outcomes rather than just arithmetic. Our note on the management information the Duty requires from finance covers that side in more detail.
What the reviewer is actually looking for
This is where unregulated habits cause most of the damage, because the standard is different from the one finance usually works to.
In an unregulated business, a reconciliation that is correct is a reconciliation that is finished. In an authorised firm, a reconciliation that is correct but undocumented is a finding. The reviewer is not re-performing your work to see whether you got the right answer; they are establishing whether an independent third party could satisfy themselves, months later, that the work was done properly, by someone competent, at the right time, and that anything unusual was dealt with.
In practice they are testing four things.
- That it happened. Dated, attributable evidence that the control was performed on the required frequency — not a spreadsheet that could have been produced yesterday.
- That someone competent reviewed it. A separate reviewer, evidenced, with enough seniority to challenge. Self-review is the single most common weakness found in small finance teams.
- That exceptions were handled. A reconciliation with no differences every single month is treated as a warning sign, not a success. Reviewers look for breaks being identified, investigated, aged and cleared.
- That the escalation route worked. Where something went wrong, whether it reached the breach log, the compliance officer and — if it crossed the threshold — the regulator.
The uncomfortable implication for a stretched function is that doing the work well is not enough. Our guide to designing financial controls that actually work covers the evidencing discipline that makes a control testable, which in a regulated firm is the difference between a clean review and a finding.
How findings are rated, and what happens next
Findings are normally rated High, Medium or Low, and the rating drives what follows rather than simply recording severity.
| Rating | What it usually means | Consequence for finance |
|---|---|---|
| High | A control is absent or has failed in a way that creates customer harm, regulatory breach or material misstatement risk | Remediation plan with a named owner and a short deadline; board visibility; probable re-test within the quarter; possible FCA notification |
| Medium | The control exists but is inconsistently applied or inadequately evidenced | Agreed action with a date, tracked to closure and re-tested at the next cycle |
| Low | Housekeeping — documentation, version control, minor timing | Logged and tracked; usually closed by the next review |
Three features of the process catch finance teams out. Findings are tracked to closure, so an action accepted and not delivered becomes a worse problem than the original issue. Findings are re-tested, so saying it is fixed is not the same as demonstrating it. And root cause analysis means the reviewer will push past the symptom: a late reconciliation caused by one person’s holiday is a resourcing and succession finding, not a one-off.
That last point is where monitoring and hiring intersect. A recurring finding that traces back to a single person carrying a control with no cover is, in substance, a statement that the function is under-resourced — and it will be read that way by the board.
Preparing for your first review
If finance has just appeared on the monitoring plan for the first time, five things will make the difference.
- Ask for the scope in writing. Which processes, which period, what sample size, what evidence format, and when the findings will be discussed. A reviewer who cannot answer that has not planned the review properly.
- Walk the process before they do. Follow one transaction end to end and ask whether an outsider could see, from the records alone, that each control operated. The gaps you find yourself are cheaper than the ones they find.
- Fix the evidencing, not the answer. In most first reviews the work is being done correctly and simply is not provable. That is a quick fix and a much better conversation than a control failure.
- Be honest about known issues. A break you have identified, logged and are working through is a functioning control. The same break discovered by the reviewer is a finding.
- Attend the close-out meeting yourself. Findings get drafted in language that will reach the board. If the characterisation is wrong, the time to say so is before it is written up, not afterwards.
What this means for hiring
There is a meaningful difference between a financial controller who has produced a regulatory return and one who has had their return tested, challenged and re-performed by a second line reviewer. The second has learned a discipline the first has not: that in a regulated firm, the work is not finished when the number is right, it is finished when the number is demonstrable.
It is also the reason that the regulated premium exists. Candidates who have operated inside an authorised firm and been through monitoring cycles are genuinely scarcer than the job adverts suggest, which is the subject of our note on why regulated-firm finance roles pay a premium. When we run FC searches for FCA-regulated firms, the interview question that separates candidates fastest is simply: tell me about a monitoring finding raised against your function, and what changed afterwards.
Candidates who have lived it describe the finding, the root cause and the re-test. Candidates who have not describe their policies.
The short version
Compliance monitoring is not an audit, not an attack and not optional. It is the firm’s own mechanism for finding problems before the regulator does, and finance is squarely within its scope — client money, safeguarding, returns, capital, fees and breach escalation all sit on the plan at most authorised firms.
For a well-run function the review is an inconvenience and a validation. For a function where the work is sound but the evidence is thin, it is a wake-up call that is far better delivered internally than by a supervisor. And for a function carrying controls on one person’s shoulders, it is the document that finally makes the resourcing gap visible to the board.
If you are new to the regulated environment and want to understand the programme that is about to assess you, SMF Capital’s guide to compliance monitoring explains how the plan is built, risk-rated, tested and reported.
Related services and guides
Every search is led personally by Adrian Lawrence FCA.
PRACTICE AREA
FC recruitment for FCA-regulated firms
Controllers who have operated inside authorised firms and been through monitoring cycles.
PRACTICE AREA
CASS and client money recruitment
Specialist client money and reconciliation experience for CASS firms.
PRACTICE AREA
Regulatory reporting recruitment
People who can produce returns that survive being tested.
A Note from Our Founder — Adrian Lawrence FCA
The first monitoring review is a rite of passage, and in my experience it is almost never the disaster people fear. What it usually exposes is not incompetence but informality — a function where the right things are being done by capable people who have never had to prove it to a stranger. That is a fixable problem, and far better found by your own compliance officer than by a supervisor. The reviews that do go badly are the ones where a single person has been quietly carrying a control nobody else understands, and the finding simply makes visible what the finance director already suspected.
Adrian Lawrence FCA
Founder, Accountancy Capital — qualified finance recruitment at £50,000 and above. Adrian is a Chartered Accountant and holds an ICAEW practising certificate in his own name — view Adrian’s ICAEW profile.
Hiring finance into an FCA-regulated firm?
Shortlists in 5–7 working days; interim and fractional in 48–72 hours. Every search led personally by a Chartered Accountant.
Adrian Lawrence FCA is the founder of Accountancy Capital and a Fellow of the Institute of Chartered Accountants in England and Wales (ICAEW). He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience as a Chartered Accountant and finance leader working with private, PE-backed and owner-managed businesses across the UK
He helps his clients achieve their growth and success goals by delivering value and results in areas such as Financial Modelling, Finance Raising, M&A, Due Diligence, cash flow management, and reporting. He is passionate about supporting SMEs and entrepreneurs with reliable and professional Chief Financial Officer or Finance Director services.