Why a Written Plan Matters

The FCA’s systems and controls rules in SYSC 6.1 require firms to have adequate arrangements to ensure they comply with their obligations, and investment firms within MiFID must run a permanent, risk-based monitoring programme. For retail firms, the Consumer Duty adds a requirement to monitor the outcomes customers receive. A written plan is how a firm shows those arrangements exist and are proportionate.

A plan also protects the compliance officer. It records what the board approved, what was tested and why, and what was deliberately left out. If something goes wrong in an area that wasn’t tested, a documented, risk-based decision is far easier to defend than an omission. For the full framework, see our guide, Compliance Monitoring Explained.

What’s in the Template

How to Complete It

• List your monitoring areas. Start from your permissions, products, customers and distribution channels. Typical areas include suitability, Consumer Duty outcomes, vulnerable customers, financial promotions, complaints, financial crime, client money or safeguarding, and Conduct Rules.
• Score each area. Rate likelihood and impact from 1 to 3, using evidence such as complaints, breaches, previous findings, business changes and regulatory focus. Record the reasoning, not just the number.
• Apply the frequency rules. Higher scores mean more frequent reviews. Adjust the rules if your firm’s risk profile needs something different.
• Build the calendar. Spread reviews across the year, avoid your busiest periods, and leave time in the final quarter to retest earlier findings.
• Check the days. Add up the days each review needs and compare them with the time available. If they don’t match, add resource or record what won’t be covered.
• Agree the rating scale. Use the template’s scale or adapt it, but apply it consistently across every review.
• Get board approval. Present the plan to the board or its risk or audit committee, and record the approval date.

Choosing Methods and Samples

The calendar asks for a method and sample for each review. The right choice depends on the area and the risk:

For sampling, focus on higher-risk cases and new staff, and record how the sample was chosen. Our article on the compliance monitoring plan and what the board should see covers how to present your choices to directors.

Recording Areas Not Tested

No plan can test everything every year. The template includes a line under the calendar for areas deliberately left out, with the reason. That small step turns a gap into a documented, risk-based decision, which is exactly what the regulator expects to see. Review those areas at least every two years, and sooner if something changes.

Using the Actions Log

The findings and actions log is where monitoring turns into improvement. Give every finding a reference, a rating, an agreed action, an owner and a due date, and update its status each month. Retest High findings once closed, and treat any repeat finding as one level more serious. An action log full of overdue items is one of the first things a regulator notices, so report it honestly to the board.

Smaller Firms

The template works for firms of any size, but small firms should keep it proportionate. A directly authorised advice firm with a handful of advisers might have six to eight monitoring areas, a dozen reviews a year and a total of 15 to 25 monitoring days. The same structure applies; there is simply less of it. Where the compliance officer is also the MLRO, consider having an outsourced reviewer test the financial crime areas, so the person running the controls isn’t checking their own work. Our article Who Checks the Checker? explains why.

Example: A Completed Risk Assessment Row

A single row of the risk assessment, completed well, looks like this:

The first row scores 6, so suitability is reviewed at least twice in the year. The second scores 2, so complaints handling can be reviewed every other year, with the decision recorded in the plan. The rationale column is what makes the scores defensible: anyone reading the plan can see why the firm spent its monitoring time where it did.

Who Should Own the Plan

The compliance officer, usually holding the SMF16 compliance oversight function, owns the plan and is accountable for delivering it. The board approves it and oversees the results. Running a good monitoring programme takes specific skills: building a risk-based plan, testing objectively, writing findings people act on and reporting clearly to the board. If your compliance function doesn’t have the time or experience, SMF Capital recruits compliance officers, including part-time compliance officers for smaller firms, with real monitoring experience.

Frequently Asked Questions

Is the template free?

Yes. Download it and adapt it for your firm, with no sign-up. It’s general guidance, not legal or regulatory advice.

How often should the plan be updated?

Review it at least annually, and whenever the business changes significantly, new rules arrive or monitoring finds problems that suggest wider risk.

Who approves the compliance monitoring plan?

The board or its risk or audit committee, usually at the start of each year, with any material changes reported during the year.

Can I use the template for financial crime monitoring?

Yes. Include financial crime areas such as due diligence, transaction monitoring and sanctions screening in the risk assessment and calendar. Consider who carries out that testing if your compliance officer is also the MLRO.

What’s the difference between this template and the board guide?

This template is the working plan the compliance officer completes. Our guide to what the board should see explains how directors should review and challenge it.