The Compliance Monitoring Plan: What the Board Should Expect From Its SMF16
The compliance monitoring plan is where a compliance function shows whether it is actually working. It sets out what the compliance team will test, when, how and why, and it is the first document many supervisors ask for when they want to understand a firm’s control environment. Yet boards often see only a summary slide once a year. This guide explains what a good compliance monitoring plan contains, what the board should expect to see from its compliance officer, how weak plans show up under supervisory scrutiny, and what that means when you are hiring an SMF16.
Why the Monitoring Plan Matters
The FCA’s rules in SYSC 6.1 require most firms to have a permanent and effective compliance function that monitors, and regularly assesses, the adequacy and effectiveness of the firm’s measures for complying with its regulatory obligations. The compliance monitoring plan is how that requirement becomes practical work. Without one, a compliance function tends to become purely reactive: answering questions, reviewing promotions and handling issues as they arise, but never testing whether the firm’s controls actually work.
The plan also matters for the compliance officer personally. Under the Senior Managers and Certification Regime, the person holding the Compliance Oversight function, SMF16, is accountable for the compliance function. If something goes wrong, a documented, risk-based monitoring plan, carried out and reported on, is one of the strongest pieces of evidence that the compliance officer took reasonable steps. Our guide to SMF16 and SMF17 covers the role in full.
What a Good Compliance Monitoring Plan Contains
There is no single required format, and a plan for a ten-person advice firm should look very different from one for a bank. But good plans share the same building blocks.
| Element | What good looks like |
|---|---|
| Risk assessment | The plan starts from a documented assessment of the firm’s regulatory risks, by business area, product and customer type, not from last year’s plan |
| Coverage | Every material regulatory obligation is mapped to a review, with higher-risk areas tested more often and in more depth |
| Method | Each review states what will be tested, sample sizes, the evidence needed and who carries it out |
| Timetable | Reviews are scheduled across the year, with capacity left for unplanned work and thematic issues |
| Findings and actions | Findings are rated, agreed with business owners, given deadlines and tracked to closure |
| Reporting | Results go to the board or its committees regularly, with a clear view of themes, overdue actions and changes to the plan |
| Review | The plan is updated when the firm’s business, risks or regulation change, not just once a year |
Testing, Not Just Advising
A common weakness is a compliance function that spends almost all its time advising the business and very little testing it. Advice matters: compliance should help the business get things right first time. But a board that only receives advisory updates has no independent evidence that the firm’s controls work in practice.
A good plan includes genuine assurance work: file reviews, call listening, sample testing of financial promotions, complaints and customer outcomes, and checks that policies are being followed. The balance will vary by firm, but the board should be able to see both what compliance advised on and what it tested, and what the testing found.
The Consumer Duty and the Monitoring Plan
For firms dealing with retail customers, the Consumer Duty has changed what monitoring needs to cover. Firms must be able to show that they are delivering good outcomes for customers across products and services, price and value, consumer understanding and consumer support, and the board must review an annual assessment of whether the firm is meeting the Duty. A monitoring plan that tests process compliance but never looks at outcomes will struggle to support that assessment.
In practice, that means compliance monitoring should include outcome testing: whether customers understood what they bought, whether vulnerable customers were treated appropriately, whether complaints point to wider problems, and whether the firm’s management information shows the outcomes it thinks it does. Our guide to the Consumer Duty for Senior Managers explains where accountability sits.
What the Board Should Expect to See
Boards should not need to read every review, but they should expect regular, clear reporting from the compliance officer. A good compliance report to the board typically includes:
- progress against the plan, including reviews completed, deferred or added;
- a summary of significant findings and the themes behind them;
- overdue actions, with owners and revised dates;
- regulatory developments and how the plan has changed in response;
- the compliance function’s own resources, and whether they are adequate;
- any matters the compliance officer believes the board needs to decide or know about; and
- for retail firms, how monitoring feeds into the annual Consumer Duty board report.
The board should also expect the compliance officer to challenge it. A monitoring plan that never produces uncomfortable findings is more likely to be weak than a sign that everything is fine.
How Weak Plans Show Up Under Scrutiny
When the FCA looks closely at a firm, whether through routine supervision, a thematic review or a skilled person review, weaknesses in compliance monitoring tend to show up in familiar ways:
- the plan is generic, with no clear link to the firm’s own risks;
- high-risk areas have not been tested for long periods;
- reviews are planned but repeatedly deferred;
- findings are raised but actions drift without escalation;
- the board receives little or no reporting on monitoring results; or
- the compliance function is too small, or too stretched, to deliver the plan.
Each of these can lead to questions about the firm’s systems and controls and about whether the compliance officer took reasonable steps. Where problems are serious, the FCA may require a section 166 skilled person review, which is far more expensive and disruptive than a well-resourced compliance function.
Scenario: A wealth manager’s compliance officer has run the same annual monitoring plan for several years, focused on advice file checks. The firm has since launched a model portfolio service and grown its use of introducers, but neither is covered. When a new compliance officer joins, her first step is a fresh risk assessment, which identifies the portfolio service, introducer due diligence and ongoing suitability as higher-risk areas. She rebuilds the plan around them, adds outcome testing for the Consumer Duty and gives the board its first quarterly report showing themes and overdue actions. The board, which had assumed monitoring was comprehensive, approves additional resource for the function.
What This Means When You Hire a Compliance Officer
The monitoring plan is one of the most useful things to explore when recruiting an SMF16. Strong candidates can describe, in practical terms, how they build a plan from a risk assessment, how they balance testing with advice, how they report to the board and how they have changed a plan when the business or regulation changed. Weaker candidates tend to describe a plan as a list of reviews inherited from their predecessor.
| Question to ask | What a strong answer shows |
|---|---|
| How did you build your last monitoring plan? | A risk assessment first, then coverage and depth based on risk |
| What did your monitoring find that the business didn’t expect? | Genuine testing, and the confidence to report uncomfortable findings |
| How did you report monitoring to the board? | Clear, themed reporting with actions tracked to closure |
| How did the Consumer Duty change your plan? | Outcome testing, not just process checks |
| What would you do in your first three months here? | A realistic plan to understand the firm’s risks before rebuilding monitoring |
When we recruit for our compliance officer (SMF16) searches, we test exactly this: whether a candidate can design and run monitoring that fits your firm. Our guide to interviewing an SMF candidate has more questions, and our guide to the first 90 days shows what a new compliance officer should do with the plan they inherit.
Smaller Firms and Limited Resources
Smaller firms often worry that a proper monitoring plan is beyond their means. It doesn’t need to be. A risk-based plan for a small firm may cover a handful of reviews a year, with outsourced file checks where volumes justify them. What matters is that the plan reflects the firm’s real risks and is actually delivered. Many small firms find that a part-time compliance officer who holds SMF16 and builds a proportionate plan gives the board far more assurance than an unstructured arrangement.
Where a firm’s monitoring has fallen behind badly, or its compliance officer has left, an interim compliance officer can rebuild the plan and clear the backlog before a permanent appointment.
Compliance Officer Recruitment
Compliance leaders who make monitoring work. Every SMF16 search is led personally by Adrian Lawrence FCA
SMF16 Hiring
Every way to fill the role.
→ Compliance officer recruitment
→ Part-time compliance officer
Interim Cover
When the role is vacant.
→ Interim compliance officer
→ Urgent SMF replacement
Regulatory Guides
The obligations behind the plan.
→ Consumer Duty for Senior Managers
→ Section 166 reviews
Hiring Well
Getting the right person.
→ Interviewing SMF candidates
→ Experience by firm type
Every SMF search is led personally by Adrian Lawrence FCA
Frequently Asked Questions
Is a compliance monitoring plan a regulatory requirement?
The FCA’s rules require most firms to have a compliance function that monitors and assesses the effectiveness of their compliance arrangements. A documented, risk-based monitoring plan is the standard way of meeting that expectation.
How often should the plan be updated?
At least annually, and whenever the firm’s business, risks or regulatory obligations change significantly.
Who should approve the monitoring plan?
Usually the board or a relevant committee, on the compliance officer’s recommendation. Board approval gives the plan authority and makes resource decisions visible.
Can monitoring be outsourced?
Monitoring work can be outsourced, but the compliance officer remains accountable for the plan and for acting on what it finds.
What if the plan isn’t being delivered?
The compliance officer should tell the board, explain why and propose a solution, whether that is more resource, interim support or a revised plan.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He leads every SMF Capital search personally. View Adrian’s ICAEW profile.
Need a Compliance Officer Who Can Build a Plan That Works?
Whether you need a permanent, part-time or interim SMF16, tell us about your firm. We’ll come back to you the same working day.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.
