A file review identifies missing evidence of lender approval. Another reveals an unanswered Land Registry requisition. A third shows that staff are using an old version of the client care terms.
The findings go into the compliance plan. Somebody records that the procedures will be reviewed, the team will receive training and the outstanding matters will be resolved.
At the next management meeting, the same actions remain open.
A compliance plan is useful only if it leads to action, evidence and a decision about whether the problem has actually been addressed. Recording an intention is the beginning of that process.
A basic plan can be a starting point
The original version of this article, published in 2013, suggested that a poor compliance plan was better than having no plan at all.
A simple document can certainly help a firm get started. It can expose gaps, organise priorities and make responsibilities visible. Its limitations should then be addressed rather than accepted indefinitely.
A plan can create false reassurance if it repeatedly describes problems without changing what happens on files. The important question is whether management can demonstrate progress against the risks it has identified.
For SRA-regulated firms, the Code of Conduct for Firms requires effective governance and controls, records demonstrating compliance, and the identification, monitoring and management of material business risks. A document labelled “compliance plan” does not, by itself, demonstrate that those obligations are being met.
Distinguish the policy, risk register and action plan
These documents have related but different functions.
- The policy explains the firm’s approach and procedures.
- The risk register records identified risks, controls and the firm’s assessment of its exposure.
- The compliance plan organises the work needed to establish, maintain or improve compliance.
They should connect. A recurring file-review finding may require an action in the plan, a revised control in the policy and reconsideration of the risk recorded in the register.
Our CQS Risk Management Policy guidance explains the wider framework. This article focuses on following identified actions through to a supported conclusion.
Give each action a defined outcome
“Improve lender reporting” is difficult to complete or verify. It does not identify the failure, the affected files or what improvement would look like.
A more useful action would specify the review required, the process to be changed and the evidence expected afterwards.
For example:
Review the identified live matters to establish whether each required lender decision has been received. Record the outcome and escalate unresolved cases before exchange. Revise the reporting procedure and check a subsequent sample of files to establish whether the revised process is being followed.
This is an illustrative action, not a universal procedure or a substitute for checking the lender’s actual requirements.
The action should make clear what must happen now and what will prevent a repeat.
Record ownership, resources and deadlines
“The conveyancing team” is rarely a sufficiently clear owner. Identify the person responsible for delivering the action and the person who will review completion.
Also record:
- the finding or requirement prompting the action;
- its priority and any immediate safeguards;
- the files, staff or systems affected;
- the resources or approval needed;
- a realistic deadline and any interim milestones;
- the evidence required before closure; and
- the route for escalating delay or an unresolved concern.
Lexsure’s Knowledge Hub paragraph on risk roles and responsibilities provides wording to consider when defining the firm’s arrangements.
A named owner must also have sufficient authority, time and support. Allocating every outstanding action to an already overloaded compliance officer does not resolve the capacity problem.
Protect affected clients while the wider fix is developed
A long-term improvement may take time. Existing matters may need attention immediately.
If a review identifies a problem with deed execution, the firm may need to examine relevant documents before completion or submission while it revises its general procedure.
If an approval process is unreliable, training scheduled for next month does not answer what should happen to the live matters currently approaching exchange.
The plan should therefore distinguish immediate protective steps, the wider corrective work and the later check that the revised control operates effectively.
Our article on why a lender portal acknowledgement is not approval illustrates a transaction-level distinction that procedures and file checks need to preserve.
Do not close an action merely because a document changed
A revised policy is evidence that wording has changed. It does not establish that staff understand it or that the relevant files now contain the required work.
Likewise, a training attendance list shows participation. Further checking may be needed to establish whether the underlying issue has been addressed.
Before closing an action, ask:
- Has the agreed work been completed?
- Were affected live matters identified and dealt with?
- Can staff explain the revised process?
- Does a proportionate follow-up review support the conclusion that the control is working?
- Does any remaining risk need further action or management consideration?
The depth of checking should reflect the seriousness and extent of the finding. One successful file does not necessarily resolve a concern affecting several teams.
Our guide to putting a CQS Risk Management Policy into practice considers the wider relationship between procedures, supervision and file evidence.
Explain overdue actions instead of repeatedly moving dates
Sometimes a deadline must change. Record why, what remains exposed, what interim controls apply and who approved the revised timetable.
Repeated postponement may indicate that the action is poorly defined, the owner lacks resources or the proposed solution is not realistic.
Management should be able to distinguish an action awaiting a third party from one that has simply received no attention.
Corrective work also does not replace any separate obligation to inform a client, lender, insurer or regulator. Where a finding raises that question, record the assessment and obtain appropriate advice rather than waiting for the improvement project to finish.
Make the plan part of management decisions
A useful review asks what has changed since the previous meeting, which actions are overdue and whether completed work has reduced the identified risk.
Keep the supporting evidence accessible. Record who authorised closure and why. If the same problem appears again, reconsider the earlier conclusion and the effectiveness of the response.
The firm should be able to trace a clear sequence from finding, to action, to evidence, to review.
Build your compliance plan into a clear risk-management framework
Lexsure’s CQS CPMS Risk Management Policy template includes sections addressing risk roles and responsibilities, the risk register and the compliance plan.
Purchase the policy as a starting point, then adapt it to your firm’s risks, people and procedures. Support the wording with assigned actions, realistic deadlines and evidence of follow-through.
Leave a Reply