Compliance Programs Fail Between The Audits

3 days ago

4 min read

A financial firm passes its annual compliance review in March. Policies are current, the manual has been updated, and the testing report notes no material findings. Everyone moves on.

By September, a portfolio manager is texting clients from a personal phone, a new marketing deck has gone out quoting performance without the required context, and a vendor holding client data has quietly changed its security arrangements. None of it was hidden. Nobody was looking, because the review was done.

When regulators arrive, they rarely ask whether a firm had a compliance program. They ask whether it worked on an ordinary Tuesday.

Policies Are Not The Program

Most firms in regulated industries have a compliance manual. Many of those manuals are thorough, well drafted, and largely disconnected from how the business actually operates.

The gap appears in three places. Policies describe procedures that staff do not follow, often because the procedures were written for a smaller or different firm. Policies describe controls that nobody tests. And policies fail to cover activities the business started after the manual was last revised.

Examiners are trained to look for exactly this. A written policy that the firm cannot show it follows can be treated as worse than no policy at all, because it shows the firm knew what it should be doing.

The working definition of a compliance program is therefore not the documentation. It is the documentation plus evidence that the documentation reflects reality, gathered continuously rather than once a year.

Communications Became The Pressure Point

For years, recordkeeping was treated as an administrative matter. That changed when regulators began examining how business conversations actually happen.

Client and colleague communication moved to text messages, messaging apps, and personal devices long before most firms' archiving caught up. Rules requiring firms to preserve business communications did not change with the technology, so conversations that happened off approved channels became unpreserved records.

Regulators in the United States pursued this aggressively in recent years, bringing actions against a long list of firms for off-channel communications failures. The lesson for any regulated business is broader than messaging. When the way work is done changes, the controls have to follow, and assuming that staff will stick to approved tools without monitoring is not a control.

Practical responses include approved messaging platforms with capture built in, clear rules on personal devices, periodic attestations, and, crucially, testing to confirm the rules are being followed.

Marketing Gets Scrutinized Line By Line

Investment marketing carries specific rules about what can be said, how performance is presented, and what context must accompany it.

The risk is volume. A firm might produce dozens of pitch decks, social posts, website updates, and client letters each quarter, and each one is a regulated communication. Performance figures need consistent methodology, testimonials and endorsements have conditions attached, and hypothetical results carry their own restrictions.

Firms that manage this well route marketing through a review process before release, keep records of what was approved, and retain the support for every figure they publish. Firms that struggle tend to discover their deck library during an examination, with no record of who signed off on what.

Technology Shifts The Burden

Cybersecurity and data protection now sit firmly inside compliance rather than beside it.

Regulators expect firms to know where client data lives, who can access it, how it is protected, and what happens when something goes wrong. That extends to vendors. A firm that outsources custody, technology, or administration does not outsource responsibility for those functions, and vendor due diligence that ended at onboarding offers little protection years later.

Approaches to ACA risk and compliance management and similar frameworks increasingly treat these areas as continuous monitoring problems: surveillance of communications and trading, regular review of vendor arrangements, and periodic testing of incident response rather than a single annual tabletop exercise.

Technology helps with the volume. Automated surveillance can review far more communications and transactions than any team could manually. It does not replace judgment. Alerts still need reviewing, and a surveillance system producing thousands of unreviewed flags creates a record that the firm saw problems and did nothing.

Testing Is The Evidence

The difference between a firm with policies and a firm with a working program usually comes down to testing.

Testing means selecting samples and checking them against the rule. Were the trades in this period allocated fairly? Did the marketing reviewed this quarter have proper approval? Were personal trading reports submitted and reviewed on time? Were access rights removed promptly for departing staff?

Each test produces evidence, and the evidence is what demonstrates the program functions. Findings matter less than how they are handled. A testing report that identifies weaknesses and documents the fix shows a program working as intended. A report that never finds anything often invites more scrutiny, not less.

Frequency should follow risk. Areas with high volume or recent problems deserve more frequent testing than stable, low-risk processes.

Culture Sets The Ceiling

Compliance teams can design controls, but they cannot be present in every conversation. Whether the program works depends heavily on how senior leadership treats it.

In firms where compliance is consulted early on new products, new markets, and new technology, problems tend to surface before they become violations. In firms where compliance hears about initiatives after launch, the function spends its time cleaning up.

Leadership signals are noticed. When a senior partner ignores a procedure without consequence, the procedure effectively stops existing for everyone else. When leaders follow the same rules as junior staff, and visibly support the compliance function's authority, the program carries weight.

Training reinforces this, but only when it is specific. Generic annual modules teach people to click through. Short, targeted sessions built around real situations the firm faces tend to change behavior.