Mortgage broker compliance audit trail

An audit trail answers one question: can somebody who was not there reconstruct what happened, in what order, and who did it? Not roughly. Specifically, with dates, and without relying on anyone's memory.

Firms tend to think they have one because their systems store things. Storing things is not the same as being able to reconstruct a sequence, and the difference only becomes apparent at the worst possible moment.

The reconstruction test

Take a completed case from a year ago. Give it to someone who had nothing to do with it. Ask them to write a page describing what the client wanted, what was recommended, why, what the client was told and when, and what happened between application and completion.

Time how long it takes and note what they cannot answer. Almost every firm that tries this finds three gaps.

The first is timing. Documents exist but their creation dates are unclear, so the order of events cannot be established.

The second is authorship. Something was decided, but not by anybody identifiable.

The third, and the most serious, is reasoning. The recommendation is recorded. The reason it was the right recommendation for this client is not.

What a trail needs to capture

Think of it as five layers, each answering a different question.

Events. What happened and when. Contact made, document received, application submitted, condition raised, offer issued. Each with a date and, where it matters, a time.

Actors. Who did each thing. Not "the firm" and not a shared login. A named individual.

Content. What was actually said or sent. The version of the document that went to the client, not a template that has since been edited.

Decisions. What was chosen, what the alternatives were, and the reasoning. This is the layer software captures worst and matters most.

Changes. What was altered after the fact, by whom, and why. A record that can be silently edited is not evidence.

Where the trail usually breaks

Shared mailboxes and shared logins. If three people use one account, your actor layer is gone. Individual accounts cost a little more and are worth it purely for this.

Communication outside the system. Calls made from mobiles, messages sent on WhatsApp, conversations in a car park. These are the ones where the important reassurance was given and there is no record of it. Either bring the channel into the system or require a contemporaneous note.

Templates that get updated. If your suitability document is generated from a template and you later change the template, can you still show what the client actually received? If the answer is that the system regenerates it live, you have a problem.

Overwriting rather than versioning. A fact find that is amended in place loses the original. Sometimes the difference between the original and the amended version is the whole story.

Notes written later. A note added three weeks after a conversation is worth much less than one written the same day, and worth almost nothing if it is undated or backdated. Contemporaneous means what it says.

Practical habits that build a trail without extra work

• Log the call while it is happening or immediately after, in three lines: what was asked, what was said, what was agreed.
• Date and initial every note, even in a system that does it automatically, because exports do not always carry metadata.
• Send confirmations of significant conversations by email. It creates a timestamped record and it is good service.
• Keep the sent copy of client documents attached to the case, not regenerated on demand.
• Record what you did not do and why, where it was a real decision. Declined product types, lenders ruled out, a client who chose against your recommendation.
• Where a client instructs you against your advice, record their words, your response and their confirmation.

The vulnerability and understanding dimension

Under Consumer Duty the interesting question is often not whether information was given but whether it was understood. That is a harder thing to evidence and there is no neat field for it.

What firms can reasonably record is: what was explained, how it was explained, what the client said back, what checks were made that the client had followed, and what was done differently for a client with additional needs. A note saying the client confirmed they understood is weak. A note saying the client asked what would happen at the end of the fixed period, and was talked through the two scenarios, is strong, because it shows an actual exchange.

Consumer Duty is outcomes-based rather than a checklist, so nobody can hand you a list of fields that discharges it. What you can do is make your records show a real conversation rather than a form being completed.

System questions to ask your provider

• Are actions attributed to individual named users, and is that visible in exports?
• Can records be edited or deleted, and is there a change history if so?
• Are timestamps recorded, and in which time zone?
• Can you export a complete case, including attachments and notes, in a form readable outside the system?
• If you leave the provider, what do you get and in what format?
• Are emails and, where used, call recordings linked to the case automatically?

That fifth question is the one firms wish they had asked. An audit trail that only exists inside a system you no longer subscribe to is not much of a trail.

Retention

Records must be kept for defined periods, and the periods differ depending on the type of record and the activity. There are also separate obligations around identity and anti-money-laundering evidence, and data protection principles pull in the opposite direction by discouraging you from keeping personal data longer than necessary.

Do not take a number from an article, including this one. Confirm your retention periods against the FCA Handbook and the relevant money laundering regulations, and check them against your network's policy if you are an appointed representative, since networks frequently require longer or more specific retention than the baseline. Then write your own policy down and apply it consistently, because an inconsistent retention practice is itself a problem.

The point

An audit trail is not built for a regulator. It is built for the day a client rings about something that happened eighteen months ago, or an adviser leaves and their cases need to be picked up cold. The regulatory value is a byproduct of doing something the business needs anyway.