By Santiago Perez, Compliance Consulting Analyst
At a glance
Compliance frameworks are only as strong as the evidence behind them
Regulatory expectations continue to evolve, with increasing focus on whether firms can demonstrate that their compliance frameworks are operating effectively in practice, rather than simply existing on paper.
Against this backdrop, our Compliance Consulting team conducted compliance health checks across a broad range of regulated investment firms over the past year, identifying 254 individual compliance issues across 47 different control areas.
While the nature, size and operating models of the firms reviewed varied, the findings point to a consistent theme: many firms understand their regulatory obligations in principle, but struggle to evidence that their compliance frameworks are complete, current and operating effectively in practice.
The most common findings were not confined to niche regulatory requirements or complex edge cases. Instead, they repeatedly appeared in core compliance areas such as anti-money laundering (AML), conflicts of interest, financial promotions, market abuse, outsourcing and Senior Managers and Certification Regime (SM&CR).
For many firms, the key risk is not identifying regulatory obligations. Rather, it is that the policies, registers, risk assessments, monitoring arrangements and governance evidence designed to manage those obligations are either missing, outdated or not sufficiently tailored to the way the business actually operates.
A concentration of risk in core control areas
One of the clearest insights from the findings is that compliance risk was not evenly distributed across firms’ frameworks.
Key finding: 75% of all issues identified were concentrated within just 16 of the 47 control areas reviewed.
Out of 47 control areas reviewed, just 16 accounted for 75% of all issues identified. This indicates that a relatively small number of compliance areas are driving the majority of weaknesses observed across the sample.
For investment firms, this concentration highlights a practical challenge. The areas most likely to fall short of regulatory expectations are often the same areas management teams assume are already covered adequately because a control framework exists.
The most commonly affected areas
| Control area | Total incidents (%) | Affected firms (%) |
| AML | 9% | 48% |
| Gifts and inducements | 8% | 40% |
| SM&CR | 8% | 36% |
| Conflicts of interest | 6% | 40% |
| Market Abuse | 5% | 36% |
The most commonly affected areas are central parts of the compliance framework through which firms conduct risk management and demonstrate financial crime control, governance, accountability and oversight. Although the specific regulatory obligations differ across these areas, the underlying pattern is consistent – firms may have had a framework in place, but the supporting evidence was incomplete, outdated or not sufficiently robust.
The real problem: not complexity, execution
When the findings are categorised by issue type, the underlying cause becomes clearer. The most common failings were not driven by complex regulatory interpretation, but by weaknesses in execution.
Across the issues identified, three themes stood out:
1. Missing controls
The most frequent issue was missing documentation or missing controls, affecting 84% of firms and accounting for 43% of all issues identified.
This included missing:
- Policies
- Registers
- Disclosures
- Risk assessments
- Statements of Responsibilities
This is a significant finding. Where a core document, register or assessment is missing, the firm may struggle to demonstrate that the relevant risk is being identified, managed or escalated, or that robust systems and controls are in place. These types of issues generally present high regulatory risk and may amount to a breach of regulatory requirements.
2. Outdated frameworks
The second most common issue identified was documentation or controls requiring review or update. This affected 80% of firms and accounted for 31% of all issues identified. Examples included outdated policies, registers, compliance manuals, risk systems and SMF documentation.
This reflects a common challenge for investment firms. A framework may have been appropriate when first introduced, but if it is not reviewed as the business activities or operating model evolve, it can quickly become disconnected from the firm’s current risk profile and regulatory requirements.
In practice, an outdated policy provides limited comfort if it no longer reflects how the business operates. Similarly, a register or risk assessment that is not regularly maintained may fail to give senior management an accurate view of the risks being managed.
3. Inadequate design or oversight
Inadequate controls affected 48% of firms and accounted for 6% of incidents.
Findings included shortcomings in due diligence, monitoring, policy design, risk assessment and training, particularly across conflicts of interest, AML, outsourcing and operational resilience.
This demonstrates an important point: the existence of a control does not necessarily mean it is effective. A firm may have an outsourcing process, but if onboarding documentation is incomplete or monitoring is not performed, effective oversight may be compromised. Similarly, a firm may have an AML framework, but if risks are not appropriately rated or monitoring is insufficient, it may struggle to evidence that financial crime risks are being managed effectively.
The question for firms is therefore not only whether a control exists, but whether it is appropriately designed, tailored to the business and capable of being evidenced.
What the findings tell us about root causes
Compliance is not always fully embedded
Many firms have compliance frameworks that exist on paper but are not consistently reflected in day-to-day processes. This suggests that compliance is sometimes treated as a set of documents rather than an operating framework embedded across the business. The risk is that, when challenged, firms can point to a policy but cannot demonstrate that the associated control is actively used, understood and maintained.
Governance frameworks are not always matched by execution
The findings highlight a gap between governance structures and day-to-day execution, and suggest that this is where many firms are most exposed. A framework may appear appropriate at a high level, but still fall short if it is not supported by timely reviews, accurate records, meaningful testing and clear ownership.
Practical steps firms should consider
Based on the findings, firms should consider whether their current framework could withstand detailed review. Key areas to prioritise include:
- Conducting a gap analysis of core policies, registers, disclosures, risk assessments and SM&CR documentation
- Implementing formal review cycles for key compliance documents and ensuring those reviews are evidenced
- Checking whether AML, conflicts of interest, market abuse, outsourcing and operational resilience risk assessments remain aligned to the firm’s current activities
- Strengthening management information to support review, challenge and escalation by senior management
- Documenting monitoring outcomes, remediation actions and ownership of identified weaknesses
These steps should not be approached as a one-off remediation exercise. Effective compliance frameworks are dynamic and require regular review to ensure they remain aligned with evolving business activities and regulatory expectations.
How IQ-EQ can help
Our Compliance Consulting team supports investment firms in assessing, strengthening and evidencing their compliance frameworks. This includes reviewing policies and procedures, testing registers and controls, assessing governance arrangements, identifying gaps against regulatory expectations and supporting remediation.
Get in touch to understand whether your firm’s compliance framework is appropriately designed, maintained and evidenced, and whether your current policies and procedures would withstand regulatory scrutiny.
Source note: Article findings are based on IQ-EQ Compliance Consulting health check review across 25 investment firms, covering 254 identified individual compliance issues across 47 compliance areas.
