{"id":2049,"date":"2026-11-03T12:20:15","date_gmt":"2026-11-03T12:20:15","guid":{"rendered":"https:\/\/iqeq.com\/gb\/insights\/what-compliance-health-checks-reveal-the-most-common-failures-across-investment-firms\/"},"modified":"2026-11-03T12:20:17","modified_gmt":"2026-11-03T12:20:17","slug":"what-compliance-health-checks-reveal-the-most-common-failures-across-investment-firms","status":"publish","type":"post","link":"https:\/\/iqeq.com\/gb\/insights\/what-compliance-health-checks-reveal-the-most-common-failures-across-investment-firms\/","title":{"rendered":"What compliance health checks reveal: the most common failures across investment firms"},"content":{"rendered":"
\n

By Santiago Perez, Compliance Consulting Analyst<\/p>\n <\/div>\n<\/section>\n\n

\n
\n
\n
\n
\n

At a glance<\/p>\n

<\/div>\n <\/div>\n
\n
\n

Over the past year, IQ-EQ’s Compliance Consulting team identified 254 compliance issues across 25 regulated investment firms and 47 control areas. While the specific findings varied, a consistent pattern emerged: the majority of weaknesses were not linked to complex regulatory requirements, but to gaps in execution. Missing documentation, outdated frameworks and ineffective oversight were far more common than technical compliance failures. For investment firms, the challenge is no longer simply implementing a compliance framework, but being able to demonstrate that it remains current, tailored to the business and operating effectively in practice.<\/p>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/section>\n\n

\n

Compliance frameworks are only as strong as the evidence behind them<\/h2>\n

Regulatory expectations continue to evolve, with increasing focus on whether firms can demonstrate that their compliance frameworks are operating effectively in practice, rather than simply existing on paper.<\/p>\n

Against this backdrop, our Compliance Consulting team conducted compliance health checks across a broad range of regulated investment firms over the past year, identifying 254 individual compliance issues across 47 different control areas.<\/p>\n

While the nature, size and operating models of the firms reviewed varied, the findings point to a consistent theme: many firms understand their regulatory obligations in principle, but struggle to evidence that their compliance frameworks are complete, current and operating effectively in practice.<\/p>\n

The most common findings were not confined to niche regulatory requirements or complex edge cases. Instead, they repeatedly appeared in core compliance areas such as anti-money laundering (AML), conflicts of interest, financial promotions, market abuse, outsourcing and Senior Managers and Certification Regime (SM&CR).<\/p>\n

For many firms, the key risk is not identifying regulatory obligations. Rather, it is that the policies, registers, risk assessments, monitoring arrangements and governance evidence designed to manage those obligations are either missing, outdated or not sufficiently tailored to the way the business actually operates.<\/p>\n

A concentration of risk in core control areas<\/h2>\n

One of the clearest insights from the findings is that compliance risk was not evenly distributed across firms\u2019 frameworks.<\/p>\n

Key finding<\/strong>: 75% of all issues identified were concentrated within just 16 of the 47 control areas reviewed.<\/p><\/blockquote>\n

Out of 47 control areas reviewed, just 16 accounted for 75% of all issues identified. This indicates that a relatively small number of compliance areas are driving the majority of weaknesses observed across the sample.<\/p>\n

For investment firms, this concentration highlights a practical challenge. The areas most likely to fall short of regulatory expectations are often the same areas management teams assume are already covered adequately because a control framework exists.<\/p>\n

The most commonly affected areas<\/h2>\n
\n\n\n\n\n\n\n\n
Control area<\/td>\nTotal incidents (%)<\/td>\nAffected firms (%)<\/td>\n<\/tr>\n
AML<\/td>\n9%<\/td>\n48%<\/td>\n<\/tr>\n
Gifts and inducements<\/td>\n8%<\/td>\n40%<\/td>\n<\/tr>\n
SM&CR<\/td>\n8%<\/td>\n36%<\/td>\n<\/tr>\n
Conflicts of interest<\/td>\n6%<\/td>\n40%<\/td>\n<\/tr>\n
Market Abuse<\/td>\n5%<\/td>\n36%<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n

 <\/p>\n

The most commonly affected areas are central parts of the compliance framework through which firms conduct risk management and demonstrate financial crime control, governance, accountability and oversight. Although the specific regulatory obligations differ across these areas, the underlying pattern is consistent \u2013 firms may have had a framework in place, but the supporting evidence was incomplete, outdated or not sufficiently robust.<\/p>\n

The real problem: not complexity, execution<\/h2>\n

When the findings are categorised by issue type, the underlying cause becomes clearer. The most common failings were not driven by complex regulatory interpretation, but by weaknesses in execution.<\/p>\n

Across the issues identified, three themes stood out:<\/p>\n

1. Missing controls<\/h3>\n

The most frequent issue was missing documentation or missing controls, affecting 84% of firms and accounting for 43% of all issues identified.<\/p>\n

This included missing:<\/p>\n