Why a robust paper trail is crucial for compliance

As licensees endeavour to meet their breach reporting obligations as part of a broader compliance culture, a legal expert has emphasised why robust documentation will prove fruitful, particularly in the face of potential regulatory investigations. 

Now in its third year, ASIC’s reportable situations regime requires licensees to submit reports of any breaches and is used by ASIC to identify any emerging trends and detect non-compliant behaviour. 

Around 2,298 reports were submitted by licensees during FY24, divided by 913 AFSLs that lodged 8,636 reports, and 161 credit licensees that submitted 4,088 reports.

However, in a recent review ASIC identified “poor practice” by licensees in complying with the regime, including gaps in how they monitored their own compliance, slow reporting to the regulator, and deficiencies in licensees’ incident management. 

Speaking to Money Management, Selina Nutley, partner at Hall & Wilcox, remarked the regime aims to identify any misconduct and create a culture of industrywide compliance and deterrence.

VIEW ALL

View all

But achieving this requires a proactive approach to compliance that involves all levels of an organisation, she said.

“If no one understands how or when to use [the company’s systems], it’s not going to be effective,” Nutley explained. 

She elaborated a culture of compliance must be embedded at every level of the organisation, from entry-level employees to board members, with training to ensure staff know when to escalate a situation and how to critically assess whether it could be indicative of a more widespread, systemic issue.

Additionally, licensees must have processes in place to swiftly address remediation, she said.

“Having a system and trained staff that identifies breaches or reportable situations is great, but if you don’t do the right thing to fix the situation and remediate consumers, your systems can’t possibly be adequate. You’re falling down at the last hurdle,” Nutley remarked. 

Importantly, as licensees seek to comply with the regime, a crucial aspect remains – documentation of decisions made at every stage of the process.

“You want to be able to demonstrate to ASIC that those systems exist and that they are adhered to. 

“So, documenting decisions that have been made at key points in time, if you’ve considered an incident and determined it’s not a reportable situation, having a paper trail as to why you determined [that] – all those things help to demonstrate the sufficiency of what licensees are doing and I think that’s an important part of the process,” she said.

“Also, when you think about adequate training and critically analysing situations, being able to demonstrate you’ve turned your mind to whether something is a reportable situation or not, even if the conclusion is that it’s not, it shows ASIC that there is that greater focus and critical thinking going on.”

Reflecting on the recent review, she noted robust recordkeeping is unlikely to emerge presently in ASIC’s reports as the regulator is primarily focusing on disclosures around a reportable situation occurring. 

However, it will prove beneficial if ASIC is required to take a “deep dive” of a licensee.

“What we will no doubt see is instances where ASIC does that deeper dive in a coercive way, whether it issues notices or what have you, and through that they’ll be looking at the paper trail that lies behind a lack of reporting or reporting of one situation where perhaps there should’ve been more,” Nutley said.

“That kind of paper trail is a good defence for licensees to have to be able to demonstrate that they’ve been complying with their obligations, even if no report was ultimately made.” 

Money Management previously explored the regulator’s focus on proper recordkeeping in light of a recent Financial Services and Credit Panel (FSCP) order to suspend an adviser over insufficient documentation.

In particular, the panel issued a written order suspending adviser Ian James Reid as a relevant provider for three months in November over concerns he had contravened the Corporations Act.

According to the FSCP, Reid failed to comply with his obligations when providing advice to three clients, using records of advice (ROA) that relied on statements of advice (SOA), which had been given to the clients up to seven years ago.

Reflecting on the verdict, Joel Ronchi of compliance firm Fourth Line, described recordkeeping as “the mortar between the bricks” of the advice process.

“Recordkeeping and detailed file notes is absolutely paramount. It’s the mortar between the bricks, and if any issues come up, then it does usually come down to having a lack of evidence,” he told Money Management.