Regulators Examine Records, Not Intentions
A firm with a well-drafted compliance manual, a competent compliance officer, and a genuine culture of doing things properly can still come out of an examination badly. The deficiency letter rarely says the firm behaved improperly. More often it says the firm could not demonstrate that it behaved properly, which is a separate finding with the same consequences.
That distinction sits at the center of most examination outcomes, and it is where the gap between having a compliance program and being able to evidence one becomes expensive.
The Standard Is Demonstrability
Regulatory examinations are document-driven exercises. Examiners arrive with a request list, review what is produced, conduct interviews, and test whether the records support what the policies describe. Their assessment is built almost entirely from artifacts.
This means the operative question during an examination is not whether a control functioned. It is whether the firm can produce contemporaneous evidence that it functioned, on the dates in question, applied consistently, with exceptions identified and addressed.
A control that worked flawlessly but generated no record is indistinguishable, from the examiner’s position, from a control that was never performed. The firm knows the difference. The file does not show it.
Written Policy Is the Starting Point, Not the Deliverable
Compliance manuals tend to receive disproportionate attention because they are the most visible artifact and the easiest to improve. A firm concerned about its program frequently responds by revising the manual, expanding coverage, and tightening language.
Examiners read the manual, but they read it as a set of commitments to be tested against. A more detailed policy describes more procedures the firm has undertaken to perform, each of which becomes something the firm must now evidence. Expanding a manual without expanding the recordkeeping behind it increases exposure rather than reducing it, since it widens the surface where documentation can fall short of what was promised.
The Annual Review Compresses a Year Into a Week
Many firms concentrate compliance testing into a single annual exercise. The review is conducted, findings are documented, remediation is assigned, and the file closes until the following year.
The structural problem is that examiners assess whether a program operated throughout a period, not whether it was assessed once at the end. A control tested in November produces evidence about November. It says comparatively little about March.
Testing distributed across a year produces a different record. Quarterly or monthly sampling generates a series of dated artifacts showing that oversight was continuous, that issues were identified as they arose, and that remediation followed within a reasonable interval. That series is difficult to reconstruct after the fact, because contemporaneous documentation is contemporaneous or it is nothing.
Where Records Usually Fail
Documentation gaps cluster in predictable places, and they tend to involve activities performed correctly but informally.
Approvals granted verbally or in passing conversation leave no record of who approved what, on what basis, or when. Exceptions handled sensibly by an experienced person frequently go undocumented precisely because the resolution seemed obvious at the time. Reviews conducted by someone reading through material carefully produce no artifact unless the reviewer records what was examined and what was concluded.
Assessments conducted by an ACA compliance firm or comparable external reviewer commonly surface these gaps first, since an outside party evaluating the file has access only to what the file contains, which is the same position an examiner occupies.
Personnel turnover converts these gaps into permanent ones. The knowledge held by the person who performed an undocumented review leaves when they do, and there is nothing in the record for a successor to rely on.
Attestation Is Not Testing
Programs frequently rely on periodic certifications in which employees confirm they have complied with applicable policies. These are useful and, in several contexts, required.
They are not evidence that the underlying conduct occurred as certified. An attestation records that someone asserted compliance. Independent testing records that someone verified it. Examiners distinguish sharply between the two, and a program resting primarily on self-certification tends to be characterized as lacking independent verification regardless of how conscientiously the certifications were completed.
The distinction matters most in exactly the areas where attestation is most convenient, including personal trading, outside business activities, and gifts and entertainment.
Third-Party Arrangements Do Not Transfer the Obligation
Firms delegate substantial operational functions to service providers, and the compliance responsibility for those functions generally does not travel with the delegation.
This creates an oversight requirement with its own evidentiary demands. Initial due diligence must be documented. Ongoing monitoring must be performed and recorded. Contractual provisions addressing compliance obligations must exist and be enforced.
The practical difficulty is that a firm’s ability to evidence third-party oversight depends on information the third party controls. Where a service provider does not supply reporting adequate to support monitoring, the firm is left evidencing an oversight process against thin inputs. Establishing those information requirements during contracting is considerably easier than negotiating them afterward, when the vendor has no particular incentive to expand its reporting.
Reconstruction After the Fact Is Visible
When a document request arrives and the underlying record does not exist, the instinct is to assemble something. Memoranda are drafted describing what occurred. Approvals are confirmed retrospectively.
Reconstruction is generally detectable, through metadata, through inconsistency with surrounding records, or through interviews that diverge from the documents. The consequences of producing reconstructed material as though it were contemporaneous extend well beyond the original deficiency, moving the matter from a recordkeeping finding toward questions about the firm’s candor.
Identifying a gap and stating plainly that the record does not exist is a narrower problem than any attempt to close it retroactively.
What a Testable Program Looks Like
The design question is whether each committed control generates an artifact as a byproduct of being performed, rather than requiring a separate documentation step that competes with other work.
Controls embedded in systems generate logs automatically. Reviews conducted within a workflow record who completed them and when. Approvals routed through a defined channel produce a record without anyone remembering to create one. Controls that depend on someone writing a memo afterward produce documentation inconsistently, because the memo is always the step that yields under time pressure.
The useful test is straightforward: for each control the program commits to, identify what evidence its performance would leave behind, and confirm that evidence is retained where it can be retrieved. Controls that fail that test are performed on trust, which functions adequately until the moment someone external asks for proof.
