What Non-Executive Directors Need to Know About Compliance Monitoring

By Adrian Lawrence FCA, founder of NED Capital · Part of the Board Governance Hub

For a non-executive director on the board of a regulated firm, compliance monitoring is one of the most important sources of assurance there is — and one of the least well understood at board level. Monitoring is how a firm checks, systematically and continuously, that it is actually doing what its policies and the regulator’s rules require. It is the evidence base that lets a board say, with some confidence, that the firm is being run properly. Yet many non-executives receive monitoring reports without quite knowing what they are looking at, what good monitoring looks like, or what they should be challenging. That is a gap worth closing, because when something goes wrong in a regulated firm, the question asked of the board is almost always whether it had adequate oversight — and monitoring is a large part of the answer.

This guide explains compliance monitoring from the board’s point of view: what it is, why it matters to a non-executive, what good monitoring reporting looks like, and the questions a NED should be asking. It is written for board members of FCA-regulated firms and those advising them, and it draws on the governance work of NED Capital and the regulatory-recruitment expertise of our sister practice. Every NED Capital search is led personally by Adrian Lawrence FCA.

What Compliance Monitoring Is

Compliance monitoring is the planned, continuous programme by which a firm’s compliance function tests whether the business is complying with its own policies and with the regulator’s rules. It is not the same as giving compliance advice, and it is not a one-off review: it is an ongoing cycle of testing, sampling and reporting that runs throughout the year. The Financial Conduct Authority expects regulated firms to have a monitoring programme that is proportionate to their size and risk, and the obligation sits within the wider systems-and-controls requirements that every authorised firm must meet. The important point for a non-executive is that monitoring is the mechanism that turns a firm’s policies from paper into practice — it is how anyone knows whether the controls the board has approved are actually working. A firm can have excellent policies and still be non-compliant in practice; monitoring is what reveals the difference. Our sister practice sets this out in full in its guide to compliance monitoring for FCA-regulated firms, which explains how the function is built and run; this article looks at it from the board’s side of the table.

Why It Matters to a Non-Executive Director

A non-executive director cannot personally inspect every transaction, sales call or client file. What a NED can do is satisfy themselves that there is a robust system in place to check those things and surface problems — and that system is compliance monitoring. For the board, monitoring is the independent evidence that the firm is doing what it says it does. It is what allows a non-executive to form an informed view rather than simply trusting management’s assurances, which is exactly the role an independent director exists to play. In a regulated firm, the board carries ultimate responsibility for the firm’s conduct and for the adequacy of its systems and controls, and the regulator holds senior managers personally accountable under the Senior Managers & Certification Regime. A non-executive who understands and engages with monitoring is discharging that responsibility; one who receives the reports without reading them critically is not. Monitoring, in other words, is not a compliance-team concern that the board merely notes — it is one of the board’s primary tools for doing its job.

Where Monitoring Sits: The Three Lines of Defence

To read monitoring well, a non-executive needs to understand where it sits in the firm’s wider control framework, usually described as the three lines of defence. The first line is the business itself — the people doing the work, who own and manage the risks day to day. The second line is the compliance and risk functions, which set the framework, advise the business and, crucially, monitor whether the first line is doing what it should. The third line is internal audit, which independently assesses whether the first and second lines are working. Compliance monitoring is a second-line activity: it is the compliance function testing the business. For the board, the value of the model is that it shows where assurance is coming from and whether it is genuinely independent. A common weakness is a firm where the second line is under-resourced or too close to the business to challenge it, so that monitoring becomes a formality. A non-executive should understand this structure well enough to ask whether each line is real and effective, rather than assuming it is. We explore the model in depth in our non-executive’s guide to the three lines of defence.

What Good Monitoring Reporting Looks Like

Most of a non-executive’s engagement with monitoring comes through what the board sees — the monitoring plan at the start of the year and the reports through it. Good reporting has recognisable features. It is risk-based, meaning it concentrates effort where the firm’s risks are greatest rather than checking everything equally. It is clear about what was tested, how, and what was found, rather than offering bland reassurance. It rates and tracks findings, so the board can see not only what went wrong but whether previous issues were actually fixed. And it is honest: a monitoring report that never finds anything is a warning sign, not a comfort, because it usually means the programme is testing the wrong things or not testing hard enough. A non-executive should expect the monitoring plan to be presented to and challenged by the board at the outset, and should expect findings to come to the board or its audit or risk committee through the year with enough substance to act on. Our sister practice’s guide to what the board should expect from its compliance monitoring plan is a useful companion on exactly this point.

Consumer Duty and the Shift to Outcomes

One of the most significant recent developments in this area is the Consumer Duty, which has changed what monitoring is expected to demonstrate. Where monitoring once focused heavily on whether processes were followed, the Duty requires firms to evidence that customers are actually receiving good outcomes — and it places specific responsibility on the board to assess and challenge those outcomes, including through an annual board report. For a non-executive, this raises the stakes of monitoring considerably: it is no longer enough to see that a process was followed if the outcome for the customer was poor. A board now needs monitoring that tests outcomes, not just procedures, and a non-executive should be asking whether the firm’s monitoring has genuinely made that shift. This is a live area of regulatory focus and one where boards are increasingly judged. Our guidance on how NEDs should oversee Consumer Duty goes into the board’s role in detail, and the SMF Capital note on where Consumer Duty accountability actually sits explains how the responsibility maps onto senior-manager roles.

The Questions a NED Should Ask

A non-executive does not need to be a compliance specialist to engage effectively with monitoring; they need to ask the right questions. Is the monitoring programme genuinely risk-based, and does it reflect the firm’s actual risks rather than last year’s template. Is the compliance function adequately resourced to deliver it, or is monitoring being squeezed. Are findings being tracked to resolution, or do the same issues recur. Does the monitoring test customer outcomes under the Consumer Duty, not just process compliance. What has the programme chosen not to look at this year, and why. Is the person responsible for compliance — the SMF16 in most firms — of the right calibre and genuinely independent of the business they monitor. And, pointedly, when was the last time monitoring found something serious, because a programme that never does is not reassuring. Asking these questions, and expecting real answers, is how a non-executive turns monitoring from a report they receive into assurance they can rely on. Where a firm’s monitoring is weak because the compliance function itself is under-strength, the answer is often the right senior hire, which is where our sister practice’s work on compliance officer recruitment and fractional and interim SMF cover comes in.

Frequently Asked Questions

Is compliance monitoring the board’s responsibility or the compliance team’s?

Both, in different ways. The compliance function runs the monitoring programme, but the board is responsible for ensuring the firm has adequate systems and controls and for challenging what monitoring finds. For a non-executive, monitoring is a primary source of the independent assurance the board relies on.

What does a non-executive actually see of monitoring?

Usually the monitoring plan at the start of the year and the monitoring reports through it, often via the audit or risk committee. A NED should expect to challenge the plan, and to receive findings with enough substance — what was tested, what was found, and whether issues were fixed — to act on.

Why is a monitoring report that finds nothing a concern?

Because it usually means the programme is testing the wrong things, or not testing hard enough, rather than that the firm is perfectly compliant. A well-designed, risk-based programme should surface issues; a consistently clean report should prompt a non-executive to ask why.

How has Consumer Duty changed monitoring?

It has shifted the emphasis from whether processes were followed to whether customers received good outcomes, and it places specific responsibility on the board to assess and challenge those outcomes. Boards now need monitoring that tests outcomes, not just procedures.

NED Capital | Sister practice of FD Capital and SMF Capital | ICAEW practising certificate held by Adrian Lawrence FCA.