How do you test whether your compliance infrastructure actually works?
Knowing what effective compliance infrastructure should produce is one thing. Testing whether your own environment actually produces it is another.
After reviewing numerous licensees, we know that policies, registers, templates and procedures can all look adequate in isolation. The real question is whether your systems, controls, workflows, and governance arrangements produce consistent, traceable, and defensible outcomes when applied in practice.
That’s where testing matters.
Effective compliance infrastructure should be able to pass a small number of simple, repeatable tests. These tests do not assess whether documentation exists. They assess whether your compliance environment works under operational pressure, regulatory scrutiny and ordinary business conditions.
This article sets out five practical tests that AFSL holders, Responsible Managers, compliance teams and advice businesses can use to assess whether their compliance infrastructure is functioning as intended.
Key Insight: Compliance infrastructure is only effective if the same test produces the same evidence, outcome and escalation pathway each time.
How should you apply the tests?
These tests should be applied to real examples, not hypothetical scenarios.
Select recent matters from your business and test whether the process can be followed from start to finish; to confirm that the process is predictable, consistent and reliable.
Suitable examples include:
- an adviser file review;
- a breach assessment;
- a complaint classification;
- a fee consent issue;
- a client remediation decision;
- a wholesale client classification;
- an adviser supervision action;
- a product replacement recommendation;
- an incident escalation;
- a Responsible Manager reporting item.
The objective isn’t to prove that a document, policy or process exists. The objective is to determine whether the underlying process produces evidence, supports consistent judgment, and enables meaningful oversight.
For each test, you should ask three questions:
- Can we see what happened?
- Can we see why it happened?
- Would the same process produce the same result next time?
If the answer is no, the issue is not usually the absence of a policy. It is usually a weakness in workflow design, evidence capture, escalation, accountability or governance visibility.
Test 1: Can you trace a decision end-to-end?
Select a recent compliance decision and attempt to trace it from the initial trigger through to the final outcome.
You should be able to identify:
- what information was available;
- what obligation, risk or policy requirement was relevant;
- what judgement was applied;
- who made the decision;
- what action was taken;
- whether the decision was reviewed;
- where the supporting evidence is stored;
- whether the outcome was reported, escalated or closed.
This test is particularly useful for breach assessments, adviser file ratings, complaints, remediation decisions and high-risk advice approvals.
A decision passes the test if the evidence explains the outcome without requiring reconstruction. A reviewer should be able to understand what happened, why it happened and why the decision was reasonable at the time.
A decision fails the test if the outcome can only be explained by asking the person who made it.
That distinction matters. If your compliance position depends on memory, informal context or post-event explanation, your infrastructure is not producing defensible evidence. It may still be possible to explain the decision, but proving that the system worked will be harder.
Test 2: Do similar scenarios produce similar outcomes?
Apply the same scenario across different users, teams, advisers or time periods.
You should expect similar decisions where the underlying facts are similar. That does not mean every scenario must produce an identical result. Professional judgement still matters. But variation should be explainable by the facts, not by who handled the matter.
This test is especially important for:
- file review ratings;
- breach reportability decisions;
- complaint classifications;
- vulnerable client assessments;
- replacement product advice;
- wholesale client classification;
- high-risk advice approvals;
- adviser supervision outcomes.
The issue isn’t whether judgment is being exercised. The issue is whether judgment is being calibrated.
If one reviewer rates a file as acceptable and another rates it as high risk, the business needs to understand why. If one breach assessment is escalated and a similar matter is not, the business needs to be able to explain the difference. If one adviser receives supervision and another does not, the decision should be supported by evidence and criteria.
A scenario passes the test if similar facts produce similar outcomes, or if any difference is clearly explained by documented risk factors.
A scenario fails the test if outcomes vary because people interpret the same obligation, control or process differently.
Inconsistent outcomes are a warning sign. They indicate that the infrastructure is not enforcing a common standard. That can create regulatory, client, and governance risks.
Test 3: Are controls embedded in the workflow?
Review whether key controls are built into the way work is actually performed.
A control isn’t effective simply because it appears in a policy. It needs to be applied at the right point in the process, by the right person or system, with evidence that it operated.
You should be able to identify:
- where the control is triggered;
- what causes the control to apply;
- whether the control is mandatory or discretionary;
- whether it can be bypassed;
- who can bypass it;
- whether bypasses are visible;
- whether exceptions are reviewed;
- whether the control produces evidence.
This test is useful for fee consent processes, advice document approvals, product replacement steps, conflict declarations, AML/CTF checks, complaint escalations, breach assessments, and adviser supervision.
A control passes the test if it operates as part of the workflow and produces visible evidence. The user shouldn’t need to remember to manually apply the control. The system should prompt, require, block, record, escalate or report the relevant action.
A control fails the test if it depends on user behaviour, memory or informal discipline.
This is one of the most common weaknesses in compliance infrastructure. Many firms have controls that are theoretically sound but operationally fragile. They work when the right person remembers them. They fail when the business is busy, when staff change, when exceptions arise or when the process is performed under pressure.
An embedded control is stronger than an instructed control. A visible exception is stronger than an invisible workaround.
Test 4: Can you demonstrate monitoring and issue resolution?
Select a recent monitoring activity and follow it through to resolution.
You should be able to show:
- why the activity was selected;
- what risk or obligation it tested;
- what sample was reviewed;
- what methodology was used;
- what findings were recorded;
- how issues were rated;
- who was responsible for action;
- what due date applied;
- whether the issue was escalated;
- how remediation was completed;
- whether closure was validated;
- how the outcome was reported.
Monitoring is only useful if it leads to action. A file review, audit, assurance check or compliance review that identifies issues but does not track them through to resolution is incomplete.
A monitoring activity passes the test if findings are recorded, actions are assigned, completion is tracked and closure is evidenced. A monitoring activity fails the test if issues are noted but not owned, escalated or resolved.
This test often reveals whether compliance is operating as a feedback loop or a reporting exercise.
A functioning compliance infrastructure should connect monitoring, incidents, breaches, complaints, adviser supervision, training and governance reporting. If monitoring findings do not flow into issue management, trend analysis, remediation and Responsible Manager oversight, the system is not learning from its own evidence.
Test 5: Can you evidence governance and oversight?
Assess how governance operates in practice.
You should be able to demonstrate:
- who is accountable for key compliance functions;
- what information is reported to management, Responsible Managers or the board;
- whether reporting is regular and structured;
- whether reports include underlying data, not just summaries;
- whether risks, incidents and issues are visible;
- whether challenge or review is documented;
- whether actions are assigned and followed up;
- whether decisions are recorded;
- whether governance reporting connects to operational evidence.
This test isn’t satisfied by producing meeting minutes that say compliance was discussed. The question is whether the governance body had enough information to understand the issue, challenge the position and oversee the response.
A governance process passes the test if oversight is supported by evidence, structured reporting and documented challenge.
A governance process fails the test if the board, Responsible Managers or senior management receive summaries without the underlying evidence needed to test them.
This is a critical issue for Licensees. ASIC scrutiny often focuses less on whether a firm had a policy and more on whether the Licensee could demonstrate supervision, monitoring, escalation and oversight. Governance that relies on assurance without evidence is vulnerable.
What do the results tell you about the system?
The five tests are separate, but the results should be assessed together.
- A failure in one test often indicates a broader infrastructure issue.
- If you cannot trace decisions, you may have an evidence capture problem.
- If similar scenarios produce different outcomes, you may have a calibration or training problem.
- If controls depend on manual behaviour, you may have a workflow design problem.
- If monitoring does not lead to resolution, you may have an issue management problem.
- If governance reporting lacks evidence, you may have an oversight and accountability problem.
The practical value of the tests is that they help identify where the system is breaking down.
They shift the conversation away from whether documents exist and towards whether compliance is actually being enforced.
Compliance infrastructure self-assessment
Use the following scoring model to assess your environment.
For each test, score your business as follows:
- No = 0
- Partially = 1
- Yes = 2
Test 1: Decision traceability
Can you take a recent decision and trace the inputs, judgment, action, review and evidence without reconstruction?
Test 2: Outcome consistency
Do similar scenarios produce similar outcomes regardless of who performs the task?
Test 3: Embedded controls
Are controls triggered within workflows rather than relying primarily on manual intervention?
Test 4: Monitoring and resolution
Can you demonstrate how monitoring identifies issues and tracks them through to resolution?
Test 5: Governance and oversight
Can you prove oversight, review and challenge with supporting data, not just summaries?
How should you interpret the score?
0–4: Fragmented infrastructure
Your compliance environment is likely to be fragmented. Core processes may exist, but they’re not consistently producing evidence, escalation or defensible outcomes.
This doesn’t necessarily mean there’s been a breach. It does mean the business may struggle to demonstrate compliance under scrutiny.
Immediate priority should be given to workflow design, evidence capture, issue ownership and governance reporting.
5–7: Partially effective infrastructure
Your business has some functioning elements, but the system isn’t yet reliable across all scenarios.
This is a common position for growing advice businesses and Licensees. The risk is that compliance depends too heavily on experienced people, informal knowledge or manual intervention.
Priority should be given to consistency, calibration, control, embedding and integration between monitoring, issue management and governance.
8–10: Defensible infrastructure
Your infrastructure is likely to be functioning effectively, provided the results are supported by real evidence and not optimistic self-assessment.
The next step is to test whether performance is consistent across advisers, teams, products, advice types and time periods.
A high score should not lead to complacency. It should lead to periodic testing, exception review and continuous improvement.
What should you do if you fail one of the tests?
Failing one test does not mean the whole system is broken. But it does identify a risk that should be understood and prioritised.
The right response depends on the failure.
- If decisions cannot be traced, improve evidence capture and decision recording.
- If outcomes are inconsistent, improve calibration, guidance and review standards.
- If controls are manual, embed them into workflows and create exception visibility.
- If monitoring does not lead to resolution, strengthen issue ownership, due dates, escalation and closure validation.
- If governance lacks evidence, improve reporting packs, dashboards and Responsible Manager visibility.
The purpose of the tests is not to create another compliance burden. It is to identify the practical points where your infrastructure needs to become more reliable.
Can small Licensees use these tests?
Yes. The tests aren’t designed only for large institutions. They’re particularly useful for small and mid-sized Licensees because they focus on outcomes, evidence and repeatability rather than complexity.
A small Licensee does not need a large compliance department to apply these tests. But it does need to be able to demonstrate that key decisions are recorded, controls are applied, issues are resolved, and oversight is meaningful.
In many cases, smaller firms can apply the tests more quickly because their workflows are simpler. The challenge is often not scale. It is discipline, consistency and evidence.
Can your infrastructure pass the tests?
Effective compliance infrastructure is not defined by the number of policies, registers or reports a business maintains. It is defined by whether the business can produce consistent, traceable and defensible outcomes in practice.
If your system can trace decisions, apply controls, produce consistent outcomes, monitor activity, resolve issues and support governance with evidence, it is functioning effectively.
If it cannot, the weakness will usually become visible when the business is placed under pressure.
That pressure may come from ASIC scrutiny, an AFCA complaint, a breach review, a client remediation issue, an adviser conduct concern, a Responsible Manager review or an internal governance challenge.
The objective is to build a system that passes these tests without special effort. That is what makes compliance infrastructure reliable. It works because the process works, not because the right person remembers what to do.
How Assured Support can help
If your infrastructure fails one or more of these tests, the issue is not usually the absence of a policy. It is usually a gap in workflow design, evidence capture, escalation, issue management or governance visibility.
Assured Support helps Licensees, Responsible Managers and compliance teams assess whether their compliance infrastructure is operating effectively in practice. We help identify where the system breaks down, what evidence is missing and which changes should be prioritised.
If you want to test whether your compliance infrastructure is consistent, visible and defensible, talk with an expert.
Further reading
- How Do You Know If Your Compliance Infrastructure Actually Works?
- Why AFSL Licensees Are Adopting Compliance Infrastructure
- What Compliance Infrastructure Do You Actually Need?
- How to Design a Compliance Monitoring Program That Works
Frequently Asked Questions
The five tests assess whether you can trace decisions, produce consistent outcomes, embed controls, monitor and resolve issues, and demonstrate governance oversight with evidence.
Together, these tests show whether your compliance infrastructure works in practice. They focus on operational performance, not just whether policies or procedures exist.
Simple tests are useful because they reveal whether compliance processes operate consistently in real situations.
Complex frameworks can obscure practical weaknesses. A simple test, such as tracing a breach decision or reviewing whether similar files received similar ratings, quickly shows whether the system is producing reliable evidence and outcomes.
Tracing a decision end-to-end means being able to identify the trigger, the information considered, the judgment applied, the person responsible, the action taken, the review performed, and the evidence retained.
If the decision cannot be understood without asking someone to explain it after the event, the infrastructure is not producing sufficiently defensible evidence.
Outcome consistency means similar scenarios produce similar decisions unless there is a documented reason for different treatment.
This is especially important for file review ratings, breach assessments, complaint classifications, adviser supervision decisions and client remediation outcomes. Inconsistency may indicate weak guidance, poor calibration or excessive reliance on individual judgment.
Embedded controls are stronger because they operate within the workflow. They are triggered by the process rather than relying on a person to remember them.
Manual controls can work, but they are more vulnerable to pressure, staff turnover, inconsistent application and invisible workarounds. A well-designed control should either prevent an issue, prompt action, record an exception or escalate a risk.
You should apply the tests regularly and whenever there is a material change to your business, processes, advisers, systems, products or risk profile.
They are also useful before ASIC scrutiny, after a breach, in response to complaint trends, during Responsible Manager reviews, or when assessing whether compliance investment is producing practical results.
The tests help Responsible Managers assess whether they have sufficient visibility over the compliance environment.
Responsible Managers need more than summaries. They need evidence that controls are operating, issues are being escalated, and compliance risks are being managed. These tests help identify whether that evidence exists and whether it’s reliable.
