Evidencing Reasonable Steps Under SM&CR: A Practical Framework for Senior Managers

When the FCA investigates a regulatory breach, "I didn't know" isn't a defense for a Senior Management Function (SMF) holder. Relying on a static compliance manual from three years ago won't prove you took reasonable steps to prevent the failure. In the current regulatory environment, the burden of proof is on the regulator to show a manager failed to act, but the practical reality is that without a robust trail of evidence, an individual remains exposed to career-ending penalties.

Senior managers are making decisions every hour that impact the regulatory health of their firm. They allocate resources, assess staff competence, and review management information. Each of these actions constitutes a "step." The challenge lies in how these steps are recorded, structured, and presented when a supervisor asks for a justification of your oversight.

Translate the Statement of Responsibilities into Daily Operational Controls

A Statement of Responsibilities (SoR) is frequently treated as a bureaucratic necessity rather than an operational manual. This is a mistake. The SoR should serve as the blueprint for your daily control environment. If your SoR states you are responsible for AML oversight, but you cannot point to a specific weekly or monthly control that verifies the efficacy of that oversight, a gap exists. The FCA expects you to bridge the distance between the high-level legal document and the granular tasks performed by your team.

To address this, you must map every responsibility in your SoR to a specific, measurable task. This process identifies areas where you might have assumed oversight was happening but lacked formal reporting. It also clarifies who is actually doing the work. In mid-sized firms, responsibilities often bleed into one another, creating a risk that no one is truly accountable. By mapping these, you ensure that operational delivery matches regulatory expectations.

Using a structured framework such as the SMCR Responsibilities Mapping Playbook provides a defensible audit trail. This tool, which carries a standalone retail value of £299 but is included in Silver and Gold retainer tiers, helps senior managers document exactly how they maintain oversight. It moves the conversation from "I think we are doing this" to "Here is the process that proves we are doing this."

Consistency is the hallmark of a reasonable manager. Mapping shouldn't be a one-time exercise at the start of the year. As your firm scales or shifts its product focus, your controls must evolve. If your SoR remains unchanged while your business model pivots, the FCA will view your oversight as disconnected from the actual risks of the firm. You need a live document that reflects the current state of play.

Establish a Continuous, Evidenced Feedback Loop

The era of the annual compliance review is over. A point-in-time check is insufficient for modern financial services, particularly in the fintech space where transaction volumes and risks shift in real-time. Senior managers must shift toward active, continuous monitoring. If you only look at your compliance status once a year, you are flying blind for 364 days. You can find more detail on this shift in our analysis of the complete guide to continuous compliance.

Effective oversight requires high-quality Management Information (MI). However, many senior managers suffer from data overload. Receiving a 100-page report every month is not evidence of oversight if you cannot demonstrate that you identified specific red flags within that data. You need to move away from vanity metrics and toward early warning signs. This might include tracking spikes in customer complaints, sudden changes in transaction patterns, or delays in employee training completion.

Implementing a system like the Compliance Monitoring Programme Builder allows managers to create a framework that surfaces risks proactively. This approach mitigates the "audit fatigue" that often plagues compliance departments. Instead of a frantic scramble before an FCA visit, you maintain a steady pulse of evidence. This proves to the regulator that you aren't just reacting to problems—you are actively looking for them.

Your feedback loop should also include qualitative data. Talk to the people on the front lines. Document your interactions with department heads. If an issue is raised in a casual meeting, it should be formalized and tracked. A reasonable manager is one who is inquisitive. The FCA values evidence that a manager sought out information rather than simply waiting for it to be presented at a board meeting.

Document the "Challenge" in Decision-Making Processes

One of the most frequent findings in FCA enforcement actions is a lack of evidence regarding challenge. Approval signatures on a document are not enough to prove reasonable steps. The regulator wants to see that you didn't just rubber-stamp a proposal. They look for evidence that you asked difficult questions, pushed back on assumptions, and considered the risks to customers before proceeding.

Board and committee minutes are the primary evidence of this challenge. Many firms record only the final decision, omitting the debate that led to it. This is a missed opportunity to build your defense. Minutes should accurately record who participated in the discussion, what specific risks were identified, and how those risks were mitigated or accepted. If you disagreed with a decision, ensure your dissent is documented along with your reasons.

For Gold tier clients, we provide assistance in drafting quarterly board compliance reports that specifically highlight these areas of pushback and risk evaluation. This ensures that the governance record reflects the reality of the decision-making process. When the regulator reviews these minutes two years later, they should see a narrative of active engagement, not a series of passive approvals.

This culture of challenge must extend down through the organization. Senior managers should encourage their teams to flag potential issues early. If a product launch is delayed because a manager raised a compliance concern, that delay is a powerful piece of evidence. It shows that the firm prioritizes regulatory integrity over short-term commercial speed. Document these instances; they are your strongest proof of taking reasonable steps.

Govern the Delegation Process, Not Just the Task

A common misconception among senior managers is that once a task is delegated, the regulatory burden moves with it. This is incorrect. Under SM&CR, you can delegate the performance of a task, but you cannot delegate the responsibility for its outcome. You remain accountable for the actions of those to whom you have assigned work, whether they are internal staff or third-party providers.

Reasonable steps in delegation involve three phases: selection, training, and oversight. First, you must evidence why you chose a specific person or firm to handle the task. What were their qualifications? How did you verify their competence? If you are using Appointed Representatives (ARs) or complex supply chains, this oversight must be even more rigorous. Tools like the AR Oversight Policy & Playbook or the Third-Party Oversight Toolkit are designed specifically to structure this level of governance.

Once delegated, you must prove ongoing supervision. This doesn't mean micromanaging every action, but it does mean having a clear reporting line and regular check-ins. If a third-party provider fails to meet their obligations, the FCA will ask what steps you took to monitor their performance before the failure occurred. Did you review their reports? Did you conduct periodic audits? If the answer is no, your delegation will be viewed as an abdication of responsibility.

Finally, ensure that those with delegated authority have the resources and training they need. If you delegate a complex regulatory task to a junior staff member without providing proper support, you have not taken reasonable steps. Document the training and guidance you provided. Our SM&CR Personal Liability Guide highlights why this training is often the only real defense a manager has during an investigation.

Demonstrate a Top-Down Compliance Culture

The FCA's focus on culture is not an abstract concept; it is a measurable expectation of leadership. Senior managers are expected to set the tone from the top. This means moving beyond high-level mission statements and demonstrating compliance in everyday actions. If you ignore a compliance rule because it is inconvenient, your team will follow your lead. This creates a systemic risk for which you will be held accountable.

Evidencing culture involves documenting your active participation in the compliance life of the firm. Do you attend and lead compliance workshops? Do you visibly support policies? Are you involved in the annual compliance team training sessions? For Gold tier firms, these two-hour sessions are a critical opportunity for senior managers to show they are invested in the team's development. Documenting your attendance and the topics covered creates a record of leadership engagement.

Another aspect of culture is how you handle breaches. A reasonable manager fosters an environment where staff feel safe reporting mistakes. If a breach is discovered, the response should be focused on remediation and learning, not just punishment. The steps you take after a breach—how you investigate, how you report it to the regulator, and how you change processes to prevent a recurrence—are all part of your evidence trail.

Culture is also reflected in how you balance commercial goals with regulatory requirements. When there is a conflict between profit and compliance, which one wins? If you can point to instances where you chose the compliant path despite a commercial cost, you have provided the FCA with the ultimate proof of your commitment. This is the difference between a firm that views compliance as a hurdle and one that views it as a foundation for sustainable growth.

A Practical Approach to SM&CR Governance

Building a defensible SM&CR framework does not require a bloated internal compliance department. In fact, many mid-sized firms find that the more people they add to the compliance team, the more the lines of accountability become blurred. We have found that the most effective models often involve external expertise to provide an objective perspective and specialized tools.

Our analysis shows that a comprehensive Gold retainer with Compliance Consultant costs less than 17% of employing a dedicated compliance manager on a £60,000 base salary. This model eliminates the single-point-of-failure risk and provides on-demand access to a panel of experts. We focus on driving process and organization change early, in parallel with infrastructure development. This is our "engage, execute, embed" methodology.

By taking these steps, you protect yourself and your firm. Regulatory exposure is not an inevitability; it is a risk that can be managed through disciplined documentation and active leadership. Don't wait for a supervisory visit to realize your evidence is lacking. Take the steps today to ensure that your oversight is as robust as the regulations require.