Compliance Case Management Software: 8 Checks

Most compliance case management software is not built for FCA conduct cases. It is built for legal matters, local-authority casework, or HR investigations, and it is sold into financial services on the basis that a case is a case. Sometimes that is true. Often it is not, and the gap only shows up when a supervisor asks for something the system cannot produce.

If your firm is looking at tooling to hold conduct and misconduct cases — particularly since the non-financial misconduct rules took effect on 1 September 2026 — these are the eight things worth checking before you commit. The honest headline first: for a firm with a handful of staff and no live cases, a well-structured spreadsheet and a shared drive is still a defensible answer, and the last section explains when it stops being one.

1. Does it retain records for six years, and can it prove it?

This is the check that eliminates the most products fastest. The FCA's guide for solo-regulated firms requires firms to "Retain records of disciplinary and fit and proper findings going back 6 years" — and on the disclosure side, to cover "the previous 6 years (unless it relates to serious misconduct, in which case there is no time limit)."

So the retention question has two parts, and vendors usually only answer the first:

Six years minimum for disciplinary and F&P findings.
No time limit at all for anything relating to serious misconduct.

A system with a fixed retention policy that purges at, say, five years — or one where retention is set globally rather than per record type — cannot express "six years for most things, indefinitely for serious misconduct". Ask specifically whether retention can differ by case outcome. If the answer is a general "we keep everything", ask what happens when you leave the product.

2. Can you get everything out, in a form that is still readable in six years?

Export is where a six-year retention obligation meets commercial reality. Your obligation runs for six years; a vendor's commercial life may not, and neither may your subscription.

What to test, ideally during a trial rather than at renewal:

Export of a complete case — not a summary row, but the narrative, the dated steps, the attachments and who did what.
A format you can open without the vendor. PDF and CSV are fine. A proprietary archive is not.
Whether attachments come with the export or stay behind.
Whether the export includes the audit trail, or only the current state of the record.

A system you cannot leave is a system that has quietly become part of your regulatory permissions.

3. Is the audit trail immutable, or just a change log?

There is a real difference between a system that records edits and a system where earlier versions cannot be altered. For a conduct case, the sequence — what was known on what date, and what the firm did next — is frequently the whole substance of the question.

Ask whether an administrator can edit or delete a historic entry, and whether doing so leaves a trace. "Admins can fix mistakes" is a reasonable product decision and a poor evidentiary one. The workable answer is usually correction-by-addition: the original entry stays, a correction is appended, and both are visible.

4. Does it handle the case where the subject is the principal?

At a firm of three to ten people, the person who would normally investigate is sometimes the person the allegation names. Every conduct process for a small firm has to answer this, and most software does not model it at all.

The concrete test: can a case be created that the firm's own administrator cannot read? If every account with admin rights can see every case, then the moment an allegation concerns the principal, the system stops being usable for that case — and that is precisely the case where the record matters most. Some firms solve this outside the tool by escalating to an external investigator; that is fine, but then you need somewhere for that case to live, and it should not be a personal inbox. Our guide on handling a harassment allegation covers the independence problem in more depth.

5. Does it separate the COCON question from the FIT question?

These are two assessments on different tests, and the FCA is explicit that "COCON and FIT operate separately." COCON asks whether a conduct rule was breached. FIT asks whether the person remains fit and proper, and the regulator confirms that "FIT allows firms to consider any relevant misconduct, wherever it occurs."

A system that models a case as a single record with one outcome field pushes you toward collapsing the two. What you want is a case that can conclude "no COCON breach" and still carry an F&P consideration forward into the annual assessment — because that combination is common and it is the one an assessor will probe. Our F&P assessment guide sets out how the two connect.

6. Does it produce the notifications you actually owe, on the right clocks?

Conduct rule breach reporting runs on more than one track. For an approved Senior Manager, the route is Form C or Form D, and the Handbook sets the clocks: Form D "as soon as practicable and, in any case, within seven business days" (SUP 10C.14.18R), and Form C "no later than ten business days" after an approved Senior Manager permanently stops performing the function (SUP 10C.14.5R). Most other conduct rules staff are reported on the annual REP008 return, but SUP 15.11.13R is "subject to SUP 15.11.12AR": a senior manager conduct rule (COCON 2.2) breach by senior conduct rules staff who are not approved Senior Managers, such as a non-SMF board director, is notified immediately instead (SUP 15.11.12BG(3)).

So a useful system knows the difference between those populations and can tell you which clock a given case is on. A system that treats every conclusion identically will not warn you that a Senior Manager finding has a seven-business-day fuse on it. Our conduct rule breach reporting guide covers which route applies to whom.

The same logic applies to references: a conduct rule breach finding is disclosable in a regulatory reference for that individual, and the system should make that connection visible rather than leaving it to memory. See our regulatory references guide.

7. Does it avoid collecting things you are not supposed to collect?

Some tooling marketed around the non-financial misconduct rules offers social-media monitoring or private-conduct screening. The FCA has said firms do not need to do this. Under "What firms do not need to do", the regulator lists "Monitor employees' private lives or social media accounts" and "Investigate allegations about employees' private lives if they are trivial, implausible or irrelevant", alongside the broader instruction not to "Do anything contrary to privacy, employment or other relevant law."

A feature you are not required to use is not automatically a problem. A feature that encourages you to build a surveillance record you have no regulatory basis for is — it creates data-protection exposure, employee-relations exposure, and nothing on the compliance side. Treat monitoring features as a reason to look harder, not as a selling point.

8. Can one person actually run it?

The buyer at a small FCA firm is usually the compliance function — one or two people who also do other things. The realistic test is not the demo; it is whether the person who will use it can open a case, record three steps and close it without referring to documentation, six weeks after training.

Signals that a product was built for a larger compliance team: mandatory workflow stages that cannot be skipped, role hierarchies you have to populate before anything works, configuration that assumes a separate administrator, and per-seat pricing with a minimum well above your headcount. None is disqualifying, but each is a cost that lands on the same person.

When a spreadsheet is still the right answer

It is worth saying plainly, because most content in this category has an incentive not to.

A spreadsheet plus a structured folder is adequate when: you have had no conduct cases, your headcount is small enough that everyone's role is obvious, the person maintaining it is the person who would investigate, and you have a backup that is not on one laptop.

It stops being adequate at fairly specific points:

The first live case involving the principal, because the file has to live somewhere the principal does not control.
The first time you cannot reconstruct a sequence — you know what was concluded but not on what date, or by whom.
Growth past the point where one person holds it all in their head, which in practice is somewhere around ten to fifteen staff.
A finding that has to survive six years and outlast whoever created it.

Until one of those lands, the money is usually better spent on the process than on the software. Our guide on SMCR compliance software for small firms takes the wider view of the same decision across the whole regime, rather than conduct cases specifically.

Summary

Retention: at least six years for disciplinary and F&P findings, and no time limit for serious misconduct — check retention can vary by case type.
Export: complete cases, attachments and audit trail, in a format that outlives the vendor.
Audit trail: correction by addition, not silent editing.
Independence: a case the firm's own administrator cannot read, for when the allegation names the principal.
Two assessments: COCON and FIT are separate tests and the system should not collapse them.
Notification clocks: Senior Manager findings carry a seven-business-day route on Form D (or Form C, no later than ten business days after the person stops performing the function); for other staff, a breach that leads to disciplinary action goes on the annual REP008 return, except a COCON 2.2 breach by non-SMF senior conduct rules staff, which is notified immediately.
Scope discipline: the FCA does not require private-life or social-media monitoring; features that invite it add risk, not compliance.
Usability: one person, six weeks later, without the manual.
And: a spreadsheet is a legitimate answer until a specific thing changes. Know which thing you are waiting for.

The NFM Investigation Checklist walks the investigation sequence a system would need to support, and the PS25/23 Readiness Pack contains the underlying templates — both are free and both work whether or not you buy anything.

Last reviewed: 7 October 2026. This guide sets out criteria for evaluating conduct case management tooling at a small FCA-regulated firm. It is general information, not regulatory, legal or procurement advice, and it does not describe a ConductLog product feature — ConductLog is validating demand for a tool that helps small FCA-regulated firms handle conduct and misconduct processes, and is not available to buy. For your firm's specific obligations, check the FCA Handbook and consider professional advice.