NFM Investigation Checklist

Record the date and time the allegation was received

Start the audit trail from the moment the report arrives. Delays in logging weaken your record.

Note who made the report (or record as anonymous)

The reporter may be the victim, a witness, or a manager. Record their relationship to the individuals involved.

Document the nature of the allegation

Categorise: bullying, harassment, sexual misconduct, discrimination, violence, or other. Be specific about what behaviour is alleged.

Identify individuals involved (accused, complainant, witnesses)

Record names, roles, and SMCR status (SMF holder, certification function, conduct rules staff). This affects reporting requirements.

Record when and where the alleged misconduct occurred

Establish the timeline and whether there is a sufficient workplace connection (office, work event, work communications, between colleagues).

Check for conflicts of interest in handling the investigation

The investigator should not be directly involved in the allegation, line-manage the accused, or have a personal relationship with either party.

Assess whether the allegation meets the seriousness threshold

PS25/23 covers serious non-financial misconduct. Trivial workplace disagreements or personality clashes are excluded. Bullying, harassment, discrimination, sexual misconduct, and violence are in scope.

Confirm sufficient workplace connection

The misconduct must have a work nexus: at the office, at work events, in work communications (including WhatsApp), during business travel, or between colleagues regardless of location.

Identify potentially relevant conduct rules

Which COCON rules could be breached? Typically Rule 1 (integrity) and/or Rule 2 (skill, care, diligence). For senior managers: SC1 (effective control) or SC2 (regulatory compliance). Use our COCON Self-Assessment tool for guidance.

Consider interim measures

Assess whether any immediate action is needed to protect the complainant, other staff, or the integrity of the investigation (e.g., separation of parties, adjusted reporting lines).

Notify the senior manager with oversight responsibility

The SMF holder responsible for conduct and compliance must be informed. Under SC1 and SC2, they are accountable for the investigation process.

Create an investigation plan

Outline: who to interview, what documents to collect, expected timeline, who is conducting the investigation.

Interview the complainant

Record their account in detail. Ask for specific dates, witnesses, and any documentary evidence they can provide. Offer a written summary for them to review.

Interview the accused

Give them the opportunity to respond to the specific allegation. Do not share the complainant's identity if the report was confidential. Record their response.

Interview witnesses

Speak to anyone identified by the complainant, the accused, or discovered during the investigation. Record each interview.

Collect documentary evidence

Emails, messages (including WhatsApp, Teams, Slack), HR records, previous complaints, performance reviews. Preserve originals.

Build a timeline of events

Map out what allegedly happened, when, and the evidence supporting each event. Identify gaps and contradictions.

Keep a running investigation log

Record every step taken, every interview conducted, every document reviewed, and when. This is your audit trail.

Document your factual findings

What happened? On balance of probability (not beyond reasonable doubt), what does the evidence support?

Map findings to specific conduct rules

For each finding, identify which rule was breached: Rule 1 (integrity), Rule 2 (skill, care, diligence), SC1 (effective control), SC2 (regulatory compliance), etc. Be specific.

Assess whether the breach was deliberate

Deliberate misconduct is more serious than negligent conduct. Record your assessment and reasoning.

Assess the harm caused

Physical harm, psychological harm, impact on the complainant's career, impact on other staff, impact on firm culture.

Check whether this is part of a pattern

Review any previous complaints or concerns about the accused. A pattern of behaviour is more serious than an isolated incident.

Determine whether an F&P assessment is required

If a conduct rule breach is found involving serious misconduct, an F&P assessment is required under FIT 2.2. This is mandatory, not optional.

Assess against FIT 2.2 criteria

Consider: honesty, integrity, and reputation; competence and capability; financial soundness. NFM primarily engages the honesty, integrity, and reputation limb.

Determine the F&P outcome

Does the finding mean the individual is no longer fit and proper? This may affect their certification, their SMF approval, or require FCA notification.

Document the F&P assessment and reasoning

Record the factors considered, the evidence reviewed, and the conclusion reached. This must be audit-ready.

Compile the investigation report

Bring together: allegation details, investigation steps, evidence summary, factual findings, COCON assessment, F&P determination, and recommended actions.

Communicate the outcome to relevant parties

Inform the complainant and the accused of the outcome. Follow your firm's disciplinary procedure for any sanctions.

Report to the FCA if a conduct rule breach is confirmed

Non-SMF breaches: include in annual REP008 filing. SMF breaches: notify the FCA within 7 business days of concluding disciplinary action.

Update certification records if F&P status changed

If the individual holds a certification function and the F&P assessment outcome has changed, update their certification status.

Identify lessons learned and update processes

Did the investigation reveal gaps in your firm's policies, training, or culture? Address them to prevent recurrence.

Store the investigation file securely

Maintain the full investigation record for at least the period required by your data retention policy. The FCA may request it during supervisory visits.