The Recordkeeping Gap After a Staff Departure
A small advisory firm's senior compliance officer left abruptly. You are brought in as a consultant and find: client identification records for 14 of 60 clients are missing or incomplete (no verified address or ID copy); suitability questionnaires for 9 clients are undated or unsigned; several emails discussing a client's source of funds were deleted when the officer's account was closed; and the firm's transaction log for the past year is a spreadsheet maintained by one administrator with no backup. The firm is subject to rules requiring client identification records to be kept for at least five years after the relationship ends, and records of orders and communications to be retained. The principal says 'we're small, we know our clients personally, and the regulator has never asked.' A regulatory examination is expected within four months.
1. Prioritize the remediation steps and justify the order.
Read the worked answer
Prioritize by legal exposure and irreversibility. First, preserve what exists: stop any further deletion, recover the former officer's emails if possible from backups or archives, and secure the transaction spreadsheet with immediate backups. Second, remediate the missing client identification for the 14 clients, since these are mandatory records and gaps cannot be backfilled later without client cooperation; begin outreach and document efforts. Third, obtain or reconstruct signed and dated suitability records for the 9 clients, acknowledging in the file where records are missing rather than fabricating. Fourth, establish a retention schedule and access controls so records survive staff changes. The 'we know our clients' argument fails because the obligation is documentary, not personal knowledge, and deleted communications may already be a breach that must be disclosed honestly to the regulator.
2. How should the firm handle the already-deleted emails and the missing records in its dealings with the regulator?
Read the worked answer
Honestly and proactively. Do not reconstruct or recreate deleted emails; that would be fabrication. Document what was deleted, when, by whom, and what recovery was attempted. Prepare a remediation plan that identifies the gaps, the steps taken, and the timeline, and disclose the situation accurately if the regulator asks or as required. Concealment or false assurance would compound the problem. The firm should also assess whether the deletions resulted from a process failure (account closure without archival) and fix that process. Candor plus a credible remediation plan is a stronger position than a clean-looking file built on misrepresentation.