Under SM&CR, "reasonable steps" is the test in the duty of responsibility. If a firm breaches a regulatory requirement in an area a senior manager is responsible for managing, the FCA can act against them if they did not take the steps a person in their position could reasonably be expected to take to avoid it. The burden of proof is on the FCA.
What does "reasonable steps" mean under SM&CR?
The duty of responsibility is in section 66A(5) of the Financial Services and Markets Act 2000 (FSMA). The FCA's guidance on how it applies the duty is in DEPP 6.2.9 and covers senior managers in all types of firm.
Two features of the test matter most. First, the burden of proof is on the regulator: a senior manager does not have to show they took reasonable steps; the FCA has to show they did not. The Bank of England and Financial Services Act 2016 removed an earlier reversed burden.
Second, the benchmark. Under DEPP 6.2.9-D, the question is what a competent senior manager would have done at that time, in that individual's position, with their role and responsibilities, and in all the circumstances. The FCA has said it will not apply standards retrospectively or with hindsight.
The FCA describes its guidance as flexible rather than prescriptive: what is reasonable depends on the facts of each case, so no list of actions guarantees enough was done. What a senior manager can control is whether they can show what they knew at the time, what they did about it and why.
Where does the duty sit? Statements of Responsibilities and the Conduct Rules
The Statement of Responsibilities
The obvious place to see what a senior manager is responsible for is their Statement of Responsibilities, which must accompany every application for approval of a senior manager. Under SUP 10C.11 it should show how the manager's responsibilities fit the firm's overall governance, be consistent with other senior managers' statements and with the management responsibilities map where the firm must have one, and list any FCA-prescribed responsibilities allocated to them. The FCA has also said it will look beyond Statements of Responsibilities and organisational charts to how responsibilities were allocated in practice.
A vague statement makes reasonable steps harder to show, because it is unclear what the manager was meant to oversee. If one senior manager is responsible for advice quality, the statement should say so plainly. Which senior management functions a firm needs, including whether it needs a Compliance Oversight function (SMF16), depends on its category and permissions.
The Senior Manager Conduct Rules
Separately, the Senior Manager Conduct Rules in COCON 2 build reasonable steps into rules of their own. Three bear directly on oversight:
| Rule | What it says | For advice oversight |
|---|---|---|
| SC1 | "You must take reasonable steps to ensure that the business of the firm for which you are responsible is controlled effectively." | Controls over advice quality that match the risk of the business |
| SC2 | Take reasonable steps to ensure that the business you are responsible for complies with the relevant requirements and standards of the regulatory system. | Monitoring that tests advice against the requirements, not just activity |
| SC3 | "You must take reasonable steps to ensure that any delegation of your responsibilities is to an appropriate person and that you oversee the discharge of the delegated responsibility effectively." | QA delegated to people able to do it, and their work checked |
The FCA's guidance on SC1, in COCON 4.2, builds in proportionality. Where a business strategy takes a firm into high-risk areas, the degree of control and strength of monitoring reasonably required is high; smaller, less complex businesses need less detailed and extensive systems of control. Senior managers do not have to build the control systems themselves unless that is part of their role.
Conduct Rule 6 and the Consumer Duty
Individual Conduct Rule 6, "You must act to deliver good outcomes for retail customers", has applied since 31 July 2023 to conduct rules staff where their firm's activities fall within the Consumer Duty. COCON 2.4 spells it out: act in good faith, avoid causing foreseeable harm, and enable and support retail customers to pursue their financial objectives. It applies to conduct rules staff generally, including the advisers on your calls.
The duty of responsibility, SC1 to SC3 and Conduct Rule 6 are separate obligations with different tests, and it helps to keep them apart in policies and training. One expectation has gone: since 27 February 2025 the FCA has not expected firms to have a Consumer Duty board champion, though firms may keep the role, and the FCA has said it was never a prescribed responsibility under SM&CR.
What does the FCA look at when it judges reasonable steps?
DEPP 6.2.9-E lists considerations the FCA may take into account. The list is expressly non-exhaustive, and it is more useful to read it by theme than item by item:
| Theme | What the FCA considers | For advice oversight |
|---|---|---|
| Delegation | Whether responsibilities were delegated to an appropriate person with the necessary capacity, competence, knowledge, seniority and skill, and whether the delegation was overseen effectively | QA reviewers with the time and expertise for advice calls, whose reports are read and questioned |
| Reporting lines | Whether reporting lines were clear and worked in practice | A defined route for a failed call or vulnerability concern to reach the right person, and evidence that it did |
| Information and challenge | Whether the manager assessed and monitored governance, operational and risk-management arrangements, including by corroborating and challenging the information available and considering its wider implications | Asking how a compliance rate was produced and what it leaves out, and opening the calls behind it |
Delegating a task does not end the senior manager's part in it: SC3 and the DEPP guidance both ask whether delegation was overseen. Accepting a report without question is not corroborating and challenging it.
Do senior managers have to keep records of reasonable steps?
Not under the duty of responsibility itself. In PS18/16 the FCA said the duty puts no extra obligation on a senior manager to explain or justify the steps they took or did not take, or to keep records supporting them. It added that keeping records of relevant steps may be in the senior manager's own interests, in case questions come from the firm, its advisers, regulators or customers.
Records also suit the test: because the FCA asks what a competent senior manager would have done at the time, a note made then is worth more than a reconstruction made later. A practical reasonable-steps file might hold:
- The current Statement of Responsibilities, and when it last changed.
- The MI received, when, how it was produced and what it did not cover.
- Questions asked and challenge given, with the answers.
- Decisions and actions, each with an owner and a date.
- Follow-up on whether each action worked.
- Delegation: who does what on the senior manager's behalf, and how their work is checked.
Minutes, an action log and saved MI packs often cover most of this, provided they record challenge and decisions, not just that a report was received.
Why advice calls are evidence of oversight
For a telephone advice firm, the conversation is where much of the advice happens: objectives are explored, costs and risks explained, understanding checked and vulnerability spotted, or missed. File notes summarise those conversations; recordings show them. Which calls must be recorded depends on the activity (see our guide to FCA call recording rules), but where calls are recorded they are among the most direct information a senior manager can corroborate and challenge.
- Rules that reflect the requirements. MI helps only if it measures the requirements the senior manager is responsible for. "Interest roll-up and its effect on the estate explained" is a requirement; "call reviewed" is activity. See writing compliance rules an AI can check and our call QA scorecard template.
- Coverage you can state. The FCA prescribes no call coverage figure, but a small sample can miss a lot: a failure affecting one call in fifty has about a 60% chance of not appearing at all in a random sample of 25 calls. The maths of call QA sampling and the sample size calculator show the trade-offs. Either way, a written call-selection policy makes clear which calls are monitored, which are excluded and why.
- An input to certification. Where advisers are certified staff, the firm must assess at least once a year whether each is fit and proper, and issue a certificate valid for one year; the FCA does not pre-approve them. The assessment covers honesty, integrity and reputation; competence and capability, including relevant training and competence requirements; and financial soundness. Call QA results by adviser are a natural input to competence and capability, alongside other evidence.
How do you turn call monitoring into oversight evidence?
- Set escalation thresholds in advance. Decide which failed rules and vulnerability signals go to whom, and how quickly. A threshold written down before the event is easier to explain than a judgement made after it.
- Show challenge, not just receipt. Trace a headline compliance rate back to the calls and quoted passages behind it. Compare a sample of results with your own reviewers' judgement, and keep reviewer overrides alongside the original result.
- Close the loop. Find the root cause (script, training, process or an individual adviser), act, and re-measure the same indicator in later MI. Our guides to compliance MI your board will read, Consumer Duty board reports and outcomes monitoring cover the reporting side.
- Connect findings to conduct where warranted. A failed call rule is not automatically a Conduct Rule breach; many findings lead to coaching or a process change. Where one leads to disciplinary action for a Conduct Rule breach, it has reporting consequences.
Using AI review without diluting accountability
Software that reviews calls changes how information reaches the senior manager, not who is accountable. It makes sense to treat an AI tool, or an outsourced QA provider, in the spirit of SC3: understand what it does, check its work and record the checks. Look for a written explanation and quoted evidence behind every result; a confidence level, so uncertain results go to a person; human override with the original result kept in an audit trail; validation against your own reviewers; and a log of calls that were not assessed. Our guides to AI in financial services compliance and buying AI call monitoring software go further.
Conduct Rule breaches and REP008
Solo-regulated firms report disciplinary action taken for Conduct Rule breaches by staff other than senior managers once a year, through the REP008 return. For most firms the reporting period runs from 1 September to 31 August with a 31 October deadline, so where there is something to report for the year to 31 August 2026, the return is due by 31 October 2026. Limited permission consumer credit firms have a different deadline. Nil returns are no longer needed for reporting periods ending on or after 31 August 2025. Disciplinary action against a senior manager for a Conduct Rule breach is reported on Connect using Form D, or Form C if they have left the role, within 7 business days.
What changed in SM&CR in 2026?
In April 2026 the FCA published PS26/6, the first phase of its SM&CR review. Most changes took effect on 24 April 2026, with regulatory reporting and process changes from 10 July 2026 and some COCON changes from 1 September 2026. Among other things, PS26/6:
- removes overlapping certification functions, which the FCA and PRA expect to cut the number of certification roles by around 15%;
- gives firms more time to notify the FCA of changes to Statements of Responsibilities and management responsibilities maps;
- streamlines the annual fitness and propriety checks on certified staff.
The duty of responsibility itself is in legislation, section 66A(5) FSMA, rather than in FCA rules, but policies and training written before April 2026 are worth checking against the current Handbook.
A reasonable-steps checklist for advice oversight
For the senior manager responsible for advice quality, or for compliance oversight where the firm has that function:
- Your Statement of Responsibilities says plainly who oversees advice quality.
- Call rules are mapped to the requirements you are responsible for, and coverage is stated, with exclusions explained.
- Escalation thresholds and routes are written down in advance.
- Challenge is recorded: questions asked, calls opened, overrides reviewed.
- Every issue has a root cause, an owner, an action and a re-measurement.
- Delegated QA, human or automated, is checked, and the checks are recorded.
COSA can supply the call side of this record. A call-selection policy decides which finished calls are assessed and logs every exclusion with its reason. Each in-scope call is assessed against the firm's own rules, with a written explanation, quoted evidence and a confidence level behind every verdict. Reviewer overrides keep the original verdict for audit, compliance alerts email chosen recipients when a rule fails, and MI dashboards show the compliance rate, outcomes by call type and by adviser, and the most-failed rules. COSA supports, and does not replace, professional compliance review, and the senior manager remains accountable. See how COSA supports Consumer Duty and SM&CR oversight.
This article is general information, not legal or regulatory advice, and reflects the position at 13 October 2026. Which senior management and certification functions apply depends on your firm's category and permissions; always refer to the FCA Handbook.
