TL;DR: An FCA file review tests whether every statement in a suitability report traces back to a source document on the client file. The baseline evidence structure reviewers check first includes client demands and needs, risk tolerance, capacity for loss, and the explanation of why the recommendation is suitable. Emma generates suitability reports using inputs from meeting notes, fact-finds, LOA pack summaries, ceding information, cashflow modelling outputs, and risk profile assessments, working from your firm's own templates and citing every statement back to its source document automatically. This converts a manual audit-trail build into a review-and-approve step. Request a demo to see how the full AdvisoryAI workflow works with your firm's templates and processes.

An FCA file review does not ask whether your suitability report is well written. It asks whether every statement in it can be traced back to a source document on the client file. Source traceability is the specific, testable standard an FCA reviewer applies, not a vague documentation aspiration. This piece explains what reviewers actually check, how to build a file where each claim cites its source, and how Emma automates that citation work so the audit trail is produced as a by-product of report generation rather than a separate manual task. The evidence requirements are clear. The operational burden of meeting them manually is not sustainable.

What Source Traceability Means in FCA File Reviews

Source traceability means every material claim in a suitability report links back to a specific source document on the client file. A reviewer tests the chain: they locate the source, verify it supports the claim, and confirm it dates from the advice process. The reviewer checks three things for each claim:

1. Does the evidence exist? The source document must be on the file, not referenced generically or reconstructed after the fact.

2. Is it consistent with the claim? The source must actually support what the report says, not just relate to the same topic.

3. Is it accessible? The reviewer must be able to locate the source without searching the entire file. Critical fact-find data buried in lengthy documents without clear cross-references fails this test even when the underlying evidence exists.

This is not a quality assessment of the report's prose. It is a traceability test of the evidence chain behind it.

What Counts as Valid Evidence in File Reviews

Valid evidence for FCA file review purposes includes fact-find data, meeting notes, risk profile responses, and provider documents. Each type serves a specific function in the evidence chain.

• Fact-find data captures the client's financial situation, objectives, knowledge and experience, and capacity for loss. COBS 9.2.2 requires firms to obtain this information before making a recommendation.

• Meeting notes provide contemporaneous evidence of the client's stated objectives, concerns, and rationale. They are particularly valuable when they capture the client's own words rather than a paraphrase.

• Risk profile responses document attitude to risk separately from capacity for loss. The FCA expects both to be evidenced, not conflated.

• Provider documents support product claims: charges, performance history, fund factsheet data, and product features. Reviewers expect the source to be the provider document itself, not a summary prepared by the adviser.

Identifying Weak Points in File Evidence

The most common weak points in suitability report evidence are missing fact-find fields, meeting notes that do not capture rationale, risk profile responses that do not match the recommendation, and provider data that is not cited.

Missing fact-find fields are a frequent trigger. Health status, partner financial details, and foreseeable life changes are often left blank, and the FCA regards incomplete fact-finds as a breach of COBS 9 because the firm cannot demonstrate that suitable advice was given. Inadequate information on file is a recurring cause of unclear suitability determinations in FCA reviews.

Meeting notes that do not capture rationale create gaps. A note that records what was discussed but not why the client made a particular choice leaves the reviewer unable to test whether the recommendation aligns with the client's actual objectives.

Risk profile responses that do not match the recommendation are a red flag. If the ATR output indicates cautious risk tolerance but the recommendation assumes moderate growth, the file must explain the departure and evidence the client's informed consent.

Provider data that is not cited is a common failure. A report that states "the recommended fund has lower charges than the existing arrangement" must reference the specific provider documents that support that claim, not leave the reviewer to guess which documents were compared.

Each of these weak points maps to the four-point data alignment: client objectives, risk tolerance, capacity for loss, and the rationale for why the recommendation is suitable. Gaps in any one of these four points are the most common trigger for file audit failure.

COBS 9 Evidence Requirements for Suitability Reports

COBS 9 requires firms to recommend investment services and financial instruments that are suitable for the client and, in particular, in accordance with the client's risk tolerance and ability to bear losses. The FCA Handbook COBS 9 chapter sets out the specific obligations.

The key know-your-customer requirements include obtaining necessary information on the client's knowledge and experience, financial situation, ability to bear losses, and investment objectives, including risk tolerance. COBS 9 requires the suitability report to demonstrate how the recommendation aligns with that information.

Consumer Duty, in force since July 2023 for existing client relationships (July 2024 for closed products), overlays an additional obligation to evidence good client outcomes, not just to follow a process, but to demonstrate that the outcome of the advice was appropriate for the client. Consumer Duty's price and value outcome (FCA guidance FG22/5) requires firms to prove that outcome, not just that a process was followed. This means the file must show the product benefits, limitations, and total price were assessed against the client's specific circumstances, with each assessment traceable to source evidence.

Tracing Data to Source Documents

The practical process of tracing each data point in a suitability report back to its source follows four steps:

1. Identify the claim. Every material statement in the report is a claim that requires evidence. This includes client objectives, risk tolerance, capacity for loss, and the rationale for why the recommendation is suitable.

2. Locate the source document. The source must be a specific document on the client file: the fact-find, meeting notes, ATR questionnaire, capacity for loss worksheet, or provider documentation.

3. Verify the source supports the claim. The source must actually say what the report claims it says. A fact-find that records "client wants growth" does not support a report claim that "client wants aggressive growth with a 15-year time horizon."

4. Record the link. The report must reference the source document clearly enough for a reviewer to find it without searching the entire file. Page numbers, section headings, or direct quotes all work.

This process is straightforward in principle but time-consuming in practice. A suitability report with multiple material claims requires separate source verifications for each one, with each verification taking time to locate, check, and record.

Linking File Evidence to FCA Standards

The evidence types map to specific COBS 9 and Consumer Duty requirements. Client objectives and time horizon satisfy COBS 9.2.2, which requires the firm to obtain necessary information about the client's investment objectives, including where applicable, information on the time horizon of the investment. Risk tolerance satisfies COBS 9.2, which requires assessment of the client's risk tolerance. Capacity for loss also satisfies COBS 9.2, which requires assessment of the client's ability to bear losses. The suitability report must demonstrate how the recommendation meets these requirements per COBS 9.4.

Consumer Duty's price and value outcome adds the requirement to prove positive client outcomes. This means the file must show not just that the advice process was followed, but that the outcome was appropriate for the client's circumstances. All fact-find points should be clearly evidenced on file.

FCA Requirements for Source Traceability

The FCA does not mandate a specific citation format, but it does require that the firm can demonstrate the basis for its recommendation. Source traceability is the practical mechanism for that demonstration. A file where every claim cites its source is verifiable by construction. A file where claims are asserted without reference to source documents is not.

The FCA's expectation is that the evidence chain is clear enough for a reviewer to test without reconstruction. If the reviewer has to guess which document supports a claim, or if the claim cannot be traced to any document on the file, the file fails the review.

Linking Every Claim to Source Documents

The four-point data alignment is the baseline evidence structure reviewers check first. Every suitability report must evidence client objectives, risk tolerance, capacity for loss, and the rationale for why the recommendation is suitable, including any disadvantages, and each of these four points must trace to a source document.

This table is the operational checklist for a source-traceable file. If any row is incomplete, the file has a gap that a reviewer will find.

Validation Steps for Each Evidence Type

The validation process is identical across all four evidence types. For each claim in the report:

1. Locate the source document. Client objectives trace to fact-find or meeting notes. Risk tolerance traces to ATR questionnaire and conversation notes. Capacity for loss traces to financial situation extracts and calculation inputs. The recommendation rationale traces to provider documents (KIID, factsheet, illustration) that support the suitability explanation.

2. Verify the source supports the claim exactly. The source must state what the report claims it states, not just relate to the same topic. If the report says "client wants £20,000 annual income from age 60," the fact-find must contain that specific figure and age, not "comfortable income in retirement."

3. Check the source is contemporaneous. The evidence must date from the advice process. Meeting notes written days after the conversation are weaker than those captured immediately.

4. Confirm the link is accessible. The report must reference the source clearly enough for a reviewer to find it: page numbers, section headings, or direct quotes all work.

Common failures by evidence type:

• Risk profile: ATR score recorded with no conversation notes showing why the client chose that level.

• Provider data: Claims about charges or performance without citing the specific provider document and page number.

• Alternatives considered: No documented alternatives, or alternatives listed without rejection rationale cited to client constraints.

For alternatives, firms should document each non-recommended route with sufficient detail: product identified (specific fund name, provider, charge structure), why it was considered (matches ATR or addresses stated objective), why it was rejected (specific client constraint such as tax efficiency, cost mismatch, time horizon incompatibility, or existing exposure duplication), and the source citation (reference to the client data point that drove the rejection).

How FCA Reviewers Validate Suitability Evidence

FCA reviewers validate suitability evidence by sampling files, checking the evidence chain, and testing whether the report's claims are supported. They do not take the report at face value. They test the chain.

AdvisoryAI's analysis of FCA file reviews identifies the most common reasons suitability reports fail as missing client data (particularly health status, partner financial details, and foreseeable life changes), conflating capacity for loss with attitude to risk, and objectives too vague to test a recommendation against.

Satis UK moved from identifying these gaps reactively at audit to catching them systematically, using Evie and Emma to build a clearer audit trail on every compliance file. Read the Satis UK case study for the full account.

Conflating capacity for loss with attitude to risk is the most consequential documentation failure in advice files. A client with high risk appetite and low capacity who is placed on appetite alone is exposed to a loss they cannot absorb.

Every advice file must contain a complete fact-find with no blank sections for required fields, a risk questionnaire documenting ATR and capacity for loss separately, and a suitability report referencing the client's specific circumstances. Generic rationales fail. A suitability report stating a pension transfer is suitable without explicitly justifying it against retaining the existing arrangement will not pass review.

How Reviewers Link Claims to Sources

Reviewers link claims to sources by following the same four-step process described earlier: identify the claim, locate the source document, verify the source supports the claim, and confirm the source is contemporaneous. They do not accept the report's assertions without testing them against the underlying evidence.

The reviewer's process is systematic. They work through the report claim by claim, checking each one against the file. If they find a claim that cannot be traced to a source, or a source that does not support the claim, they flag it as a gap.

Common Triggers for File Audits

Common triggers for file audits include inconsistent risk profiling, missing capacity for loss evidence, product recommendations that do not match client objectives, and gaps in the fact-find.

Inconsistent risk profiling occurs when the ATR output does not match the recommended risk level, or when different documents on the file record different risk tolerances for the same client. Missing capacity for loss evidence occurs when the file does not contain a separate capacity for loss calculation with numerical inputs. Product recommendations that do not match client objectives occur when the report recommends a product that does not align with the client's stated goals. Gaps in the fact-find occur when required fields are left blank or incomplete.

Each of these triggers maps to the four-point data alignment. Inconsistent risk profiling is a risk tolerance gap. Missing capacity for loss evidence is a capacity for loss gap. Product recommendations that do not match client objectives are a client objectives gap. Gaps in the fact-find can affect any of the four points.

Generic statements ("the client understands the risks"), unsupported assertions ("the client is comfortable with volatility"), and post-hoc reconstructions (meeting notes written days later) do not count as valid evidence.

Fixing Gaps in Your Suitability Report Evidence

Fixing gaps in suitability report evidence requires a systematic remediation framework. The Operations Director's checklist below provides a scannable workflow for identifying and closing gaps before a file review.

Operations Director's Checklist: Source-Traceable File Evidence

This checklist is the operational tool for converting source traceability from an aspiration into a repeatable process.

Defining Measurable Client Aims

• Remediation: Update fact-find templates to require client objectives in measurable terms with time horizon and review date, capturing the client's own words rather than a summary. "Comfortable retirement" is not measurable, "provide £20,000 annual income from age 60" is.

The client's own words on objectives and time horizon, not a paraphrase, materially improve a file's ability to withstand review. Objectives too vague to test a recommendation against are a recurring failure.

Validating Client Loss Thresholds

• Remediation: Create a standalone capacity-for-loss worksheet showing essential monthly expenditure, secure income sources, liquid reserves available, and scenario testing (for example, "client can absorb 30% portfolio loss without impacting standard of living").

The capacity-for-loss calculation and its inputs must be recorded separately from the risk profiling output. The record should show the inputs: essential expenditure, secure income, liquid reserves, time to recovery, and what would happen if the invested capital fell by a material percentage. Capacity for loss is objective and must be evidenced separately from attitude to risk per COBS 9.2.

Validating the Recommendation Rationale with Evidence

• Remediation: Implement a pre-submission check that requires every product claim in the report to reference a specific provider document with a page number or section heading. Claims without a source reference are flagged for completion before the report is finalised.

Validating the recommendation rationale means checking that every claim about charges, risk ratings, performance history, and product suitability has a corresponding provider document on the file, and that the document actually supports the claim.

Evidence for Non-Recommended Routes

• Remediation: Update the suitability report template to require a section on alternatives considered, with each alternative documented using the four-element structure: product identified, why considered, why rejected, and source citation.

Evidence for alternatives considered is required because the FCA expects the file to show what other options were evaluated and why they were set aside. This is a common gap in files that otherwise look complete.

For any recommendation that does not match the ATR tool output, the file must document the alternative route considered, why it was rejected (cost, risk mismatch, liquidity constraints), and which specific client circumstance drove the decision away from the tool output.

How AdvisoryAI Automates the Full Advice Workflow

Atlas is AdvisoryAI's platform for the full advice workflow, from pre-meeting preparation through to compliance checking. Before each meeting, Atlas surfaces client history and flags missed actions so advisers arrive briefed. It is the single environment in which all three capabilities operate, with each one handling a distinct stage of the advice process.

Evie, the meeting notes capability within Atlas, captures structured notes automatically via Microsoft Teams, Zoom, and Google Meet, understanding financial terminology and UK dialects to produce structured output covering objectives, circumstances, recommendations, next steps, and actions. Evie's primary differentiator is soft facts capture: client anxieties, family dynamics, and health concerns mentioned in passing are documented alongside hard financial data.

Emma, the suitability report capability within Atlas, generates reports from multiple input sources (meeting notes, fact-finds, LOA pack summaries, ceding information, cashflow modelling outputs, risk profile assessments), working from your firm's own templates with customisation depth that includes advice style, tonality, formatting (bullets, paragraphs, tables), and personalisation to individual adviser requirements.

Colin, the compliance checking capability within Atlas, checks documents against FCA Consumer Duty and COBS standards before they leave your desk. Atlas then serves as the intelligence layer across all of this, letting you query meeting transcripts, suitability reports, documents, client data, and back office systems (Intelliflo, Plannr, Curo) in plain English, with visible reasoning through Adaptive Thinking so you can see each step and expand any thinking block to read the full reasoning behind any answer.

AdvisoryAI's CEO has spoken directly about where professional judgment remains with the adviser and where documentation work does not, including in conversation with Intelliflo's CEO. Evie connects directly with back office systems including Intelliflo, Plannr, Curo, and Iress Xplan, pushing structured meeting outputs including fact-find data directly into the client file without manual re-entry. Colin is system-agnostic and works on any suitability report, not just those created in AdvisoryAI.

How Emma Maps Suitability Reports to Source Data

Emma generates suitability reports using inputs from meeting notes, fact-finds, LOA pack summaries, ceding information, cashflow modelling outputs, and risk profile assessments, working from the firm's own templates and citing every statement back to its source document automatically. This converts source traceability from a manual, hours-per-report task into an automatic output of the report generation process. Satis UK reported clearer audit trails on every compliance file and richer evidence captured per meeting after adopting Emma, with file review readiness improving as a direct result of source citation being embedded in the report generation process rather than built manually afterwards.

The manual audit-trail construction process described earlier typically adds one to three hours per suitability report, depending on complexity. Emma reduces this to a review-and-approve step by citing every statement to its source as the report is generated.

How to Ensure Report Audit Trails

Emma's source citation works in practice by linking each statement in the generated report to the source document it draws from. When Emma writes a suitability report, it draws on the data already on the client's file from multiple sources and cites every statement back to its source document as the report is generated. Colin then checks the completed report and flags where a client's stated risk tolerance does not align with their capacity for loss, or where investment recommendations contradict stated objectives, before the report leaves the adviser's desk. Every statement carries a link to the source document, so the audit trail is produced as a by-product of report generation rather than a separate manual task. See Emma's compliance features for a full description of how source citation works in practice.

The adviser reviews and approves the report, but the citation work is done. Every statement carries a link to the source document, so the audit trail is produced as a by-product of report generation rather than a separate manual task.

For example, when Emma writes "The client aims to generate £20,000 annual retirement income from age 60," that sentence links directly to the fact-find section 2.1 where the client stated that objective. When Emma writes "The recommended portfolio has an ongoing charges figure of 0.45%," that figure links to the provider KIID page 2. The adviser sees both the statement and its source reference in a single view during review.

The adviser reviews the draft, adjusts where necessary, and approves, while the citation work is compressed from hours to minutes.

Evidence Mapping for FCA File Reviews

Emma's output maps to the four-point data alignment by citing each of the four evidence types to its source document. Client objectives are cited to the fact-find or meeting notes. Risk tolerance is cited to the ATR questionnaire and supporting conversation. Capacity for loss is cited to the financial situation extract and calculation inputs. The recommendation rationale, including why it's suitable and any disadvantages, is cited to provider documents and client data points.

This mapping is automatic. The adviser does not build it manually. Emma generates the report with the citations embedded, and the adviser reviews the output to confirm accuracy.

Validating Provider Data in Advice Files

Atlas handles provider data by extracting figures with a source reference for each, flagging what a provider left out, and surfacing conflicts between documents rather than picking a value. This is particularly valuable when provider documents contain inconsistent data or when key information is missing.

For example, if a provider illustration states one set of charges but the KIID states a different figure, Atlas flags the conflict rather than choosing one. The adviser sees both figures and their sources, and makes the decision about which to use.

This approach reduces the risk of citing incorrect provider data, which is a common source of file review failures.

Validating Evidence for FCA File Reviews

Colin checks the completed report against FCA Consumer Duty and COBS requirements before it leaves the adviser's desk, providing pass/fail verdicts and suggested fixes for gaps. Colin runs automated checks against regulatory standards, with a time-stamped audit trail stored for any future FCA supervisory review. Every generated document carries version history showing who changed what and when, compliance approval can be enforced as a gate before finalisation, and templates and standard wording can be centrally locked so advisers cannot drift from the firm's approved format. This lets firms move from spot-checking a sample of cases to reviewing 100% of cases, surfacing higher-risk cases as flagged alerts.

This is particularly valuable ahead of an s166 review, where the FCA has flagged concerns about a firm's activities, as inconsistencies are caught at the adviser's desk rather than during an external review.

Request a demo to see how Emma's automatic source citation eliminates the hours per report your team currently spends building audit trails manually. Firms using Emma report suitability report preparation time reducing from 4-6 hours to under 1 hour, with the audit trail produced as a by-product of report generation rather than a separate manual task. Contact AdvisoryAI directly for current pricing. A 14-day free trial is available with no credit card required, a monthly rolling agreement, a 30-day money-back guarantee, and annual plans with a 10% discount.

FAQs

Does Emma Work with My Existing Templates and Processes?

Yes. Emma works from your firm's existing suitability report templates, not a standardised vendor format. Customisation includes advice style, tonality, formatting (bullets, paragraphs, tables), and personalisation to individual adviser requirements. Evie connects directly with Intelliflo, Plannr, Curo, and Xplan, pushing structured meeting outputs into your back office without manual re-entry.

How Does Colin Improve Compliance File Review Coverage?

Colin lets firms move from spot-checking a sample of cases (commonly around 15%) to reviewing 100% of cases, surfacing higher-risk cases as flagged alerts. Brooks Macdonald and Satis UK are among the UK advice firms using AdvisoryAI's compliance and documentation capabilities across their adviser teams. See case studies for documented outcomes. Colin works on any suitability report, not just those created in AdvisoryAI.

What Inputs Does Emma Use to Generate Suitability Reports?

Emma generates reports using inputs from meeting notes, fact-finds, LOA pack summaries, ceding information, cashflow modelling outputs, and risk profile assessments. Every statement in the generated report cites back to its source document automatically.

How Does Atlas Help with Client Data Queries?

Atlas lets you query across meeting transcripts, suitability reports, documents, client data, and back office systems (Intelliflo, Plannr, Curo) in plain English. Atlas keeps its reasoning visible and persistent, so you can follow the logic behind any answer and return to earlier queries for audit purposes.

What Is Evie's Primary Advantage for Meeting Notes?

Evie captures soft facts that other meeting note products miss: client anxieties, family dynamics, and health concerns mentioned in passing are documented alongside hard financial data. This is the primary reason firms choose AdvisoryAI's meeting note capability. Firms using Evie report documentation time dropping by 50-80%. At Brooks Macdonald, meeting write-up time reduced from 2.5 hours to a 30-minute review across 60 advisers, freeing 6,000 hours annually firm-wide.

Key Terms Glossary

Source traceability: The ability to trace every statement in a suitability report back to a source document on the client file, such as a fact-find, meeting note, risk profile response, or provider document.

COBS 9: The FCA Conduct of Business Sourcebook chapter on suitability requirements for retail advice, which sets out the information firms must obtain about clients and how recommendations must align with that information. Key obligations are contained in COBS 9.2.2 (investment objectives and time horizon), COBS 9.2 (risk tolerance and capacity for loss), and COBS 9.4 (the suitability report).

Suitability report evidence: The source documents and data that support each claim in a suitability report, including client objectives, risk tolerance, capacity for loss, and the rationale for why the recommendation is suitable.

Audit trail: The recorded chain of evidence linking a recommendation back to its source documents, which an FCA reviewer tests during a file review.

Four-point data alignment: The baseline evidence structure FCA reviewers commonly check first in a suitability report, comprising client demands and needs, risk tolerance (ATR), capacity for loss, and the explanation of why the recommendation is suitable, each of which must trace to source documents on the client file.