The SRA Compliance Officer Thematic Review: Insights, concerns and the way forward
Anne Austin
Director
The Solicitors Regulation Authority (SRA) has published their comprehensive findings of a significant thematic review examining how Compliance Officers for Legal Practice (COLPs) and Compliance Officers for Finance and Administration (COFAs) are operating across law firms.
The review, based on visits to 25 law firms and interviews with 36 individuals, reveals a profession grappling with resource constraints, unclear regulatory expectations, and a crisis of confidence in the value of these critical roles.
While the SRA identified examples of good practice and firms where compliance culture is thriving, the review uncovers significant systemic risks that could undermine consumer protection and regulatory effectiveness. The findings suggest that compliance officer roles are frequently under-resourced, over-extended, and undervalued – even as individual officers shoulder significant personal responsibility for their firms’ regulatory compliance.
Why the need for the review? The regulatory imperative
The SRA’s thematic review was driven by a fundamental regulatory question: are COLPs and COFAs effectively discharging their duties to ensure law firms comply with regulatory requirements and protect consumers?
The regulatory framework
As we know, law firms regulated by the SRA must appoint a COLP, i.e. an individual responsible for compliance with professional principles and regulatory standards. Most firms also appoint a COFA to oversee financial compliance and administration. These roles exist at the heart of the regulatory framework, intended to provide real-time checks and assurances about a firm’s daily approach to compliance.
The SRA’s key questions
The review set out to answer four critical questions:
- How, and when, do law firms choose their compliance officers?
- Do compliance officers understand and meet their regulatory obligations, including ensuring ongoing competency?
- What compliance systems, controls and processes are in place, and how effectively are compliance officers overseeing them?
- What are the key risks and challenges faced by compliance officers?
Historical concerns: A regulatory background
The SRA has, in recent years, expressed concerns about the effectiveness of compliance officer roles across the profession. While compliance officer appointments have been mandatory since 2012, the regulator has identified emerging issues that suggested a deeper investigation was warranted.
Previous observations
The SRA’s previous work identified patterns suggesting that:
- Compliance officers sometimes lack clarity about their specific regulatory obligations
- Some firms treat compliance as a tick-box exercise rather than embedding it into firm culture
- Succession planning for these critical roles was often overlooked
- Compliance officers may lack adequate support, resources, and training
- There were inconsistencies in how firms approached compliance reporting and record-keeping
This thematic review was the SRA’s attempt to understand the extent and nature of these concerns, and to identify what support and changes might be needed to strengthen compliance officer effectiveness.
Key findings/what the review revealed: A profession grappling with awareness and understanding
One of the most striking findings concerns compliance officers’ awareness of their own regulatory obligations. The SRA sets five specific requirements for COLPs and three for COFAs. Yet, the review found that:
- Only 1 COLP could describe the material requirements of their role to the SRA
- Only 50% of compliance officers had read the SRA’s reporting and notification guidance
- 20% of compliance officers could not explain their record-keeping obligations
- Only 1 individual could describe the difference between a notification (must be reported) and a report (discretionary)
This represents a fundamental gap in regulatory knowledge that directly affects how effectively firms detect, evaluate, and report regulatory breaches.
Overwhelm and burnout: the human toll
A critical finding concerns the personal wellbeing and workload of compliance officers themselves. The picture is one of overextension:
- 52% of compliance officers reported feeling stressed about their role
- Nearly 50% identified lack of time as their primary challenge
- Compliance officers spend, on average, only 26% of their time on compliance-related tasks
- Almost 25% struggle to dedicate enough time to compliance alongside fee-earning work
- 100% of compliance officers held at least one additional role within their firm
Critically, 47% felt their role was not acknowledged or valued by their firm, yet 84% felt they were the right person for the job. This mismatch reveals a profession that feels personally responsible but systematically underappreciated.
Succession planning and dependency risks
Despite overall stability in compliance officer tenure, the review reveals troubling succession planning issues:
- 42% of compliance officers have held their role since its introduction in 2012
- 44% of firms do not have a deputy compliance officer
- Firms show little evidence of encouraging internal applications for the role
- There is no competition for compliance officer positions
- Few compliance officers reported receiving financial incentives or formal recognition
This creates a significant risk: many firms are heavily dependent on individual compliance officers who may lack clarity about the future of their role, without adequate backup or succession planning should those individuals leave.
Inconsistent reporting and record-keeping practices
The review identified concerning gaps in how firms approach compliance reporting:
- Only 25% of compliance officers could describe a defined reporting process
- 41% of firms maintain only partial compliance records
- 44% use their own professional experience to determine reporting obligations (despite not having read SRA guidance)
- Compliance records are stored across multiple systems: software, paper, email, and case management systems
These inconsistencies create risk: compliance breaches may be missed, inadequately documented, or not reported to the regulator in line with requirements.
Positive practices alongside concerns
It is important to note that the review also identified substantial compliance infrastructure in place at most firms:
- 94% of firms had a formal office manual and internal compliance policy
- 83% of firms undertake regular file reviews
- 69% of firms arrange external third-party compliance audits
- 53% of compliance officers lead training exercises on core compliance areas
- 63% of compliance officers access external compliance advisors for support
The challenge, therefore, is not the absence of compliance structures, but rather gaps in understanding, resource, and strategic value placed on these roles.
What the SRA expects: Recommended actions for Compliance Officers
Based on its findings, the SRA has identified several priorities for compliance officers and firms going forward. While the regulator has stopped short of announcing specific enforcement actions, the review makes clear what the SRA expects
Understand your obligations
All compliance officers must have a thorough, documented understanding of the SRA’s five (COLP) or three (COFA) specific regulatory requirements. The SRA expects that, if asked, a compliance officer should be able to describe these requirements clearly. Key actions include:
- Read and become familiar with the SRA’s Standards and Regulations
- Study the SRA’s reporting and notification guidance in detail
- Understand the distinction between notifications (mandatory reporting) and reports (discretionary)
- Document your firm’s compliance obligations and how they will be met
- Seek SRA guidance or external advice if any aspect of your obligations remains unclear
Establish clear, documented processes
The SRA expects compliance officers to establish systematic, documented approaches to managing compliance, including breach identification and reporting. The review found that too many firms rely on informal processes or individual judgment. Actions include:
- Create a defined, written process for identifying potential compliance breaches
- Establish a clear decision-making framework for determining whether breaches must be reported to the SRA
- Implement centralised, accessible record-keeping systems for all compliance documentation
- Ensure all staff understand the breach identification and reporting process
- Regular audit your record-keeping to ensure completeness and accuracy
Embed compliance into firm culture
The SRA expects compliance to be a shared responsibility across the firm, not solely the domain of the compliance officer. This requires:
- Leadership support for compliance culture, including adequate resourcing
- Clear communication from management that compliance is a shared responsibility
- Regular training and awareness-raising for all staff on key compliance topics
- Recognition and acknowledgment of the compliance officer’s role and contribution
- Consultation with compliance officers on firm strategy and decision-making that may impact compliance
Management take heed: address resource and succession planning
The SRA expects firms to ensure that compliance officer roles are adequately resourced and that succession planning is in place. This includes:
- Allocate sufficient time for compliance officers to discharge their duties effectively
- Appoint a deputy compliance officer or identify a succession plan
- Consider providing training and shadowing opportunities for potential future compliance officers
- Ensure compliance officer roles are documented and transferable
- Consider financial recognition or career development opportunities for compliance officers
Maintain and demonstrate competence
The SRA expects compliance officers to maintain and develop their competence. The review found that:
- 19% of compliance officers had no learning and development record
- Only a minority could demonstrate training relevant to their role in the past year
- For COFAs, 19% had undertaken none of the typical competence-building activities
The SRA expects:
- Documented professional development tailored to compliance officer responsibilities
- Regular training on emerging regulatory changes and risks
- For COFAs, specific financial knowledge or expertise (through qualifications, experience, or professional development)
- Maintenance of a learning and development record demonstrating competence
- Access to external expertise or advice where needed, and use of SRA resources
What comes next: The SRA’s broader agenda
The SRA has made clear that this thematic review is the beginning, not the end, of its engagement on compliance officer effectiveness. The regulator has committed to:
- Consider changes to continuing competency requirements and frameworks for compliance officers
- Develop a stronger support package for compliance officers and firms
- Improve communications and engagement with compliance officers
- Undertake a more fundamental, longer-term review of the effectiveness of the compliance officer regime
- Progress its Consumer Protection Review, which may include changes relating to compliance officer roles
Compliance officers should anticipate potential regulatory changes and use this period to strengthen their practices and demonstrate their value to their firms.
Conclusion: A call to action
The SRA’s thematic review paints a picture of a profession where compliance officer roles are critical to regulatory effectiveness but where many officers are struggling under resource constraints, unclear expectations, and lack of firm-wide support.
For compliance officers, the message is clear: understand your obligations thoroughly, establish systematic processes, maintain your competence, and work to embed compliance into your firm’s culture.
For firm leaders, the message is equally important: your compliance officer cannot effectively discharge their role without adequate time, resources, support, and firm-wide buy-in.
The SRA is serious about strengthening compliance officer effectiveness. Firms that take action now to address the findings of this review will be better positioned as the regulator implements the changes and developments outlined in its conclusions.
Based on the SRA’s Thematic Review on Compliance Officers | February 2026