The Compliance Checklist Every Insurance Broker Needs Before an Audit

Brokerages rarely fail a compliance audit on the obligations they have never heard of. They fail on the ones they assumed they were meeting.

ASIC's surveillance activity has stepped up rather than eased off. In its 2024-25 annual report, the regulator recorded a 50% increase in investigations and completed 829 targeted surveillances across the financial services sector. That is a wider net, and it means more licensees are being asked to produce evidence, not just describe their processes.

For a brokerage that has already worked through its AFSL obligations, the checklist below is the operational layer that sits underneath it.

It also builds on current ASIC compliance requirements and what a compliant brokerage is expected to look like in practice.

And it complements the groundwork covered in preparing for an ASIC audit: this checklist is what that preparation should be able to produce on demand. A policy answers what the brokerage says it does. A checklist, tested against real files and real calls, answers what it can actually show.

This distinction is where most audit findings originate. The framework exists. The evidence trail behind it is thinner than anyone realised until someone was asked to produce it on short notice.

An ASIC review does not start with a broad question about culture or intent. It starts with a request for specific documents, and the request tends to follow a predictable pattern across five categories.

Licensees must show how they meet the general obligations set out in the Corporations Act, including adequate risk management systems.

ASIC's regulatory guide builds on that statutory base and sets out what the regulator looks for in the supervision and compliance arrangements built around it.

Since September 2024, record-keeping requirements for personal advice have required these records to be kept for seven years and produced on request.

Each category sounds administrative until a reviewer asks for a specific example rather than a general description. That is usually where the gap becomes visible.

These five categories are not arbitrary. They broadly reflect the areas ASIC's surveillance and review work commonly examines across licensees of every size, from single-adviser brokerages to firms with dozens of authorised representatives. A reviewer working through a file is not looking for perfection. They are looking for a consistent pattern of evidence across all five categories, applied the same way regardless of which representative handled the file or which product was being discussed. A brokerage that is strong on personal advice records but has never tested its internal dispute resolution process against a real complaint has not closed the gap. It has simply moved it to a different category.

For an insurance brokerage specifically, these categories rarely sit in isolation. A single client renewal call can touch four of the five at once: the adviser makes representations that fall under general obligations, the call may constitute personal advice requiring a record, a client query midway through the call can look very like the start of a complaint, and the way the adviser handles that moment says something about how well their training has actually landed. Treating the categories as five separate compliance projects misses how closely they are tied together in the calls a brokerage runs every day.

A brokerage can have every policy listed above and still fail to produce what ASIC asks for, because policies describe intent and reviews test application. Take duty of disclosure as an example: a brokerage may have a documented policy that every adviser is trained on, but a review tests whether disclosure was actually given, in the specific words used, on a specific client call. File notes can say disclosure occurred. They cannot show what was actually said, and for many firms, the call itself was never reviewed to confirm it.

The same gap shows up around best interest duty. The duty is well understood in policy terms. Whether a particular piece of advice, delivered verbally, actually met that standard is a different question, and one that a written file often cannot answer on its own.

This is not a case of brokerages ignoring their obligations. It is a structural gap: the parts of the business most exposed to compliance risk, live advice conversations, are also the parts least likely to be systematically reviewed. Spot-checking a small sample of calls each month can create a false sense of coverage while leaving most conversations unreviewed and unaccounted for.

The pattern repeats across internal dispute resolution as well. For many brokerages, the earliest and most revealing evidence of how a complaint was actually managed exists only in the original call, and that call is often the one piece of the file nobody thinks to check until it is requested.

None of this is unique to any one product line, or to firms that have historically had compliance issues. The hidden compliance risk in a brokerage's day-to-day phone calls rarely announces itself as a red flag at the time. It sits inside the ordinary, unremarkable renewal call or claims conversation that nobody thought to review, which is exactly why a checklist built only around documents will miss it, and a checklist built around the calls themselves will not.

"Audit-ready" is not an ASIC-defined term, but a practical working definition is useful here. Audit-ready is not a folder of policies updated the week before a review. It is a standing checklist that can be tested at any time, against any file, without preparation. In practice, that means each of the five documentation categories carries a defined risk level and a defined way of proving compliance, not just describing it.

A brokerage that can pull a random file or a random call and show, without notice, how it meets each category is in a fundamentally different position from one that can only produce a policy manual. The risk rating matters because it determines where limited compliance resources should go first: personal advice records and verbal disclosure carry the most direct exposure, so they warrant the most review time.

The risk rating is only half of the picture. The consequence side matters just as much. A gap in personal advice records can have more significant regulatory consequences, particularly where it affects the ability to demonstrate compliance or respond to a client complaint, while deficiencies in training records may be identified during supervisory reviews depending on the circumstances. Mapping both risk and likely consequence against each category is what turns a checklist from a filing exercise into something that actually changes where a brokerage spends its compliance attention.

The categories that are hardest to prove on request are the ones tied to what was actually said on a call: disclosure, advice content, and how a complaint was first raised and handled. These are also the categories a compliance officer has the least practical ability to review at scale using manual sampling.

This does not replace the documentation categories that sit outside call data, training records or IDR case files, for example. It closes the specific gap explored above: the distance between a policy that says disclosure happens and proof that it did, on a particular call, for a particular client.

A checklist run once before an audit tells a brokerage what it looked like on one day. Run continuously, it tells a brokerage what it actually looks like most of the time. Five practical steps make the difference, usually coordinated by whoever holds the compliance officer role in the business.

Call recording compliance is the category most exposed to manual review gaps and most improved by systematic, rather than sampled, coverage.

None of these steps require a larger compliance team. They require the checklist to be treated as something the business runs against continuously, rather than something it assembles when a review letter arrives.

The brokerages that struggle in an ASIC review are rarely the ones without a compliance framework. They are the ones whose framework cannot be tested on demand, particularly around what was actually said in client conversations rather than what a policy document says should have been said. A checklist built around the five documentation categories, applied continuously and tested against real files rather than assumed compliance, closes most of that gap. The categories tied to call content are the hardest to keep current through manual review alone, which is where Callyx.ai fits: turning every recorded call into evidence the checklist can already answer, rather than evidence that has to be reconstructed after a request lands.