A compliance audit for an Australian mortgage brokerage is a licence-and-file review against the NCCP, ASIC guidance, the Privacy Act 1988 and your licensee or aggregator program. Drop any TILA, RESPA or Dodd-Frank checklist.
Start with who holds the Australian credit licence and the CL50 appointment. Then sample files for best-interests duty, the comparison note and consent. An aggregator scorecard does not replace those duties.
Effortlessly navigate compliance with comprehensive trail tracking.
Track My Trail makes it easy for brokers to analyse their lender distribution, identify their most profitable clients, and keep track of lost & gained trail.
Get Track My Trail for free today – no credit card required.
What a Compliance Audit Tests
Audit Scope and Evidence
A compliance audit here is a planned review of whether the brokerage can show it arranged credit lawfully. The work is risk assessment of files, process checks and a pass or fail against the written program. It does not “improve efficiency” by itself. It shows what you would hand to the licensee, ASIC or AFCA.
Find Missing Records Before an External Review
You run the review so a missing Credit Guide, a stale comparison note or an expired appointment is found in-house. ASIC can still act on a breach. AFCA can still hear a complaint. A clean aggregator visit does not close those doors.
Compliance Areas a Brokerage Audit Covers
Licensing and Operational Permits
Credit authority is national. Most new brokers are credit representatives. The licensee lodges CL50. States do not issue a second home-loan broker permit. Check the licence number on the website, the Credit Guide and every ad. Confirm the appointment is current and that anyone giving credit assistance is named on it.
Adherence to Mortgage Lending Laws
Use Australian instruments: the National Consumer Credit Protection Act, best-interests duty from 1 January 2021 and RG 209 inquiries where they still apply to the file. ADI home-loan responsible-lending duties were largely removed from 1 October 2021. Brokers arranging consumer credit still have NCCP unsuitability duties. TILA, RESPA and the Dodd-Frank Act are United States statutes. They do not govern an Australian Settlement file.
Mandatory Reporting and Data Privacy
Keep Privacy Act 1988 consent, access and retention on every lead and file. Report eligible breaches to the licensee on the clock in your program. AFCA is the external-dispute path for many credit complaints. Do not invent a US-style HMDA report. If you send files to a CRM host, record where the data sits.
Preparing for a Compliance Audit
Necessary Documentation
Pull a sample before the reviewer arrives: Credit Guide, appointment letter, ID and living-cost worksheet, comparison and BID note, lender correspondence, consent and the trail or invoice record. Add CPD evidence and the current PI certificate. A folder labelled “checklist” with empty templates is not a file.
Staff Training
Train on the process you actually lodge: how to complete the comparison note, when to pause for a variation and who signs a breach form. MFAA or FBAA membership CPD can count toward hours. ASIC does not treat membership as the licence test. Record the date, the topic and who attended.
Contracting External Auditors
An outside reviewer helps when no one in the office can fail their own files. Ask for Australian credit-assistance experience, a sample report with redacted files and who they notify if they find a breach. A generic ISO auditor who has not read an NCCP file is the wrong hire.
Conducting the Compliance Audit
Internal vs. External Audits
Internal review is cheaper and can run every month. It can also grade your own shortcuts as fine. External review costs more and can sample files you would not pick. An aggregator path such as choice may run its own file reviews. That visit does not replace the licensee’s program or an ASIC inquiry.
Step-by-Step Audit Process
Use this order:
- Write the scope: licence and appointments, a set number of settled and withdrawn files, ads and the Privacy Act register.
- Pull the documents listed above and lock the sample so nobody “tidies” a file mid-review.
- Test each file against BID, the comparison note, living costs, consent and who gave the credit assistance.
- Interview the broker who owned the file. Ask them to show the note, not recall it.
- Write findings with the file ID, the rule and the fix date. Lodge breaches on the licensee’s form the same week.
Common Compliance Pitfalls
The usual fails are a comparison note written after lodge, a Credit Guide that still names the old licensee, ads that omit the licence number and consent stored only in a personal inbox. Another fail is a US statute list left in the office manual. Update the manual when the law moves, not when the next audit is booked.
Utilising Technology in Compliance Audits
Software and Tools
Use the aggregator CRM, the licensee portal and a trail ledger that can show who was paid. Track My Trail can show distribution and lost trail. It does not score BID. Do not buy a US “HMDA export” tool for an Australian book.
Benefits of CRM Systems
Customer Relationship Management software is useful when it holds consent, the file note and the document list in one login you can export. Ask where the host stores data and who can see it. A CRM that cannot export will stall the next switch and the next audit.
Digital Tools for Streamlining Audits
A shared folder or audit workspace helps only if the sample is frozen and dated. Analytics that rank “risky clients” are not a substitute for opening the PDF. Confirm Suite360, Mercury, Infynity or Metanoia is the screen your office actually uses this month.
Have you checked your trail book for missing trail?
Track My Trail makes it easy for brokers to keep track of lost & gained trail, discover clients who have paid off big chunks of their loans, and identify your most profitable clients.
Get Track My Trail for free today - no credit card required.
Post-Audit Activities
Handling Audit Findings
Give each finding an owner and a date. Fix the file first if the client is still in the process. Then fix the template so the next file does not copy the same gap. Tell the licensee on their form if the program requires a breach notice.
Continuous Improvement
Put the next sample date in the calendar before you close this one. Review ads when RG 234 or your rate sheet moves. Do not wait for a 12-month “program refresh” slide.
Training and Development
Train on the finding you just closed. If the fail was living costs, run that worksheet again with the same staff. A generic “compliance culture” session without a file on the table does not change the next lodge.
Regulatory Updates and Future Trends
Upcoming Regulatory Changes
There is no single 2026 “mortgage audit Act”. Date the rules that did move. ASIC reissued RG 234 on 9 June 2026 for credit advertising. Consumer-data rules for large non-banks start in stages (product data from 13 July 2026 and consented consumer data from 9 November 2026). Put those dates in the program if you use CDR feeds. Do not invent a new audit statute around them.
Impact of Technology and Market Trends
Pre-fill and ranking tools can speed a pack. The credit representative still owns the recommendation. A chatbot must not pick a loan. Finsure’s Infynity-to-Metanoia cutover is staged through 2026. AFG Flex sits inside Suite360. Confirm the login before you write it into the audit program.
Choosing a Compliance Partner
Criteria for Selecting Compliance Consultants
Choose a reviewer who has assessed Australian credit-assistance files, can name NCCP and BID in the sample report and will tell you who they notify. Ask how they treat mortgage compliance when the licensee and the aggregator disagree. Price is second.
Where to Find an Approved Reviewer
This page does not name a vendor shortlist. Start with the licensee’s approved reviewer list, then the aggregator’s file-review team. A “leading global GRC platform” that cites TILA is the wrong catalogue.
Continuous Partnerships vs. Ad-Hoc Services
A standing reviewer helps if they sample on a calendar and see repeat fails. A one-off review helps before a sale or a licence variation. It also helps after a complaint cluster. A retainer that never opens files is a fee, not a control.
Case Studies
Document a Completed Audit
Use your last licensee sample as the case study. Record what the reviewer requested, which file IDs you provided and which finding you closed.
Overcoming Compliance Challenges
If the last fail was documentation, rebuild the pack order and re-audit five files in 30 days. If the fail was training, sit the same people on those five files. Do not add a new policy PDF and call the finding closed.
Additional Resources
Regulatory Bodies and Updates
Read ASIC for credit-licence and RG pages, the AFCA site for complaint process and OAIC for Privacy Act notices. MFAA and FBAA pages are membership guidance. ASIC and the NCCP are the statute. Keep a dated bookmark list inside the mortgage compliance folder you will actually open.
The Role of Internal Communication in Compliance
Keep One Current Template and Reporting Path
Tell the office which template is current and which one is retired. Put the Credit Guide version and the comparison-note version in the same place as the lodge button. A meeting that only repeats “stay compliant” does not change a file.
Communication Tools and Strategies
Use the CRM note, the licensee portal and one shared folder. A personal WhatsApp thread is not an audit trail. If someone sees a breach, they need a named inbox and a same-week response, not a suggestion box.
The Financial Impact of Compliance
Cost of Non-Compliance
The bill is ASIC or licensee action, AFCA outcomes, clawbacks, PI excess and time off the panel. Do not quote an invented “average fine”. Price the last finding you actually closed and the hours it took.
Budgeting for Compliance
Budget for PI, CPD, the licensee or aggregator file-review fee and time to fix findings. Software is only useful if it holds consent and notes you can export. Do not fund a second CRM that nobody logs.
Run the Next File Sample This Month
Run the next sample this month: licence and CL50, five files, ads and the Privacy Act register. Stop if the office manual still cites TILA, RESPA or Dodd-Frank. Fix the finding before you book the next reviewer.
