A mortgage broker compliance checklist tests your licence arrangements and client files, then gives each finding an owner and a due date. Use it before a licensee review or aggregator file check, and keep the same checks running through a standing quality-control plan.
What a Compliance Audit Tests
A compliance audit is a planned review of whether your brokerage can show it arranged credit lawfully. The result is an evidence pack you could hand to the licensee, the Australian Securities and Investments Commission (ASIC) or the Australian Financial Complaints Authority (AFCA).
Run the review in-house to find missing documents before someone else requests them. A clean aggregator visit does not prevent ASIC from taking action or AFCA from hearing a complaint. Test the files against the duties in your broker compliance framework and your licensee's written program.
Compliance Areas a Brokerage Audit Covers
Licence and Appointments
Confirm who holds the Australian credit licence (ACL) and the authority under which each broker provides credit assistance. For a credit representative appointment, the licensee notifies ASIC using form CL30. A corporate credit representative can also notify a permitted sub-authorisation.
Check the appointment letter against ASIC's register and the broker's authorised activities. Employees and directors of a licensee can act as its representatives without a separate credit representative appointment. Record which arrangement applies to each person.
Form CL50 is the licensee's annual compliance certificate. Check its lodgement record separately from appointment records. Check the correct licence number on the website, Credit Guide and every advertisement.
Responsible Lending and Best Interests
The National Consumer Credit Protection Act 2009 (NCCP Act) still imposes responsible lending obligations on lenders and brokers. Mortgage brokers also have a best interests duty (BID). Test the evidence for both duties in each relevant consumer-credit file.
ASIC RG 209: Credit licensing - Responsible lending conduct explains inquiries, verification and the assessment of unsuitability. Check the client's requirements and objectives, financial information and the recorded reasons for the recommendation.
TILA, RESPA and the Dodd-Frank Act are United States statutes. They do not govern Australian mortgage-broking files. An office manual built around those statutes needs correction before staff use it for a file review.
Privacy and Escalation Records
Check consent and collection notices against the Privacy Act 1988 requirements that apply to the business. Review access permissions, client access requests and retention rules. Confirm that staff can retrieve the consent record from the business system.
Use the broker breach-reporting guide to assess a suspected reportable situation. Route client complaints through the complaints and AFCA guide. Record the referral from the audit without replacing either process with a finding log.
Preparing for a Compliance Audit
Prepare a complete pack for each sampled file so the reviewer can follow what happened before lodgement. Gather these records from the systems where staff actually keep them.
- The Credit Guide and appointment letter.
- Identification records and the living-cost worksheet.
- The comparison record and best interests note.
- Lender correspondence and client consent.
- The trail statement or invoice record.
- Continuing professional development (CPD) evidence and the current professional indemnity (PI) certificate.
Train staff on the process they use to lodge a loan. Practise the comparison note and the escalation of a changed client circumstance. Record attendance and the training topic. Match CPD records to the licensee's requirements.
Choose an external auditor with Australian credit-assistance experience. Ask for a redacted sample report showing the rule tested and the evidence behind each finding. Agree who receives a suspected breach and how the reviewer protects client records.
Conducting the Compliance Audit
Internal review lets you test files between outside visits, while an external reviewer can challenge how staff apply the program. Assign internal reviews to someone who can question the file owner's work. An aggregator's file review does not replace the licensee's monitoring program.
- Write the scope. Name the licence and appointment checks, the period covered and the settled or withdrawn files to sample. Include advertisements and Privacy Act records.
- Gather and lock the sample. Save the file list and a read-only copy of the records. Keep later corrections separate so the original evidence remains visible.
- Test each file. Record evidence for responsible lending, BID, consent and the comparison note. Confirm who gave the credit assistance and whether their authority covered it.
- Interview the file owner. Ask the broker to show the record supporting their decision. A recollection cannot fill a missing contemporaneous note.
- Record each finding. Include the file ID, the rule tested and the evidence of the defect. Assign an owner and a fix date, then route any suspected breach through the licensee's process.
Watch for a comparison note written after lodgement, a Credit Guide naming the old licensee, advertisements missing the licence number and consent held only in a personal inbox. Record each defect against the affected file or advertisement. Keep the original evidence when staff correct it.
Utilising Technology in Compliance Audits
Use the customer relationship management (CRM) system for client records and the licensee portal for review submissions and escalation. A trail ledger helps reconcile the money paid against the underlying book. Test exports and access permissions before the reviewer needs them.
Track My Trail shows lender distribution and lost trail, but it does not score best interests compliance. Upload two monthly reports to Quick Analysis to see which loans dropped off and which clients discharged. Keep those financial checks beside the file review.
Finsure describes Metanoia as its next generation broker platform and still promotes Infynity. Its public Metanoia page gives no cutover date. Confirm which platform your office actually uses before naming its screens or export steps in the audit program.
Keep the locked sample in a shared audit workspace with restricted access. Preserve the file list and export time. Staff must open the underlying documents even when software flags a file for review.
Post-Audit Activities
Give every finding an owner and a due date. Fix the live client file first when the client is still in the process. Then correct the template and retest the affected check before closing the finding.
Train staff on the specific defect just closed. For a living-cost error, work through the worksheet with the same staff and check their next relevant files. Record what the retest showed.
Use the last licensee sample as the record of a completed audit. Keep what the reviewer requested, the file IDs supplied and the evidence that closed each finding. This gives the next reviewer a traceable starting point.
Put one current template in the same place as the lodgement button and retire superseded copies from active use. Use a named inbox for suspected breaches and assign someone to respond within the same week. That response timetable does not replace legal reporting deadlines.
Turn the Audit Into a Standing QC Plan
A standing quality-control (QC) plan keeps file checks running after the audit closes. Adapt the sampling method to the brokerage's volume, staff experience and past defects. Record the sample size and review frequency with the reason for each.
Use pre-submission checks to catch missing evidence before lodgement. After settlement, sample files by a recorded risk-based or random method. A risk-based sample can include files involving new staff or a defect found in an earlier review. Keep the selection rule so another reviewer can repeat it.
Give each loan-file review a record with the following fields.
| Review Field | What to Record |
|---|---|
| Check performed | The obligation or control tested. |
| Evidence | The document or system record, with its location. |
| Result | Pass, fail or further evidence needed, with a reason. |
| Defect type and severity | The category and seriousness under the licensee's program. |
| Corrective action | The file fix and any change to the process. |
| Retest | Who checked the fix and the outcome. |
Keep a corrective-action log for every material defect. Include its finding ID, file ID and owner, with the due date and closure evidence. An overdue action stays open until the manager records a resolution. Use the brokerage risk-management template to track recurring findings.
Reconcile commission, clawbacks and expenses as a separate financial check. Report its findings to the same manager without treating a reconciled statement as proof of lawful credit assistance.
Review the QC plan after a regulatory change, an incident or a repeated defect. Record the approver and keep earlier versions for the files assessed under them. Keep the written controls in your brokerage policies and procedures consistent with the checks staff perform.
Regulatory Updates and Where to Check Them
Update the audit program for the rule that actually changed. ASIC reissued RG 234: Advertising financial products and services (including credit) in 2026. Check advertisements against that guidance and the licensee's approval process.
The Consumer Data Right rollout for non-bank lenders separates product data from consented consumer data. Initial and large providers have different consumer-data commencement rules. Where your office uses these feeds, apply the published provider category and timetable to its controls.
Use ASIC for licence records and regulatory guides. AFCA publishes complaint-process information, while the Office of the Australian Information Commissioner (OAIC) publishes privacy guidance. Treat Mortgage and Finance Association of Australia (MFAA) and Finance Brokers Association of Australia (FBAA) material as membership guidance. Keep the applicable source and rule version in the audit program.
Choosing and Paying for a Compliance Partner
Start with the licensee's approved reviewer list or the aggregator's file-review team. Select a reviewer with Australian credit-assistance experience and a redacted report that shows how findings are supported. Ask how they resolve differences between the licensee's requirements and the aggregator's process.
A standing arrangement fits recurring sampling and follow-up of repeated defects. A one-off review can fit a licence variation, a business sale or an incident. Agree the file count and scope, who performs the retest and what the fee covers.
Non-compliance can lead to licensee or ASIC action, AFCA outcomes and time away from writing business. It can also create PI excess costs and hours spent repairing files. Budget separately for PI, CPD, file-review fees and staff time to close findings. Use the actual cost of earlier findings when setting that budget.
Run the Next File Sample This Month
Book a first sample of five files this month alongside the licence, appointments and annual compliance certificate checks. Include advertisements and Privacy Act records. Five files is a starting exercise, not a prescribed sample size for your standing program.
Stop using an office manual that still cites United States law and correct its Australian requirements. Before closing the sample, confirm every material finding has an owner and a due date. Close it only when the retest record shows the defect is fixed.
