Colp & Cofa

Originally published on 9 June 2013. Updated on 8 October 2026.

COLP and COFA reporting should help senior management understand the firm’s compliance risks, the effectiveness of its controls and the decisions requiring attention. A reassuring summary is of limited value if it leaves important weaknesses unexplained.

The central question raised when this article first appeared remains relevant: how does management know that the firm’s compliance arrangements are working?

Answering that question requires a sensible balance. Partners need enough information to exercise oversight, presented clearly enough to identify what they should do next.

Management remains responsible for compliance

The SRA Code of Conduct for Firms sets out responsibilities for firms, managers and compliance officers. Appointing a COLP and COFA does not transfer all responsibility for compliance to those individuals.

The firm must have effective governance and controls, maintain compliance records and enable its compliance officers to discharge their duties.

In practice, management should give the COLP and COFA access to relevant information, a clear route for escalating concerns and the resources needed to address weaknesses.

Lexsure’s risk roles and responsibilities wording offers a starting point for documenting responsibilities within your firm’s own structure.

What should the COLP report to management?

A useful COLP report should explain the issues that matter to the practice and the evidence supporting its conclusions. Depending on the firm’s work, management might ask:

• What significant concerns have arisen since the previous report?
• What do file reviews reveal about supervision and the quality of advice?
• Are complaints or incidents exposing recurring weaknesses?
• Have changes in the firm’s work created new compliance risks?
• Which corrective actions remain outstanding, and why?
• What decisions, funding or support are needed from management?

Where regulatory reporting obligations arise, they need prompt consideration. A scheduled management meeting should not delay a report required by the applicable rules.

Our article on evidencing law firm compliance explains why completed procedures need to be supported by meaningful records.

What should the COFA report to management?

The COFA’s responsibilities focus on compliance with the SRA Accounts Rules. Management reporting should make the position on client money and accounting controls understandable.

For firms operating client accounts, rule 8.3 of the SRA Accounts Rules requires reconciliations at least every five weeks, with the record signed off by the COFA or a manager. Any differences should be investigated and resolved promptly.

Practical questions for management include:

• Are reconciliations completed and signed off on time?
• What unexplained differences, shortages or other exceptions remain?
• Have payment controls identified errors or attempted fraud?
• Are residual client balances receiving appropriate attention?
• Are staff absences or workload pressures weakening financial controls?
• What action has been taken following previous findings?

A statement that a reconciliation was completed should be accompanied by an explanation of any unresolved issues and the action being taken.

Make reports useful for decisions

A practical management report can begin with a short summary covering the principal risks, changes since the last report and decisions required. Supporting detail can follow where it is needed.

For each significant issue, record:

1. The finding: what happened and how it was identified.
2. The significance: the potential effect on clients or the firm.
3. The response: immediate safeguards and further action.
4. The owner: who is responsible for completing that action.
5. The review: the deadline and how completion will be checked.

This is a suggested reporting structure rather than a prescribed SRA form. Adapt it to the firm’s size, work and risks.

Use matter information to test the conclusions

Management should understand the basis for any assurance it receives. If a report says that risk assessments are complete, which files were checked? Were the assessments timely and meaningful? Were concerns followed up?

Similarly, an absence of recorded incidents may deserve further enquiry if staff are unsure how to raise concerns.

Our article on using law firm matter data for risk management explores how information from individual files can support wider management decisions.

CDDMonitor and AML management oversight

CDDMonitor provides AML solutions for law firms, including client and matter risk assessments, initial and ongoing monitoring, and management oversight.

Its relevance here is the AML information available to support review and follow-up. The firm should establish who reviews that information, who investigates concerns and how unresolved actions reach the appropriate decision-maker.

AML responsibilities also need to reflect the firm’s MLCO and MLRO arrangements where applicable. Those roles should be clearly distinguished from the COLP and COFA roles, even where one person holds more than one appointment.

Record management’s response

Reporting should lead to a recorded decision. Where management agrees additional training, revised procedures or further investigation, identify who will act and when progress will be reviewed.

Repeated findings may also require an update to the firm’s risk register. Our article on maintaining a living and breathing risk register explains why it should develop in response to experience.

For CQS-accredited practices, Lexsure’s CQS CPMS Risk Management Policy template can support the documentation of the firm’s arrangements. Adapt the wording to the way your practice actually operates.

Effective COLP and COFA reporting gives management a clear view of the risks, the evidence and the action required. Its value depends on what management does with that information.