The Decision Was Made in a Chat: Auditing Informal Compliance Approvals Before the Record Disappears

In many UK firms the official compliance record is no longer the first place a decision appears. It is often the last. A customer due diligence escalation is resolved in a Teams thread. A policy exception is agreed on a call and confirmed with a thumbs-up. A risk acceptance is discussed in WhatsApp because the matter is urgent. Months later the file may show an approval, but not the reasoning, conditions or challenge that made it defensible.

That gap matters. Regulators, auditors, litigants and successors need to understand not only what was decided but who decided it, on what authority and why. The audit below is designed to test evidential resilience, not to eliminate informal communication. Chat is a legitimate coordination tool. The problem arises when coordination becomes decision-making without a record.

Why informal channels deserve attention in 2026

Hybrid and distributed working have pushed compliance judgements into the same tools staff use for everything else. Teams, Slack, WhatsApp, SMS, calls and corridor conversations all carry fragments of decisions. Many of those fragments are appropriate. But compliance judgements carry record-keeping expectations. Firms subject to FCA or PRA requirements, and those in legal, accountancy and other regulated sectors, should expect to demonstrate who approved what, when and on what basis. Data protection adds a further dimension: personal devices and consumer messaging apps create UK GDPR risks that should be assessed before messages are exported or monitored.

The decision types to include are familiar: risk acceptances and exceptions, customer due diligence and enhanced due diligence judgements, onboarding overrides, complaint outcomes, breach triage, vendor approvals and policy waivers. Each can be made informally. Each can be difficult to reconstruct later.

Scoping the audit

Start by defining the decision universe. Interview team leads and compliance staff about where decisions actually happen. Map approved and unapproved channels. Include calls, but recognise that a call without a note or follow-up summary is a weak record. Set a sample period, typically six to twelve months, and take legal and privacy advice before exporting employee communications. Document the scope and its limitations. The aim is not a perfect census. It is a defensible sample that shows where evidence is strong and where it fails.

Two-way sampling

Use two directions of travel. First, take closed decisions from the official record and trace backwards to the chat, call or side channel where the discussion took place. Second, export approved channels and sample threads containing decision language such as approve, sign off, exception, accept, go ahead or happy with. Include calendar invites and call notes where available. Sample across risk levels and business areas. A practical starting point is 25 to 50 decisions, weighted towards higher-risk judgements. Record how each decision was found and whether the official file pointed to the informal discussion.

The reconstruction test

For each sampled decision, give a reviewer who was not involved 15 minutes with the official file and any captured messages. Ask a simple set of questions. What was decided? Who was accountable, and under what authority? What information was considered? What conditions, caveats or review dates were set? Was there challenge or dissent? Where is the evidence? Score the result as fully reconstructable, partially reconstructable or not reconstructable. A decision that cannot be reconstructed without the original participants is an unrecorded compliance judgement, even if someone remembers it. The test should be repeated after a desk swap or staff absence to expose reliance on memory.

Failure patterns to look for

Several patterns recur. Chat may be used to coordinate, while the decision is made verbally and never summarised. Approval may be given by emoji or a single word without context. A decision may be split across threads and direct messages. Personal WhatsApp may be used for firm business, leaving no export. Retention settings may delete channels before the record retention period ends. The official system may record the outcome but not the rationale. Multiple decision-makers may leave no named accountable owner.

These are not necessarily misconduct. They are evidence failures. Treat them as control failures, because that is how a regulator or auditor will see them if the file cannot explain the judgement.

Remediation: approved-channel rules

Do not simply ban chat. Staff will move to less visible channels. Instead define which channels may be used for which decision types. Substantive compliance approvals should occur in a retained, exportable system. Teams channels can be approved if retention and eDiscovery are configured. Personal WhatsApp should not be used for firm decisions. Calls should have a note or follow-up summary. Make the rules practical: state where a decision must be recorded, not just where chat is forbidden.

Decision-capture prompts

Build prompts into the workflow. When a chat contains decision language, or when a case is closed, prompt for the decision and decision-maker, the authority or delegation, the rationale and information considered, any conditions and review date, and a link to the evidence. Use a short template. The aim is a 60-second capture, not an essay. For high-risk decisions, require a record before the action is taken. For lower-risk decisions, allow a summary within one business day.

Retention, export and privacy

Review retention schedules. Ensure approved channels retain messages for the period required by your regulatory and legal obligations. Configure legal hold. Address personal devices and UK GDPR: minimise personal data, define permitted use and avoid exporting more than necessary. Take advice on employment and data protection issues before monitoring or exporting employee communications.

Board-level reporting template

Report the audit quarterly. Use a simple table with columns for decision type, number sampled, fully reconstructable, partially reconstructable, not reconstructable, main themes, risk rating, action owner and due date. Add a headline metric: the number of unrecorded compliance judgements identified. The board should see the trend, not just a one-off count. Where the trend is flat or worsening, ask whether the approved-channel rules and capture prompts are working.

Conclusion

The chat is not the file, but it is often where the decision starts. A 2026 audit should test whether the organisation can reconstruct informal approvals without relying on memory. Where it cannot, the fix is not a ban on messaging. It is a clearer rule about where decisions live, a faster way to capture them, and board reporting that treats unrecorded judgements as a control risk.