The Grievance Signal: Turning Complaints into Board-Level Fraud and Conduct Intelligence
Photo: customer complaints data dashboard boardroom risk reporting, via cdn1.faroutmagazine.co.uk
Most UK businesses underuse complaints. The log is cleaned, categorised and closed, then reported as a volume. That is a missed opportunity. Complaints are unsolicited evidence. They arrive before the regulator, before the ombudsman and often before the fraud loss is fully understood. In 2026, with the Consumer Duty embedding expectations of good outcomes and with fraud and financial promotions under sustained scrutiny, complaints should be treated as compliance data, not just customer service data.
The problem with volume-only reporting
Counting complaints tells the board little. A rise may mean worse service, better recording or a new scam. A fall may mean improvement or suppression. Volume without theme, severity and root cause is noise. The board needs to know what customers are complaining about, which obligations are engaged, whether the same failure is recurring and what has changed as a result.
Mapping complaint themes to obligations
Start with a taxonomy that reflects the business, not the call centre. For each complaint, record the customer journey stage, the product or channel, the alleged harm and the conduct theme. Then map the theme to the relevant obligation. A complaint about a misleading promotion may engage financial promotion rules and the Consumer Duty. A complaint about an unauthorised transaction may engage fraud controls, reimbursement rules and operational resilience. A complaint about a safety issue may engage product safety and recall obligations. The mapping does not need to be perfect; it needs to be consistent enough to reveal patterns.
Use a simple matrix: theme, obligation, frequency, severity, trend, owner. Review it monthly. If the same theme appears across products or channels, that is a signal of a systemic issue rather than a series of individual errors.
Spotting repeat root causes
Complaint handling often stops at resolution. The customer is satisfied, the case is closed, the file is archived. Compliance should ask why. Use a root cause method such as the five whys or a cause-and-effect review. Was the customer given the wrong information? Was the script misleading? Was the fraud check too weak? Was the product design flawed? Look for repeat causes, not just repeat complaints. A root cause that appears in three different complaint themes is a control failure.
Track the time between the first complaint and the control change. A long lag is a risk in itself. Regulators are interested in whether the business identified the issue, escalated it and fixed it within a reasonable period.
A concise board reporting pack
The board does not need a 40-page complaints report. It needs a one-page dashboard and a short narrative. Include total complaints and trend; top five themes by volume and severity; mapping to regulatory obligations; repeat root causes; remediation actions and owners; overdue actions; and a small number of anonymised case studies that illustrate the issue. Use RAG ratings with definitions. Show what has changed since the last report.
Add a section on listening. What did the business do with customer feedback beyond resolving the individual case? Did it change a script, a product term, a training module or a control? The pack should demonstrate a loop: complaint, analysis, action, verification. That loop is what regulators mean by listening, learning and acting.
Making the pack regulator-ready
Regulators do not expect zero complaints. They expect evidence of effective oversight. Minutes should show that the board or committee challenged the data, asked about root causes and approved actions. The pack should be consistent with other management information, such as fraud losses and breach logs. If complaints about unauthorised transactions are rising but the fraud report shows no change, one of the two is wrong. Reconcile them.
Common failures
Four failures recur. First, complaints are owned by customer service and never reach compliance. Second, the taxonomy is too generic to reveal conduct themes. Third, root cause analysis is replaced by a resolution note. Fourth, the board sees volume but not the regulatory mapping. Each failure can be fixed, but only if complaints are treated as a risk source rather than a service metric.
Complaints are not noise. They are the customer's early warning system. In 2026, a UK business that can show it maps grievances to obligations, finds repeat root causes and reports them clearly to the board has a stronger compliance story than one that simply reports a falling complaint count. The grievance signal is there. The question is whether the business is listening.
