Approved, Then Overtaken: A Revalidation Audit for Compliance Decisions Built on Old Assumptions

Every compliance approval is a photograph. It captures a judgement at a single moment, framed by the facts that were visible at the time: who owned the counterparty, which technology was in use, which customer segment was in scope, which rules applied, and how much risk the firm was willing to carry. The photograph does not age. The facts underneath it do.

This is not a story about dishonesty or incompetence. Most stale approvals were perfectly sound when granted. The difficulty is that nothing in the file announces the moment the basis of the decision quietly ceased to exist. The signature remains, the minute reads well, the committee paper is immaculate — and the decision it records may no longer be defensible.

For UK firms operating under Senior Managers and Certification Regime expectations, the Consumer Duty's annual assessment cycle, the Money Laundering Regulations 2017 duty of ongoing monitoring, and UK GDPR accountability provisions, this is an increasingly awkward gap. Regulators are less interested in whether a decision was once reasonable than in whether anyone has tested it since.

How an approval goes stale

Decay happens through three distinct mechanisms, and they require different responses.

• Factual drift. The ownership structure changes, the sub-processor is swapped, the transaction volumes triple, the customer base shifts towards a more vulnerable cohort, the key individual leaves.
• Rule drift. The regulatory perimeter moves, guidance is revised, a new obligation is layered on top of an existing permission, or a previously permitted arrangement becomes notify-only.
• Appetite drift. The board's risk tolerance tightens after a sector-wide incident, and an exposure once considered acceptable is no longer within tolerance — even though nothing about the arrangement itself has changed.

Only the first of these is usually caught by a periodic review cycle. The second is caught by regulatory change teams. The third is frequently caught by nobody.

What an invalid decision actually looks like

Invalidity here is rarely dramatic. It is not a forged signature or a breach of delegated authority. It is a decision whose stated basis no longer exists — for example:

• An outsourcing approval granted when the supplier ran the process in-house, now delivered through a fourth party in a different jurisdiction.
• A customer risk rating founded on beneficial ownership that has since been restructured through an intermediate holding company.
• An AI model approval issued for version 2, with version 4 now in production.
• A delegated authority given to a named role, with the role now vacant and the decisions taken by an interim.
• A product approval scoped for retail distribution, where the customer mix has drifted towards cohorts the original assessment never contemplated.

In each case the approval remains on file, unamended and apparently live.

Step one: inventory the assumptions, not the approvals

Most firms can list their approvals. Far fewer can list the assumptions those approvals rested on. The audit starts with the second list.

Take a representative sample of decisions carrying regulatory consequence and read each approval paper for factual assertions that did real work in the reasoning: ownership and jurisdiction, volumes and materiality, technology and version, counterparty identity, staff competence and resourcing, the applicable permission, and the risk appetite statement in force at the time.

For each, apply a simple test: could this sentence be false today without anyone having had to amend the approval? If yes, it belongs in the decision log as an assumption line, with an owner, a source of truth, and a date last verified.

Step two: define the triggers that force revalidation

Assumption lines are only useful if something causes them to be re-tested. Set out trigger classes explicitly rather than relying on annual review to catch everything.

Two disciplines matter here. First, triggers must be owned by someone whose day job generates the signal — procurement, HR, technology change management — not only by the compliance function. Second, the trigger must produce a dated entry in the log, even where the outcome is a simple reaffirmation.

Step three: tier the testing effort

Not every approval warrants the same intensity. Tier decisions by consequence and reversibility: a decision that is difficult to unwind, or that sits close to a regulated permission, earns frequent testing; a low-materiality internal approval can be handled by light-touch attestation.

A workable structure is three tiers — event-driven plus annual for the highest consequence decisions, an eighteen-month cycle for the middle band, and a two-year attestation for the remainder. The tiers should be visible to the board so that any later reclassification is itself a recorded decision.

Step four: build a log that answers the question the regulator will ask

The question is seldom "when did you approve this?" It is "when did you last satisfy yourself that it was still the right answer?"

A decision log designed for that question carries, at minimum: decision reference; date and decision maker, with the authority basis cited; the assumptions relied upon; the evidence held at the time; the trigger set attached; date of last revalidation; date of next scheduled revalidation; the outcome; and the name of the person who attested.

Kept in this form, the log becomes a living record of judgement rather than a filing convention. It also exposes the pattern the regulator cares about most: whether revalidation produces any change.

Step five: make withdrawal a normal outcome

Revalidation should yield one of three results — reaffirm, amend with conditions, or withdraw and remediate. A log in which every decision is reaffirmed, year after year, is not evidence of stability. It is evidence of a process that is not genuinely testing anything.

Firms should therefore report the mix of outcomes to the relevant committee, alongside the count of overdue revalidations. Encouraging managers to record a withdrawal as a control working correctly, rather than as an admission of failure, is the cultural precondition for the rest of the exercise.

Common failure modes

• Bulk attestation. Hundreds of approvals confirmed on the same afternoon by the same individual, with no evidence of consideration.
• Confusing revalidation with policy review. Reviewing the framework document is not the same as testing whether a specific decision still holds.
• Over-logging. Capturing every minor approval dilutes attention; restrict the log to decisions with regulatory consequence.
• Missing informal approvals. Decisions taken by email or messaging platform must enter the same log, or the inventory will be quietly incomplete.
• No source of truth. An assumption line without an identifiable owner and data source cannot be verified and will be skipped under pressure.

A thirty-day starting sequence

Week one: select the twenty approvals with the greatest regulatory consequence. Week two: extract assumption lines from each and assign owners. Week three: agree trigger definitions and tiers with the relevant business owners. Week four: revalidate the highest-consequence cohort and take the results — including any withdrawals — to the risk or audit committee.

That sequence will not produce a complete inventory, but it will produce something more valuable: a demonstrated capability to notice when an approval has been overtaken by events.

The expiry date on an approval is not printed on the front of the paper. It is printed in the assumptions, and it becomes visible only when someone goes looking for it.