The Second Filing Cabinet: Auditing Compliance Records That Never Reached the Register

Compliance functions rarely operate on a single, tidy record set. Alongside the approved register, the case management system and the formal committee pack, there is usually a second layer: a spreadsheet maintained by one team, a shared-drive log inherited from a previous manager, a mailbox folder of approvals, a local tracker for complaints or training. These records are not necessarily evidence of bad faith. They often fill a gap, speed up a process or reflect the way a business unit actually works. But when a regulator, auditor or litigant asks for the record, that second layer can become a liability. The official file may be complete in form yet incomplete in substance.

A shadow-records audit is not a purge. It is an evidence exercise. The objective is to understand what exists outside the official record, test its relationship to that record, and make a documented decision about its future. For UK firms operating under FCA or PRA expectations, the Senior Managers and Certification Regime, UK GDPR and the Data Protection Act 2018, the question is not whether informal records exist. It is whether the firm can account for them.

Why shadow records persist

Shadow records usually emerge for understandable reasons. The official system may be slow, poorly configured or inaccessible to the people who need it. A team may need a local view that the central platform cannot provide. A process may have changed faster than the record architecture. In other cases, the cause is less benign: unclear ownership, weak records management, a desire to avoid scrutiny, or simple habit.

Whatever the cause, the compliance risk is similar. A decision may be evidenced only in an unofficial file. A retention rule may be bypassed because the record sits on a personal drive. A version may be overwritten with no audit trail. An individual may leave, taking the key to the spreadsheet with them. The official record then tells a partial story, and the firm has to explain the gap under pressure.

Begin with an inventory, not a clear-out

The first step is to establish scope. That means identifying the business areas, systems and repositories where compliance-related records are likely to sit. Include shared drives, collaboration platforms, local endpoints, email folders, case management tools and any software-as-a-service products used by teams without central oversight. Do not limit the exercise to formal compliance functions. Fraud, complaints, vendor management, HR and finance often hold records that touch regulatory obligations.

Ask staff what they use. A short, confidential questionnaire is more effective than a speculative IT search, though both have a role. The aim is to produce a record inventory: what the record is, who owns it, where it lives, what format it takes, how long it is kept and who can access it. Avoid turning the exercise into a blame process. People will not disclose workarounds if disclosure is treated as an admission.

Apply three tests: contradiction, completion and duplication

Once the inventory exists, test each material shadow record against the official file. Three tests are useful.

The contradiction test asks whether the shadow record conflicts with the official record on a point that matters: a date, an approval, a risk rating, a decision, a notification. If the official file says a matter was approved in March and the local tracker says it remained pending until May, that is a finding. It may be a recording error. It may be a control failure. Either way, it needs resolution.

The completion test asks whether the shadow record contains material information that the official file lacks. A local complaints log may record a customer vulnerability flag that never reached the central case file. A vendor tracker may show a due diligence step that is absent from the procurement record. If the shadow record completes the official record, the official record is incomplete.

The duplication test asks whether the same content is being maintained in two places. Duplication is not automatically a problem, but it creates version risk. The audit should identify which record is authoritative and why.

Decide what to migrate, retire or preserve

Every material shadow record needs a disposition decision. There are three broad options.

Migration is appropriate where the record contains material information that should form part of the official record. Migration must be controlled. Copying a spreadsheet into a shared drive is not migration. The transfer should preserve metadata, provenance and access controls, and it should create an audit trail. The receiving system should be able to demonstrate who changed what, when and why.

Retirement is appropriate where the record is redundant, superseded or not a record at all. Retirement should follow the firm's retention policy and be documented. Silent deletion is not acceptable, particularly where a legal hold, investigation or regulatory inquiry is foreseeable. A short disposition note explaining the rationale is prudent.

Preservation is appropriate where the record may be relevant to a dispute, investigation, regulator request or litigation. In those cases, apply a legal hold and preserve the record in place or through a forensically sound process. Do not allow routine deletion to continue.

The governance gap behind the spreadsheet

A shadow-records audit will usually reveal a control weakness, not just a filing problem. If teams maintain local trackers because the official system is unusable, the fix is system design. If records sit on personal drives because ownership is unclear, the fix is accountability. If retention is ignored because no one has read the policy, the fix is training and monitoring.

The audit should therefore feed the wider compliance operating model. Record owners should be named. The records management policy should reflect how the business actually works. Retention schedules should be applied consistently. Access controls should be reviewed. The firm should be able to show that it has considered the risk and taken proportionate action.

A short sequence for UK teams

A practical audit can be run in six stages: sponsor and scope the exercise; inventory the shadow records; classify them by risk and materiality; apply the contradiction, completion and duplication tests; agree a disposition plan with legal, records management and the business; and report findings to the appropriate committee with a remediation plan. The report should distinguish between records that were migrated, retired or preserved, and it should identify the root causes that allowed shadow records to persist.

Regulators do not expect perfection. They do expect a firm to know what records it holds, to be able to produce them, and to explain any gap between the official file and the operational reality. The spreadsheet under the desk is not the problem by itself. The problem is discovering it only when someone else asks for it.