Ticks Without Traces: Turning the Compliance Calendar into an Evidence File

Most UK compliance functions run on a calendar. Reviews are scheduled, owners are named, colours change from amber to green, and the board pack reports that the control environment is operating. The difficulty arises when a regulator, auditor or internal challenge function asks a simpler question: show me the file. At that point, a calendar entry is not evidence of a review. It is evidence of a diary commitment.

That distinction matters more in 2026 than it did when compliance calendars were largely administrative tools. Regulated firms now operate in an environment where supervisory questions are more granular, where senior managers are expected to demonstrate reasonable steps, and where board attestations can be tested against the underlying record. A calendar that says 'reviewed' while the file says nothing is not a control. It is a presentation risk.

The reassuring arithmetic of a full calendar

A well-maintained calendar has an attractive logic. It allocates responsibility, sets frequency, records completion and gives management a view of upcoming obligations. For routine tasks — filing deadlines, policy renewals, training cycles — that may be sufficient. The calendar is the trigger, and the associated output is usually obvious.

The problem is that many compliance activities are not routine tasks. They are judgements. A monthly monitoring review, a quarterly risk assessment refresh, an annual control self-assessment or a periodic review of regulated activity involves scope decisions, sampling, challenge and follow-up. A tick in a spreadsheet cannot capture any of that. Nor can it demonstrate that the person who ticked it had the competence, information or authority to do so.

This is where calendar theatre begins. The calendar becomes a performance of control rather than a record of it. The organisation looks organised. The paperwork looks current. But the substance has been replaced by the rhythm.

What a calendar entry can prove — and what it cannot

A calendar entry can prove that a review was expected. It can show who was nominated to conduct it, when it was due and whether someone marked it complete. It cannot, on its own, prove what was reviewed, what was found, what was decided or what changed as a result.

That gap is not necessarily dishonest. In many firms, the evidence exists somewhere — in an email chain, a shared drive, a meeting note or the memory of the person who did the work. The risk is that the evidence is not retrievable, not contemporaneous or not linked to the calendar item. When the regulator asks for the file, the firm is left reconstructing a review after the event. Reconstruction is not the same as evidence.

A four-question evidence test for recurring controls

For each scheduled control, the compliance team should apply a short test. First, is there a dated artefact that was produced at the time of the review, rather than assembled afterwards? Second, does it identify the reviewer and the capacity in which they acted? Third, does it record the scope, the information considered and, where relevant, the sample selected? Fourth, does it show the decision, challenge or follow-up that resulted?

If the answer to any of these is no, the calendar entry is doing more work than the evidence can support. That does not automatically mean the control failed. It means the firm cannot demonstrate that it operated. In a supervisory conversation, those are very different positions.

The attestation trap

Board and senior manager attestations often sit on top of a calendar. The senior manager signs that controls have been reviewed; the board notes that the compliance plan has been delivered. These attestations are valuable only if they are underpinned by evidence that the signatory could reasonably rely on.

A common weakness is the absence of a sub-certification trail. The senior manager attests at a high level, but no one below them has confirmed, in writing, that the underlying reviews were completed and evidenced. The attestation becomes an assertion about an assertion. A practical remedy is to require each control owner to provide a short evidence statement before the attestation is signed: what was reviewed, where the record is held, what exceptions were found and what remediation is open. The attestation then rests on a documented chain rather than on confidence.

Monitoring plans and the limits of memory

Monitoring plans are particularly exposed to this problem. A plan may list twelve reviews a year, with frequency, scope and owner. If the only output is a note that the review took place, the plan has become a schedule of intentions. The evidence should include the workpaper, the sample tested, the exceptions identified and the issue log entry where follow-up is required.

The same applies to committee minutes. A minute that records 'compliance update noted' may be accurate, but it does not show what the committee saw or challenged. Where a control depends on committee oversight, the minute should reference the paper considered and any decision taken. Otherwise the calendar proves that a meeting happened, not that oversight occurred.

Three forms of calendar theatre

The first is the recurring placeholder: a monthly or quarterly entry marked complete with no associated output. The second is retrospective clean-up: files populated shortly before an audit or supervisory visit, with dates that do not reflect when the work was actually done. The third is owner-dependent evidence: the review happened, but only the departing or unavailable owner knows where the record is.

Each can be addressed through simple operating disciplines. Every calendar entry should specify the required output and its storage location. Completion should not be possible until a link to the evidence is added. A sample of completed items should be checked each month for evidence quality, not just timeliness. And where a control owner leaves, their calendar items should be part of the handover checklist.

Rebuilding the calendar as an evidence system

The practical fix is not to abandon the calendar. It is to redesign it around evidence hooks. For each entry, record the required artefact, the reviewer, the retention period and the review standard. Add a short post-completion check, ideally within five working days, to confirm that the evidence is present and legible. Report to the board not only on completion rates but on evidence completeness.

A thirty-day audit can test the current position. Select the highest-risk recurring controls, request the underlying file for the last two cycles, and score each against the four-question test. The output should be a short exceptions report: which controls are evidenced, which are assertion-only and which require remediation. That report is more useful to a senior manager than another green calendar.

The diary defence only works if the diary is supported by the file. A compliance calendar is a useful map of obligations. It is not the territory. In 2026, UK firms should be able to show the regulator the territory — not simply point to the map.