When a file scores Amber: escalate, remediate, or re-review?

What does an amber score actually mean?

Amber sits between pass and fail in a file-review rubric: the file misses one or more criteria without meeting the fail threshold. Regarding file review amber findings, the grade itself is only half the output — the useful half is the line-level citation naming the criterion the file missed and where. A suitability report carries a clear recommendation and still scores amber when the comparative reasoning behind it never reached the page — the evidence the suitability standard in COBS 9.2.1R anchors.

PRIN 2A requires firms to act to deliver good outcomes across the four outcome areas, so an amber criterion is an outcome the file cannot yet evidence. FG22/5, the FCA's final non-Handbook guidance for the Duty, frames the expectation as identifying and acting on risks to good outcomes — which makes every amber a work item with an owner, not a comment to file.

An unevidenced criterion is an unevidenced outcome. (Source: FCA PRIN 2A)

Which three types of amber finding matter?

Documentation gaps lead the list. The advice process happened and the file fails to show it: a missing comparative illustration, an attitude-to-risk discussion recorded without the resulting risk profile, an ongoing-service conversation that left no trace. The fix lives in the record.

Client-harm ambers sit one level down. The file shows a risk to the client's outcome: vulnerability indicators visible in the notes but absent from the recommendation, a solution whose cost was never weighed against its benefit, a review date passed in silence. Regarding Consumer Duty outcomes, these are the ambers that connect a single file to the outcomes the Duty regulates.

Pattern ambers complete the set. The same criterion scoring amber across several files in a sample points at a process or an adviser habit rather than a one-off slip. Pattern findings belong at firm level, where sampling, training and rubric changes live — the individual file is the symptom, the process is the finding.

Which route fits which amber: escalate, remediate, or re-review?

The route follows the finding type. Remediation without re-review leaves the loop open; re-review without remediation simply re-confirms the amber. The mapping below sets out the three routes and the record each one leaves.

Table: Three amber types, the route each calls for, and the record each leaves.

Regarding amber triage, the discipline sits in the fourth column: every route ends in a record, because the record is what turns a graded file into evidence of a functioning review process. A documentation gap closes with a completed record and a fresh score. A client-harm amber closes with a decision taken above the adviser's desk. A pattern amber closes with a process change and a line in the outcomes report.

When does an amber need escalation rather than a fix?

Client-harm signals share one feature: the risk sits with the client, not the paperwork. Regarding vulnerability, FG21/1 — the FCA's guidance on the fair treatment of vulnerable customers — expects firms to identify characteristics of vulnerability and record the support offered. A file where the life event sits in the meeting notes but never reaches the recommendation fails that expectation, even where the recommendation itself holds up.

Ongoing-service ambers run close behind. A review overdue with no record of contact sits against PRIN 2A.6, and the FCA's file-level work on retirement income advice (TR24/1 para 1.40) shows the kind of ongoing-service evidence it examines. Escalation, in a 1–5 adviser firm, means the finding moves to whoever owns compliance — often the owner-director — with a dated note of the decision and any client contact that follows. Where a client later questions the advice, FOS decides on the file in front of it, the context behind its 'acted fairly' reform work.

Vulnerability awareness without a record is invisible to a reviewer. (Source: FCA FG21/1)

How does re-review close the loop?

Re-review means the corrected file goes back through the same rubric at the same version. Rubric versioning matters here: an original amber scored against version 3 and a re-review scored against version 4 is not a like-for-like comparison, and the evidence trail loses its clean line. The complete trail holds four items — the original score with its citations, the remediation note saying what changed, the re-review score, and the date of each step.

Two ambers on the same criterion tell a different story from one. Regarding outcomes monitoring, re-review rates and repeat-amber counts are metrics in their own right: they show whether remediation works and where it stalls. A file that returns amber twice on the same criterion has stopped being a documentation gap and started being a pattern, which routes it back to the escalation column of the table above.

A loop left open is a finding that never closes. (Source: FCA FG22/5)

What does the amber trail need to show?

Amber counts feed the firm-level picture: findings by type, by adviser, by rubric criterion, and the route each one took. Regarding proportionality, CP26/23 — the FCA's June 2026 consultation on tailoring the Duty — recognises that smaller firms scale their approach, but scaling the machinery is not the same as deleting the record. A sole-trader firm needs a shorter trail than a larger firm; both need a trail.

The trail answers three questions file sampling asks: did the firm find the issue, did it decide what to do, and did the fix land. Files showing all three steps demonstrate a review process that works; files showing only scores demonstrate a grading exercise. Regarding file review amber findings, the difference between the two is the difference between evidence and decoration.

Proportionality scales the machinery, not the record. (Source: FCA CP26/23)

About the Author: Nick Thorp is the founder of Proven Duty, where he builds AI compliance tooling for UK advice firms and writes about what Consumer Duty means at file level.