Consumer Duty file reviews and suitability evidence: the complete guide

File reviews are where Consumer Duty evidence is made or missed. TheCOBS 9 and 9A checks — suitability reasoning, vulnerability consideration, cost disclosure, alternatives, capacity for loss — are the spine of a defensible file.

The guides at a glance

File review and suitability guides and what each covers
Guide	What it covers
12-point checklist	The twelve pre-send checks, mapped to the FCA rules.
FCA expectations	The eleven rubric check areas, mapped to COBS 9 and 9A.
Report template	The 12 report sections and what each must prove.
ATR vs capacity	The distinction files routinely get wrong.
Annual review	The six sections that keep the annual review defensible.
Anonymisation	Strip client data before using AI — in five minutes.
Methodology evidence	One page that answers 'show me your methodology'.
Ongoing service record	What to log per client, every year.
AI file review tools	What AI tools check — and what they can't.

The 12-point checklist is the pre-send gate. The templates, methodology evidence, and anonymisation guides are the tools that make the evidence exist.

For a buyer's-eye view of the category, see AI file review tools for UK advice firms.

What the FCA says about suitability and file reviews

The suitability rules live in COBS 9 of the FCA Handbook: a firm must take reasonable steps to ensure a personal recommendation is suitable, which means assessing the client's objectives, financial situation, knowledge and experience, risk appetite and capacity for loss, and recommending only where it is suitable. COBS 9A applies the same duty to ongoing service arrangements, so the checks apply to reviews and annual suitability updates as much as to the original recommendation. The FCA's Consumer Duty pages explain how the duty layers on top of those rules, and the Consumer Duty publications library carries the FCA's guidance on suitability, file reviews, and outcomes — including the good and poor practice firms are expected to learn from.

Two things are worth noting about how the FCA applies those rules in file work. First, it reviews files as a reviewer would read them cold: if the evidence is not in the file, it does not exist. Second, the suitability report is the centrepiece — it is the document where the reasoning, the disclosure, and the checks are meant to meet. What the FCA expects in a suitability report reads the rules back as a report structure.

What the checks mean at file level

At file level, the COBS 9 and 9A checks reduce to six evidence points. A reviewer scans for all six in order; a firm that has them has a defensible file, whichever way the review started.

Suitability reasoning. The rationale references the client's objectives and explains the recommendation in their circumstances.
Client circumstances. Facts, needs, and constraints recorded — including vulnerability consideration under FG21/1.
Risk and capacity for loss. Both, separately, and the connection to the recommendation. ATR vs capacity for loss explains the difference and why conflating the two is a common fail.
Cost disclosure. Total cost in pounds, initial and ongoing, explained. The suitability report template shows where the disclosure sits.
Alternatives. What else was considered, and why this product at this cost.
Ongoing service record. What the client receives for an ongoing charge, dated. See the ongoing-service record guide and the annual suitability review for the review-time version.

Worked example: the rationale that carries the file

Before

“Recommended due to consistent performance and low charges.” — no link to the client's circumstances, no risk assessment, no capacity-for-loss check, no alternatives.

After

“Client objectives: income starting in five years, capital preservation priority. Risk profile 4 of 10 confirmed by risk questionnaire; capacity for loss assessed at £15,000 per the cashflow cash-reserve test. Recommendation: multi-asset income fund at 0.55% ongoing charge, total first-year cost £1,100. Alternatives considered: gilt ladder (yield too low for the income need) and annuity purchase (the annuity's offered income fell short of the need). Planning risk disclosed and illustrated with downside scenario.” — every check answered with evidence, in one paragraph.

The before version would not survive a review; the after version answers the reviewer's questions before they are asked. The Consumer Duty file-review checklist is the pre-send gate that turns one into the other.

Common mistakes in file reviews

Reviewing for compliance, not for the client. A file with every disclosure ticked can still fail on suitability if the recommendation does not fit the client's circumstances.
No record of the review itself. The review needs its own evidence: who reviewed, when, against what methodology, and what follow-up happened. How to evidence your file-review methodology covers this artefact directly.
Conflating attitude to risk and capacity for loss. An appetite for risk is not the same as the ability to absorb a loss. Files that treat them as one check fail the risk-disclosure test.
Reviewing without anonymisation discipline. Client data moving through a review process needs protection. The anonymisation guide takes two minutes per file and keeps every other check intact.
Fixing findings without logging them. The fix that is not recorded is the finding that comes back next quarter — and the theme that the board summary should have shown.

The file-review checklist at a glance

Check area	Evidence to find
Suitability reasoning	Rationale tied to objectives and circumstances
Client circumstances	Facts and needs recorded, vulnerability considered
Risk and capacity for loss	Both assessed, separately, and disclosed
Cost disclosure	Total cost in pounds, initial and ongoing
Alternatives	Options considered and the comparison recorded
Ongoing service record	What was delivered against the ongoing charge

The full scoring version — twelve checks with pass and fail criteria — is the 12-point Consumer Duty file-review checklist.

Frequently asked questions

What is the difference between the COBS 9 and COBS 9A checks?

COBS 9 covers the suitability of advice — assessing the client's objectives, circumstances, risk profile, and capacity for loss, and making a suitable recommendation. COBS 9A applies the same suitability duty to firms with an ongoing service arrangement, so it is the section that governs reviews and ongoing suitability. Both matter when a file is reviewed.

How many checks does a file review need to cover?

There is no fixed number set by the FCA; what matters is that the review covers the areas the suitability rules require — suitability reasoning, client circumstances, risk and capacity for loss, cost disclosure, alternatives, and ongoing service. Our 12-point checklist turns those rules into a review you can run the same way on every file.

What makes a file 'fail' a Consumer Duty review?

In practice it is usually an evidence gap rather than a wrong recommendation: a rationale that does not reference the client's objectives, risk disclosure missing, costs not stated in pounds, no alternatives considered, or an ongoing charge with no service log. Those are the flags a reviewer looks for first.

Do we need to review every file every year?

The review scope is a firm decision that has to be defensible. Many firms review every file on an ongoing cycle; others review on a documented sample basis with full reviews at key trigger points. The methodology — what you review, how you score, and what you do with the results — is part of the file-review evidence the FCA would expect to see.

Your next step

Run the 12-point checklist on one recent file before it goes out. The checks that fail on that file are the ones working across the client bank. Proven Duty scores every file against this rubric automatically, flags the missing evidence at line level, and logs the result for the review trail. Start with a free trial or see pricing.