How to document vulnerability in a suitability report: one paragraph that converts an invisible judgement into evidence

The cheapest compliance upgrade available to a small advice firm is one standard paragraph in every suitability report.

What the FCA says about documenting vulnerability

Under the Consumer Duty, firms must act to deliver good outcomes for vulnerable customers. The FCA's Consumer Duty pages set out that expectation in the cross-cutting rules and the vulnerability-specific guidance that sits alongside them. The file is where a reviewer checks whether the firm acted: if the consideration is not recorded, the regulator and the client have no way to see it.

Record-keeping gaps appear repeatedly in the FCA's Enforcement Watch series \u2014 firms that could not show what was considered or decided because the note was never written. A standard paragraph is the low-cost answer to that failure.

“Vulnerability assessment: the following characteristics were considered [list]. No indicators of vulnerability were identified / [indicators] were identified and the following adjustments were made [list].”

That is it. Considered, checked, outcome, reasoning.

It converts an invisible judgement into documented evidence — which is the entire difference when a reviewer reads the file cold.

The FCA's own reviews keep finding the same gap: not that advisers are not thinking about vulnerability, but that the thinking never makes it into the file. This paragraph closes that gap.

Worked example: the paragraph that passes a cold read

The same client, two files. Anonymised and illustrative.

Before

“Client is not vulnerable.” — nothing else. No characteristics listed, no reasoning, no record that any check happened.

After

“Vulnerability assessment: characteristics considered — health, life events, resilience, capability. No indicators identified following review of the client's circumstances at the annual review on [date]. To be reassessed at the next review.” One paragraph, complete, reviewable.

Common mistakes when writing the paragraph

The bare denial. “Not vulnerable” with no characteristics checked and no reasoning. It states a conclusion with nothing behind it.
The outcome without the check. Recording the result but not what was considered, so the audit trail of the assessment is missing.
Written once, never revisited. A client's circumstances change; the paragraph is reassessed at the next review, not left frozen at the point of sale.
Ruling out without looking. A conclusion with no basis in the file reads as an assertion, not an assessment.

The paragraph, element by element

Element	What it records	If it is missing
Characteristics checked	The drivers considered — health, life events, resilience, capability.	No record that any check happened.
Outcome	Indicators identified or ruled out.	The conclusion is invisible.
Reasoning	Why, grounded in the client's stated circumstances.	Reads as an assertion rather than an assessment.
Adjustments	What changed if indicators were found — communication, charges, reviews.	The response to the vulnerability is unrecorded.

Frequently asked questions

Do I need to write the paragraph for every client?

Yes. The check and its outcome are documented even when nothing is found. A file with no vulnerability line reads as no consideration at all, which is the gap reviews keep finding.

What if no indicators are identified?

Record the characteristics checked and the outcome. “Considered and ruled out” with the drivers listed is evidence; an omission is not.

Does identifying vulnerability change the advice?

Not necessarily the recommendation. The process adjusts — communication, timing, charges, review frequency — and the file records the adjustment.

Your next step

Add the paragraph to the next suitability report you write — considered, checked, outcome, reasoning — and let it become the firm's default. Start a free trial or see pricing.