Last reviewed 27 September 2026
Businesses usually look at compliance in one of two situations: something has prompted concern, such as an incident, a complaint or a letter from a regulator, or the business is growing, launching a product or preparing for investment and wants to be confident its practices are sound.
A compliance review brings the relevant rules and the business's actual practices side by side so that gaps can be identified and addressed in a sensible order. It can be broad, or focused on one area such as health and safety, marketing or data protection.
This guide explains the usual stages in general terms. It is general information only and not legal advice on the rules that apply to your business.
Scoping the review
The first step is agreeing what the review covers. That means identifying the business activities involved, the sectors and products concerned, and the regimes that are likely to apply. Regulation depends heavily on what a business actually does, so an accurate description of operations matters more than the business's label or sector name.
A clear scope also sets expectations about depth. A high level health check is different from a detailed audit of one process, and each suits different circumstances.
Gathering information
The review then collects the relevant material: written policies and procedures, risk assessments, training records, incident logs, contracts with key suppliers, published marketing and product information, and any past correspondence with regulators. Short interviews with the people who run the processes day to day often reveal how things work in practice rather than on paper.
Where policies exist but are not followed, or practices exist but are not written down, both are useful findings.
Identifying and assessing gaps
Each area is compared against the relevant requirements. Gaps are then assessed by likely impact and likelihood: a missing document may be quick to fix, while a process that exposes people to harm or breaches a clear legal duty needs urgent attention.
The result is usually a written summary of findings, grouped by area, with an explanation of why each point matters. It should be understandable by the people who will have to act on it, not just by lawyers.
Prioritising and implementing actions
A practical action plan assigns each item an owner and a target date, starting with the highest risks. Typical actions include updating policies, improving records, training staff, amending contracts or marketing copy, and putting reporting lines in place so problems reach the right people quickly.
Where the review uncovers something that may need to be reported to a regulator, or that is already the subject of an investigation, the approach should be discussed carefully before any external communication.
Keeping compliance under review
Rules change and businesses change. Scheduling periodic reviews, and revisiting compliance whenever the business launches a product, enters a new market or changes a key process, helps prevent gaps reopening.
Keeping a record of the review and the actions taken also helps show that the business took its obligations seriously if questions are ever raised.
Key points
- Start by scoping which activities and regimes the review covers.
- Collect written policies and check how processes run in practice.
- Assess gaps by impact and likelihood, then prioritise.
- Give every action an owner and a target date.
- Review again whenever the business or the rules change.
Frequently asked questions
- Do we need a compliance review if nothing has gone wrong?
- Many businesses carry one out proactively, for example before growth or investment, because identifying gaps early is usually simpler than dealing with them after a problem.
- Will a review tell us every rule that applies?
- A review covers the activities and regimes agreed in its scope. That is why describing the business accurately at the start is so important.
- What if the review finds a serious problem?
- Serious findings should be prioritised, and any question of reporting to a regulator should be considered carefully before external communication.
- Is this guide legal advice?
- No. It is general information about how compliance reviews commonly work in England and Wales and is not advice for your business.