Most brokerages only look closely at their files when something forces the issue — a complaint, a compliance review, a dispute. By then, any gap in the record has already happened and can't be fixed retroactively; all that's left is explaining why it's missing. A self-audit run on a regular schedule, before anything forces the issue, is the only way to actually catch and fix gaps while they're still fixable.
This checklist is built around what Ontario's regulator, FSRA, has published directly about record-keeping and supervision expectations for the mortgage brokering sector — not a generic compliance template. It's written for principal brokers and brokerages running their own quarterly review, but the same logic applies to any mortgage professional keeping their own file discipline sharp between formal reviews.
Why self-audit before the regulator does
FSRA is explicit that record-keeping is about more than proving a deal should be funded — it's about proving why a recommendation was suitable for that specific client. As FSRA puts it directly, if a brokerage's files can't be “re-performed” by another broker using only the documentation on file, the underlying record isn't complete, regardless of how many documents are technically present.
A self-audit run on a schedule, rather than only when circumstances force a closer look, catches this gap while it's still fixable — on a live or recently closed file, when the reasoning is still fresh and easy to document — rather than months or years later when a complaint or examination forces a reconstruction.
The standard to test against: if another broker or agent picked up this file cold, could they explain the recommendation without asking you anything? If not, the file has a gap worth closing now.
Check 1. What a complete client file contains
Beyond the mortgage application and supporting income documents, a complete file needs to show the decision-making narrative — not just that documents were collected, but how and why they led to the specific recommendation made.
| Component | What it should show |
|---|---|
| Application & supporting documents | The standard income, ID, and deal-specific paperwork for the client's employment and deal type |
| Disclosures | The required cost-of-borrowing and other disclosure statements, provided in the format the brokerage has adopted |
| Consents | Documented client consent for credit report access and any other data collection specific to the file |
| Suitability notes | A narrative — not just a form — explaining why the recommended product fits this client's specific circumstances |
| Correspondence | Relevant emails, call summaries, and text messages that show the story of the transaction from first contact through funding |
| Outsourced work records | Clear documentation of what was done by any third party (see Check 4) and by whom |
Every one of these components should tell a consistent story when read together — a suitability note that doesn't match the income documented elsewhere in the file, or correspondence that contradicts the application, is exactly the kind of inconsistency an audit exists to catch.
Check 2. The quarterly self-audit ritual
- 01Pull a random sample of files closed in the quarter — enough to be representative, weighted toward more complex deal types where gaps are more likely.
- 02Score each file against the components in Check 1, marking each as complete, partial, or missing.
- 03Pay particular attention to the suitability narrative — this is consistently the component FSRA flags as most often underdone.
- 04Note any recurring gap across multiple files — a single missed item is a file problem, a repeated one is a process problem.
- 05Bring findings to a short remediation review with whoever handled the flagged files, focused on fixing the process going forward, not assigning blame for the past.
- 06Document that the audit itself happened — the review process is itself a piece of the compliance record a brokerage should be able to show.
Check 3. Common gaps found in self-audits
Without inventing specific figures, a few gap patterns show up consistently enough across brokerages to be worth checking for deliberately in every audit cycle, rather than waiting to notice them by accident.
- →Suitability documented as a form, not a narrative — know-your-client information collected, but no explanation of how it led to the specific product recommendation.
- →Correspondence gaps — key conversations happened by phone or text and were never summarized into the file.
- →Personal email use without a retention plan — correspondence sent from a personal account that the brokerage can't reliably access if the broker or agent later leaves.
- →Outsourced or third-party work left undocumented — a file processed with outside help, without a clear record of what that help actually did.
Check 4. Documenting outsourced work on a file
When any part of a file's processing is handled by a party outside the brokerage — a fulfillment provider, a processing assistant, an external document-collection service — the file should still show, clearly, who did what and when. The brokerage's supervisory obligation doesn't transfer just because the task did.
A short, standard note in the file — identifying the outsourced party, the specific tasks performed, and confirming the Principal Broker or supervising broker reviewed the resulting work — closes this gap with very little extra effort. This is exactly the kind of documentation FSRA's supervision guidance points toward: a policies and procedures manual that accounts for how every broker and agent's work, including work performed by third parties on the brokerage's behalf, is actually supervised.
The rule of thumb: if a file went through hands outside the brokerage at any point, the file itself should say so, plainly, in one place.
Check 5. Fixing gaps forward, not just flagging them
An audit that only produces a list of problems, without a specific fix for each recurring one, tends to find the same gaps again next quarter. Each recurring gap identified in Check 3 should map to one specific process change — a new checklist item, a template addition, a short training note — not just a reminder to “be more thorough.”
Record retention matters here too: under FSRA's guidance, mortgage transaction records generally need to be kept for six years past the expiry of the transaction (or six years from creation, for files that don't result in a completed deal), so any gap-fixing process should also confirm retention and access controls are actually being followed, not just the content of the files themselves. Run this checklist alongside the 27-point pre-submission checklist for the completeness side of the same discipline, and see FSRA Compliance for Mortgage Agents for the broader regulatory picture this checklist sits inside.