COLP and COFA duties in a small firm: what the role actually requires

Every SRA-authorised firm must have a Compliance Officer for Legal Practice (COLP) and a Compliance Officer for Finance and Administration (COFA), both approved by the SRA (rule 8.1 of the SRA Authorisation of Firms Rules). In a small firm one person often holds both roles, alongside a caseload and a share of the business.

What the COLP must do

Paragraph 9.1 of the SRA Code of Conduct for Firms requires the COLP to take all reasonable steps to:

• ensure compliance with the terms and conditions of the firm's authorisation
• ensure the firm, its managers, employees and interest holders comply with the SRA's regulatory arrangements that apply to them
• ensure managers, interest holders and those they employ or contract with do not cause or substantially contribute to a breach
• ensure a prompt report is made to the SRA of facts or matters the COLP reasonably believes are capable of amounting to a serious breach
• ensure the SRA is told promptly of anything else it should know in order to investigate whether a serious breach has occurred or to exercise its powers

Those duties exclude matters that paragraph 9.2 gives to the COFA.

What the COFA must do

Paragraph 9.2 requires the COFA to take all reasonable steps to ensure the firm, its managers and employees comply with the SRA Accounts Rules, and to report serious breaches of those rules promptly in the same way. Day to day, that includes the client account reconciliation in rule 8.3 of the Accounts Rules: at least every five weeks, the bank statement balance reconciled with the cash book balance and the client ledger total, with a record signed off by the COFA or a manager, and any differences promptly investigated and resolved.

Keep a record of every breach, not just the serious ones

Record all breaches. Report promptly where the reporting threshold is met, which includes facts or matters you reasonably believe are capable of amounting to a serious breach. You do not have to prove a serious breach has happened before you report, and there is a separate duty to tell the SRA about matters it should know so it can investigate or use its powers. In its December 2025 thematic review of compliance officers it said that, because a firm must keep records demonstrating compliance (paragraph 2.2 of the Code for Firms), it expects compliance officers to keep a record of all breaches that occur. Those records let you spot patterns, and they are your evidence when you decide something did not need reporting. The SRA's reporting guidance says you should be prepared to show how you reached a decision whether or not to report.

What the SRA found about the role

The same review, based on visits to 25 firms and 36 compliance officers, found that:

• every compliance officer held at least one other role in the firm, and nearly half named lack of time as their main challenge
• 41% of firms kept only partial records of their compliance officers' decisions, often missing the circumstances of a breach or the reason for the remedial action
• 44% of firms had no deputy compliance officer, leaving them reliant on one person

Making the role workable in a small firm

• Put compliance time in the diary as protected time, not whatever is left after fee earning.
• Name a deputy who knows where everything is, as operational cover. That does not replace the SRA-approved COLP or COFA: if a role holder changes, the new one needs SRA approval.
• Keep one breach and incident log with the date, what happened, who decided, whether it was reported and why.
• Make sure the MLCO and the COLP see the same picture, especially where they are different people.
• Keep your own training record for the role.
• Review the firm's policies when the rules change, not just on the anniversary. See policy version control.

If the firm does work within the Money Laundering Regulations, the COLP will usually sit close to AML compliance too. Our guides on preparing for an SRA AML inspection and the firm-wide risk assessment cover that side.

One place for the evidence

ComplianceMinder gives the COLP one place for the evidence the role depends on: registers, breach and incident logging, a review chain from the MLCO to the COLP, and a compliance dashboard. Policies are versioned with a reason and director approval for every change, and staff training records update automatically.

See how ComplianceMinder works or book a walkthrough.