In short
A defensible governance record is one that lets a firm show, for any past date, who was responsible for an oversight decision, what information they had, what they decided and when the decision was reported upward. It is built from individually attributed, timestamped records of actual activity rather than periodic policy statements, and it survives challenge because it was created at the time of the decision, not reconstructed afterwards.
What defensible actually means in an evidential sense
A governance framework and a governance record are not the same thing. The framework is the policy: who is responsible, what committees exist, what gets escalated and to whom. The record is the proof that the framework operated as written on a specific date. Supervisory challenge is directed at the record, not the framework, because a policy document only ever describes intent.
Defensible, in this context, has a narrow meaning. It means that for a decision or action taken on a given date, the firm can produce a record showing who took it, what information was in front of them at the time, and what happened next, and that this record cannot plausibly have been altered after the fact to improve how it reads. It does not mean the decision was necessarily correct. A firm can be found to have made a poor judgement call and still have a defensible record of how that judgement was reached, which is a materially better position in a supervisory review than having made a reasonable decision with no record of how it was reached at all.
This is why the word to reach for is tamper-evident, or hash-sealed where cryptographic sealing is used, rather than any claim that a record cannot be changed. What matters to a regulator or auditor is that any alteration would be detectable, and that the record was created contemporaneously with the event it describes.
The named individual and what their record needs to show
CASS 15.2.4R requires a firm to allocate to a director or senior manager of sufficient skill, seniority and authority responsibility for oversight of the firm's compliance with the safeguarding regime and for reporting on that compliance to the firm's governing body. This is a rule about accountability, not a rule about paperwork, but the only way accountability survives a supervisory review is through the record of what that individual actually did.
In practice this means the individual's oversight activity needs to be visible as discrete, dated events: reviewing reconciliation results and exceptions, receiving and acting on breach escalations, approving corrective action, and reporting to the board. A governance record that shows only that this person holds the title, with no trail of oversight activity attributable to them individually, does not evidence that CASS 15.2.4R responsibility was actually discharged.
There is a related trap worth naming directly: no controlled function is prescribed for this role by the FCA. CF10a is a historic designation and SMF18 is not a specified mapping for safeguarding oversight under CASS 15. Firms should allocate the responsibility as the rule requires and evidence it accordingly, without assuming that a particular SMF holder automatically satisfies it by virtue of their other responsibilities.
What a governance record is built from
A governance record for client fund oversight is composed of several distinct types of entry, each attributable to an individual and timestamped at the point of action. Review entries, showing that reconciliation output, exception reports or breach notifications were actually looked at by a specific person. Decision entries, showing what was decided, including the reasoning where the decision was not simply to accept a recommendation. Escalation entries, showing when a matter was raised beyond the person who first identified it, to whom, and how quickly. And reporting entries, showing what was put in front of the governing body and when.
The chronological relationship between these entries is itself evidential. If a breach was detected on one date, escalated three days later and reported to the board a month after that, the record needs to show each step with its own timestamp so the interval at each stage can be examined. A single retrospective summary that states the breach was handled appropriately, without the underlying dated entries, gives a reviewer nothing to test.
Segregation of duties belongs in the same record. Where the person who performed a reconciliation is also shown as its sole reviewer, that is itself a finding, because the record needs to demonstrate that oversight was independent of execution, not merely that both steps occurred.
Attribution and retention are where records usually fail
Individual attribution is the most common weak point. Shared logins, team-level sign-off such as an approval attributed to compliance generally rather than a named person, and decisions recorded only in email threads or verbal conversations all produce the same failure: when a reviewer asks who specifically approved something on a specific date, the honest answer is that nobody can say with certainty. A record that cannot survive that question is not a governance record in any evidential sense, whatever the underlying decision-making was actually like.
Retention is the second common failure, and it has two components that are often conflated. The first is duration: safeguarding records generally need to be kept for several years, and firms should confirm the specific period under their applicable rulebook rather than assume a single figure applies across every record type. The second, less obvious component is retrievability. A record that technically still exists somewhere in an email archive or a decommissioned system, but cannot be produced within the timeframe a supervisory request demands, has not met the retention obligation in any practical sense.
The annual audit under SUP 3A.9.2R adds a further reason to get retention right. Since the auditor must opine on the whole period rather than a single date, gaps anywhere in the period, not just at the point of review, weaken the basis for that opinion. A retention policy that only guarantees the record most recently created is not sufficient for a rule built around the full period.
Board reporting as the output, not the record itself
Board and risk committee reporting is where the governance record becomes visible to people who did not do the underlying work, and it is tempting to treat the board pack as the governance record. It should not be treated that way. The board pack is a synthesis: current safeguarding status, exceptions and their resolution, breach frequency, and anything the governing body needs to decide. The underlying record is the set of dated, attributed entries that the synthesis is drawn from.
Keeping this distinction clear matters practically. If the board pack is produced from a separate manual exercise rather than generated from the underlying record, the two can drift apart, and a supervisory reviewer comparing what the board was told against what the underlying reconciliation and escalation records actually show will treat any disagreement as a records failure in itself. The safer design is a board pack that is a filtered view of the same record a regulator would eventually request, not a parallel document assembled from memory and spreadsheets shortly before the meeting.
How Safeheld builds the underlying record
Safeheld attributes every review, escalation, approval and board report to an individually authenticated user at the moment it happens, and stores each entry with a hash-sealed timestamp so that alteration after the fact would be detectable rather than assumed absent. Board packs are generated by filtering this same record to the relevant period, rather than compiled separately, which keeps the governance narrative and the underlying evidence aligned.
Frequently asked questions
Does CASS 15.2.4R require a specific controlled function to hold safeguarding oversight?
No. The rule requires allocation to a director or senior manager of sufficient skill and authority. No FCA controlled function is prescribed for this specifically; CF10a is historic and SMF18 is not a mapped safeguarding role under CASS 15.
What makes a governance record defensible rather than merely complete?
It must show individual attribution, a chronological trail of actual dated activity, and independence between execution and review, created at the time of the decision rather than reconstructed afterwards.
How does the SUP 3A audit affect what a governance record needs to cover?
SUP 3A.9.2R requires the auditor to opine on systems adequacy throughout the period, not just at the reporting date, so the record needs to support sampling at any point in the period, not only at its end.
Should the board pack be treated as the governance record itself?
No. The board pack is a synthesis for a non-specialist audience. The governance record is the underlying set of dated, individually attributed entries the synthesis is drawn from, and the two should stay traceable to each other.