COLP and COFA: Roles, Responsibilities, and Reporting

Every SRA-authorised firm in England and Wales must appoint a Compliance Officer for Legal Practice (COLP) and a Compliance Officer for Finance and Administration (COFA). These are not optional titles. The SRA must approve both appointments before they take effect, and both officers carry personal regulatory responsibility for their areas of oversight.

This guide explains how the two roles work in practice, what happens when things go wrong, and how to handle your annual reporting obligations. If you are setting up a new firm, being appointed as a COLP or COFA, or reviewing whether your current arrangements are adequate, this guide will help you understand the scope of the roles and the systems you need to support them.

What the COLP does

The COLP is responsible for ensuring that the firm, its managers, and its employees comply with the terms and conditions of the firm's authorisation and with the SRA's regulatory arrangements. In practice, this means the COLP:

• Monitors compliance with the SRA Principles, the Code of Conduct for Firms, and the Code of Conduct for Solicitors
• Maintains a breach register recording every failure to comply, however minor
• Assesses whether each recorded breach is material (requiring prompt SRA reporting) or non-material (recorded internally and reviewed for patterns)
• Reports material breaches to the SRA as soon as reasonably practicable
• Oversees the firm's systems for conflict checking, supervision, complaints handling, and training
• Reviews the breach register at least quarterly to identify trends and systemic risks

What the COFA does

The COFA is responsible for ensuring compliance with the SRA Accounts Rules 2019. This covers all handling of client money. In practice, the COFA:

• Ensures client account reconciliations are completed at least every five weeks
• Monitors that client money is kept separate from office money at all times
• Maintains a breach register for all failures to comply with the Accounts Rules
• Reports material breaches to the SRA promptly
• Oversees the annual accountant's report process and liaises with the reporting accountant
• Ensures residual balances are returned to clients or paid to charity promptly

Who can be appointed

The COLP must be a lawyer (solicitor, REL, or other authorised person) who is a manager or employee of the firm. The COFA must be a manager or employee but does not have to be legally qualified. Both must:

• Be individuals of suitable seniority and experience to carry out the role effectively
• Have access to all the firm's files, systems, and financial records
• Be approved by the SRA before taking up the role (apply via mySRA)

In smaller firms, one person can hold both roles, but you should consider whether that person realistically has time and expertise for both. In sole practices, the sole practitioner is usually both COLP and COFA by default, but approval is still required.

Record keeping obligations

Both officers must maintain detailed records. The SRA does not prescribe a format, but your records should be clear enough for an external reviewer to understand what happened, when, and what action was taken. As a minimum, each breach register entry should include:

• Date the breach was identified
• Description of the breach and the relevant rule or standard
• Whether it is categorised as material or non-material
• Root cause analysis (what went wrong and why)
• Remedial action taken
• Date the breach was reported to the SRA (if material)
• Outcome and any follow-up required

Keep these records for at least six years. They form the evidential basis for your annual declarations and for any SRA investigation.

Annual reporting to the SRA

Each year, as part of the firm's renewal, the COLP and COFA must submit annual declarations via mySRA. These declarations confirm whether there have been any material compliance failures during the year. The SRA uses these declarations as a risk indicator. If you declare a material breach, expect the SRA to make further enquiries.

Prepare for the annual declaration by:

• Reviewing the breach registers in full before the declaration deadline
• Discussing any borderline breaches with the firm's management to agree the correct categorisation
• Confirming that all material breaches reported during the year have been resolved or are being actively managed
• Ensuring the firm's compliance and risk records are up to date

Managing non-compliance within your firm

When a breach occurs, the compliance officer's role is to record, assess, and manage the response. The following approach helps maintain a proportionate and defensible process:

• Investigate promptly: Establish the facts before deciding on categorisation. Speak to the individuals involved and review the relevant files.
• Categorise honestly: The temptation to classify everything as "non-material" is risky. If the SRA later discovers an unreported material breach, the consequences for the compliance officer are significantly worse than if it had been reported promptly.
• Take remedial action: Fix the immediate problem, then address the systemic cause. If the breach arose because a system failed, update the system. If it arose because of individual conduct, address it through supervision or disciplinary procedures.
• Report when required: Material breaches must be reported to the SRA as soon as reasonably practicable. There is no fixed deadline, but days rather than weeks is the SRA's expectation.

Escalation procedures

Not every issue can be resolved at the compliance officer level. You should have a clear escalation path:

• Routine matters: The compliance officer records the breach and manages the response within their authority
• Significant matters: Escalate to the managing partner or management board before reporting to the SRA
• Matters involving the compliance officer themselves: Escalate to the senior partner or another designated person. The firm must have a plan for this scenario.
• Matters involving the firm's viability: If a breach threatens the firm's authorisation or solvency, involve all managers immediately and take independent legal advice if needed

How this connects to your wider compliance framework

The COLP and COFA roles do not operate in isolation. They sit at the centre of your firm's compliance framework and connect to:

• Risk management: The breach registers feed into the firm's overall risk register. Patterns in breaches may indicate systemic weaknesses in training, supervision, or systems.
• Professional indemnity insurance: Your insurer may ask about compliance failures at renewal. Accurate breach records help you provide truthful and complete disclosure.
• Regulatory inspections: If the SRA conducts a desk-based review or a visit, the compliance officer's records will be the first thing they examine.
• Succession planning: If a COLP or COFA leaves or becomes incapacitated, you must apply to the SRA to approve a replacement promptly. Have a deputy arrangement in place.