What are the signs that a financial services communications policy is not working?

Common warning signs include employees using personal devices, unapproved messaging apps, incomplete retention of texts or voice records, weak training coverage, and gaps in supervisory review. If a firm cannot recover messages or prove it can preserve regulated records, the policy is not operating as intended and enforcement exposure is already building.

How to tell the policy has drifted out of control

A communications policy is failing when the firm’s actual message handling no longer matches the rules on paper. The clearest signals are workarounds that become routine, such as personal devices for business messages, unapproved chat channels, and exceptions that are never closed. At that point, the policy is not shaping behaviour, it is only documenting it.

For financial services firms, the practical test is whether regulated communications can be captured, supervised, and produced on demand. If supervisors can only review a fraction of the traffic, or if employees can bypass approved channels without detection, the policy has lost operational authority even if training materials still exist.

Policy drift often starts with convenience and ends with recordkeeping failure. Once staff view the approved workflow as slow, incomplete, or easy to evade, they route around it. That creates a gap between intended controls and actual communications handling, which is exactly where enforcement exposure and eDiscovery failure begin to build.

What a broken policy looks like in day-to-day operations

The most visible sign is inconsistent channel use. Employees may move client discussions to text, WhatsApp, personal email, or voice notes when the approved system is unavailable or cumbersome. Another sign is weak retention behaviour, where messages are not archived, deleted too early, or stored in places the firm cannot search or supervise.

Coverage gaps in training and supervision are also strong indicators. If staff cannot explain which channels are allowed, managers cannot demonstrate review of those channels, or exceptions are handled ad hoc, the policy is not embedded in the operating model. In practice, that means the firm has a policy statement but not a functioning control.

Where communications are part of a regulated record, DORA raises the stakes by tying communication handling to operational resilience, third-party dependence, and incident readiness. If the firm cannot preserve records through normal failure conditions, the control is fragile, not merely incomplete.

Why preservation and supervision failures matter more than policy language

The real failure mode is loss of evidence. If the firm cannot reconstruct what was said, when it was said, and through which account or device, it cannot prove supervision, retention, or escalation controls are working. That makes the policy difficult to defend and even harder to improve because the firm lacks operational evidence.

In financial services, this is not just a process issue. It can affect conduct surveillance, complaints handling, investigations, and regulatory response. PCI DSS v4.0 is a useful comparator for this discipline because it treats access boundaries, account use, and controlled handling of system interactions as security requirements, not optional administration.

If the organisation relies on third-party messaging platforms or unmanaged devices, the policy also inherits retention, export, and supervision risks outside its direct control. That is where a communications policy stops being a simple conduct document and becomes part of the firm’s broader control stack for records, oversight, and resilience.

What to check before you decide the policy is actually working

First, test whether the firm can recover a complete message set for a real user, desk, or case without manual reconstruction. Second, test whether exceptions are visible, approved, and time-bound rather than informal and permanent. Third, verify that supervisors review the channels employees actually use, not just the channels the policy prefers.

It is also worth checking whether training evidence matches behavioural evidence. A high training completion rate does not mean the policy works if users still default to unapproved tools. The stronger sign is a measurable decline in off-channel use, paired with preserved records and actionable supervisory review.

NIST Cybersecurity Framework 2.0 helps frame the issue as governance, protection, detection, and recovery working together. When any one of those is missing, the policy may exist, but the control system is not complete.

Risk and Threat Considerations

The main risk is that off-channel communications become unreviewable, unrecoverable, or impossible to evidence during an investigation, dispute, or regulator inquiry. That creates exposure not only from non-compliance, but also from hidden conduct issues, poor supervision, and weak incident reconstruction.

Failure mechanism: Employees bypass approved channels, retention fails, or supervision does not cover the channels in use, so the firm loses visibility into regulated communications and cannot prove control operation.

Impact: The firm faces recordkeeping gaps, weak evidentiary posture, delayed remediation, and higher enforcement exposure because it cannot demonstrate that communications are preserved and reviewed as required.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8 and NIST CSF 2.0 set the technical controls, while DORA and ISO/IEC 27001:2022 define the regulatory obligations.

Framework	Control / Reference	Relevance
DORA	Digital operational resilience and ICT risk management	Financial communications controls depend on resilient record capture and supervision.
Recommendation — Map communications capture and retention to ICT resilience and incident-readiness requirements.
CIS Controls v8	CIS-8 — Audit Log Management	Message preservation and supervisory review depend on complete, reviewable records.
Recommendation — Centralise and retain communication logs so reviews and investigations can reconstruct events.
NIST CSF 2.0	GV.OC-01 — Organizational Context	Communications policy failure is a governance issue tied to regulated business operations.
	PR.DS-04 — Logs are protected against unauthorized access, modification, and deletion	Preserved messages and records must remain intact for supervision and evidence.
Recommendation — Define communications-record obligations in the organisation’s governance and operating context. Protect message archives from deletion, alteration, and unauthorised access.
ISO/IEC 27001:2022	A.5.33 — Protection of records	The policy must preserve regulated communications as records that remain available.
Recommendation — Classify, retain, and protect communications records according to legal and business requirements.

Practitioner Guidance

What to prioritise: Test the policy against actual communication behaviour, not policy acknowledgements. The first question is whether the firm can recover a complete, supervised record set for the channels employees really use.

What to verify: Check whether exceptions, retention, and surveillance are tied to enforceable controls. If an approved workflow cannot capture, archive, and review a message end to end, the policy needs control redesign, not more training alone.

Practitioner takeaway: A communications policy is working only when the firm can prove it governs real behaviour, preserves the record, and supports supervision under pressure, not when it simply describes the preferred process.