Why you get audited
A credit licensee has to supervise the people who act under its licence. Section 47 of the National Consumer Credit Protection Act 2009 (NCCP Act) requires a licensee to take reasonable steps to ensure its representatives comply with the credit legislation. For the best interests duty there is a specific version: s 158LE(2) and s 158LF(2) require the licensee to take reasonable steps to ensure its credit representatives comply with the duty and the conflict priority rule. ASIC's RG 273.21 says broker records help licensees meet that obligation.
File reviews are how that supervision happens. If you are a credit representative, your aggregator or licensee reviews you. If you hold your own licence, your aggregator agreement will usually still give it audit rights, and you are also expected to monitor your own business. Lenders run their own checks on submitted applications as well.
Every aggregator has its own audit program, sample size and scoring. What follows is the common core, built from the NCCP Act and ASIC's guidance, because that is what every program is testing against. Always check your own aggregator's compliance manual for the local rules.
What a file review checks
1. Credit guide
Section 113 requires a credit assistance provider to give the client a credit guide as soon as practicable after it becomes apparent that credit assistance is likely to be provided. Credit representatives have their own credit guide obligation under s 158. The reviewer looks for the current version on file and evidence of when it was given. ASIC lists a copy of the credit guide among the records it expects brokers to keep (RG 273.165(b)).
2. Credit quote
Under s 114 you must not provide credit assistance unless you have given the client a quote, and the client has signed and dated it or otherwise indicated acceptance and the date. Reviewers check the quote exists and that its date comes before the credit assistance. Many aggregators combine the credit guide and quote into one document.
3. Preliminary assessment
Before providing credit assistance you must make a preliminary assessment that the contract is not unsuitable (ss 115 and 116), having made reasonable inquiries about the client's requirements and objectives and financial situation and taken reasonable steps to verify the financial situation (s 117). Section 118 sets out when a contract must be assessed as unsuitable. Under s 120 the client can ask for a written copy of the assessment for up to seven years after the date of the quote. You have 7 business days to provide it if they ask in the first two years, and 21 business days after that.
Reviewers check that the assessment is on file, dated before the application was submitted, covers the loan that was really applied for, and records specific requirements and objectives. If the loan amount, product or structure changed along the way, they look for an updated assessment.
4. Credit proposal disclosure
Section 121 requires a credit proposal disclosure document (CPD) to be given at the same time as you provide the credit assistance. It sets out the fees the client pays you, a reasonable estimate of the commissions you or your licensee are likely to receive, and fees payable to others such as referrers. Reviewers check the CPD is on file, dated correctly, names the right lender and loan amount, and that commission figures are filled in.
5. Verification evidence
The inquiry is what the client told you. The verification is what you checked it against. Reviewers look for payslips, tax returns, bank statements, liability statements and ID on file, dated within the lender's acceptable window. They then compare those documents to the figures in the fact find and the application. Unexplained differences between the payslip and the declared income, or between bank statements and declared living expenses, are a standard finding. The explanation belongs in a file note.
6. Best interests duty reasoning
Under s 158LA (s 158LE for credit representatives) you must act in the client's best interests, and under s 158LB (s 158LF) you must put the client first where there is a conflict. RG 273.165 sets out the records ASIC expects, including the options and recommendation you gave "and the reasons why (including a detailed description of your decision-making process)" and any conflict you identified and how you handled it.
Reviewers check for a product comparison on file, a shortlist, a recommendation, and reasons that connect the recommendation to what this client said they wanted. Where the recommended loan is not the cheapest on the comparison, they look for the explanation RG 273.54 asks for. On a refi they look for switching costs. We go through this in detail in best interests duty file notes for mortgage brokers.
7. File notes of every client contact
ASIC expects records of "relevant conversations with the consumer" (RG 273.165(e)) and names file notes as an accepted form of record (RG 273.167(b)). In practice, aggregator reviews expect a note for every substantive contact: the first meeting, the recommendation discussion, any change to the loan, lender queries that needed client input, approval, and settlement. The reviewer reads the notes in date order and expects them to tell the story of the file without needing you in the room.
How file notes get marked down
| Finding | What the reviewer sees | Fix |
|---|---|---|
| Missing contact | Emails refer to a phone call and there is no note of it | One note per substantive contact, even if short |
| Generic objectives | "Wants competitive rate and flexibility" on every file | Specific, ranked priorities in the client's words |
| No reasoning | Recommendation recorded with no reasons | Two sentences linking the client's priorities to this product over the others |
| Unexplained cost gap | Comparison report shows a cheaper loan, note is silent | Record the non-cost reason and tie it to a client need (RG 273.54) |
| Dates out of order | Note or assessment dated after submission | Write notes on the day, and if late, date them honestly as written later |
| Note does not match the application | Note says $650k P&I, application is $680k IO | A change note explaining what changed, why, and that the assessment was redone |
| Figures not reconciled | Declared expenses differ from statements with no comment | Note the discrepancy, the question asked and the client's answer |
| No conflict check | Related party or white label product recommended, nothing recorded | Record the relationship and why the client still came first (RG 273.160) |
| Client went against advice, not recorded | Product chosen differs from the recommendation | Record what you presented, the risks explained and the client's instruction (RG 273.104) |
| Editable, undated notes | Free text in a CRM field with no author or timestamp | Dated, attributed notes that are locked once complete |
| Identical notes | The same paragraphs pasted across different clients | Templates for headings only. The content has to come from the conversation |
Full audit-readiness checklist
| Area | On file and correct? | Source |
|---|---|---|
| Credit guide | Current version, evidence of date given, before or at first substantive contact | NCCP Act s 113 (s 158 for credit reps) |
| Credit quote | Signed or accepted and dated by the client before credit assistance | s 114 |
| Privacy consent and ID | Signed consent, ID verified to your aggregator's and lenders' standard | Aggregator and lender policy |
| Fact find | Complete, dated, all borrowers covered, no blank sections | s 117 inquiries |
| Requirements and objectives | Specific to this client, ranked, consistent with file notes | s 117(1)(a) |
| Financial situation | Income, expenses, assets and liabilities recorded for all borrowers | s 117(1)(b) |
| Verification documents | Payslips, statements, liability evidence, in date, matching declared figures or differences explained | s 117(1)(c) |
| Preliminary assessment | Dated before submission, covers the actual loan, concludes not unsuitable, updated if the loan changed | ss 115, 116, 118 |
| Product comparison | Output from comparison software saved to file with the date run | RG 273.167(e) |
| BID reasoning | Shortlist, recommendation, reasons, cost position, refi switching costs where relevant | s 158LA, RG 273.165(g) |
| Conflicts | Any related party or remuneration conflict recorded with how the client was prioritised, or a line that none was identified | s 158LB, RG 273.165(h) |
| Credit proposal disclosure | Given with the credit assistance, correct lender, amount, fees and commission estimates | s 121 |
| File notes | One per substantive contact, dated, attributed, in order, consistent with the application | RG 273.165(e), 273.169 |
| Changes during the deal | Note explaining each change to amount, product, structure or borrowers | RG 273.121 |
| Application and lender correspondence | Copy of what was submitted, lender queries and your responses | RG 273.165(c) |
| Outcome | Approval, decline or withdrawal recorded, with reasons for any decline | RG 273.165(d) |
| Settlement and post-settlement | Settlement confirmed, client contacted, any follow-up promised is diarised | Aggregator policy |
| Retention | Whole file retrievable for at least 7 years, longer where your licensee requires | s 120, RG 273.168 |
Two free tools cover the note-specific parts of this list. The file note audit readiness checker scores how well a note would hold up to a cold read. The NCCP file note compliance checklist walks through the responsible lending content item by item.
What a note that passes looks like
An invented example of a mid-deal change note, the type most often missing from files:
- What changed
The valuation came in at $815,000, against our estimate of $850,000. On a $680,000 loan, the loan-to-value ratio (LVR) is now 83%, so lenders mortgage insurance (LMI) would apply.
- Options discussed
- 1. Reduce the loan to $652,000. That brings the LVR to 80%. The clients add $28,000 from savings and avoid LMI.
- 2. Keep the loan at $680,000 and pay LMI. Estimated cost quoted from the lender's calculator and saved to the file.
- 3. Order a valuation from a second lender. This delays things by about a week. Finance date is 18 July.
- Clients' reasoning
Aisha: "We would rather use the savings than pay LMI, we still have the buffer." Confirmed they will have about $31,000 in savings after settlement, which still meets the 3-month buffer they asked for.
- What stays the same
First home buyers, owner-occupied, principal and interest. Same lender and product, so the original best interests reasoning still stands. No new conflicts of interest.
- Assessment redone
Preliminary assessment updated on 9 July for the $652,000 loan. The loan is still not unsuitable, and they can meet repayments more comfortably than before.
- Clients' decision
Tom and Aisha told us to go ahead with option 1.
- Next steps
- Send the updated credit proposal disclosure to the clients today.
- Send the revised application to the lender today.
It is dated, it names who was on the call, it shows the options, it has the client's reasoning in her words, it records that the assessment and disclosure were redone, and it matches what the application will now say. A reviewer can tick it in thirty seconds.
How to fix a backlog
Most brokers who fail on file notes have the same problem. The conversations happened, the notes did not get written, and an audit notice has arrived. Here is a sound way through it.
- Stop the backlog growing first. From today, every substantive client contact gets a note the same day. Clearing old files while new ones pile up does not work.
- Sort the old files by risk. Start with files in progress, then recent settlements, then anything with a refi, cash-out, debt consolidation, interest-only, a higher-cost recommendation, a related party product, or a client in any kind of hardship or complaint.
- Rebuild from sources, not from memory. Emails, SMS, calendar entries, CRM activity logs, call logs, lender messages and any call or meeting transcripts you already hold all carry dates and detail. Build each note from them and reference the source.
- Date late notes honestly. Head the note with the date of the conversation and the date you wrote it, for example "Note of phone call on 14 March, written 22 September from emails of 14 and 15 March and a calendar entry". Never backdate. ASIC's RG 273.169 is clear that contemporaneous notes are more effective, but an honest late note is a legitimate record. A backdated one is a false record and will sink the whole file if it is found.
- Do not invent detail. If you cannot recall or source why a product was chosen, say what the file shows and stop there. A short accurate note beats a long speculative one.
- Fill document gaps separately. A missing credit guide or CPD cannot be fixed by a note. Record that it is missing, tell your aggregator if their policy requires it, and fix the process that let it happen.
- Tell your aggregator where you are at. Reviewers respond far better to a broker who has found the problem and has a plan than to one who hopes the sample misses it.
- Change the process so it does not recur. Book ten minutes after each appointment, or start each note from a transcript instead of a blank page.
Where CallNote fits
The backlog usually exists because a proper note takes ten to fifteen minutes by hand and the day does not have the gaps. CallNote is Australian software that turns a call or meeting transcript that already exists into a structured file note in about two minutes. It never records calls, never joins a meeting as a bot and never stores call audio. Transcripts come in by paste, by .vtt or .txt upload from Teams, Zoom or Meet, by email forward, or automatically from Dialpad or Aircall. For in-person meetings there is a voice memo option so you can dictate the note on the way back to the car.
There is a system template for NCCP and mortgage notes, or you can paste one of your own past notes and CallNote builds a template with your headings and shorthand. You review the draft, then publish it. A published note is sealed with a SHA-256 checksum and is immutable, amendments are append-only, and the audit log shows who did what and when. That answers the "editable, undated notes" finding directly. On a Team plan, owners and admins can see every broker's notes and members see only their own, which suits a principal doing internal file checks.
There is no native integration with Mercury, Salestrekker or other broker CRMs. Notes go across by copy and paste or PDF, and there are HubSpot, Notion, Slack and Zapier connections. Pricing is $149 a month Solo or $99 per seat a month for Team, in AUD, with a 14-day free trial and no credit card. More detail is on CallNote for mortgage brokers.
Common questions
What does a mortgage broker compliance audit check?
A file review checks that each sampled loan file has the credit guide (NCCP Act s 113), a signed and dated credit quote (s 114), a preliminary assessment made before credit assistance (ss 115 to 118), the credit proposal disclosure (s 121), verification documents that match the declared figures, best interests duty reasoning (s 158LA and ASIC RG 273), and dated file notes of client contact. Reviewers also check the dates run in the right order and the documents agree with each other.
Why do file notes fail a broker audit?
The common findings are missing notes for phone calls, generic objectives that read the same on every file, a recommendation with no reasons, a cheaper option on the comparison with no explanation, notes dated after submission, notes that do not match the final application, and undated free-text notes that anyone could have edited. Each one leaves a reviewer unable to see why the broker did what they did.
How many file notes should a loan file have?
There is no set number. ASIC's RG 273.165 expects records of relevant conversations with the consumer, and most aggregator programs expect a note for every substantive contact. For a typical file that means the first meeting, the recommendation discussion, any change to the loan, client input on lender queries, approval and settlement. Short notes are fine as long as each is dated and specific.
Can I write file notes after the audit notice arrives?
You can write late notes, as long as they are dated honestly with both the date of the conversation and the date written, and built from sources such as emails, calendar entries and CRM logs. Never backdate a note or alter an existing one. ASIC says contemporaneous notes are more effective (RG 273.169), so a late note carries less weight, but a backdated note is a false record and is far worse than a gap.
How long do brokers need to keep loan files for audit?
At least seven years is the practical minimum. Under s 120 of the NCCP Act a client can request a written copy of the preliminary assessment for up to seven years after the date of the credit quote. ASIC's RG 273.168 says how long best interests duty records should be kept may vary with the loan term, any interest-only period and whether the client refinances, and that short retention puts you at risk. Many licensees require longer.
Who audits a mortgage broker in Australia?
Usually the aggregator or licensee. A licensee must take reasonable steps to ensure its representatives comply with the credit legislation (NCCP Act s 47), including the best interests duty (s 158LE(2) and s 158LF(2)). File reviews are how that is done. Lenders also check applications, and ASIC can review records as the regulator. Brokers with their own licence are expected to monitor their own compliance as well.