Aggregator audit requests: prepare a broker-reviewed response pack

When an aggregator or licensee asks to review selected mortgage files, give your assistant the actual notice and a defined evidence-preparation task. Build a response index that connects every requested item to its source, an explicit gap or a separately dated explanation. Have a named broker review the response and an authorised owner approve the exact release copy.

This proposed workflow is for Australian brokerage owners delegating preparation after a review request arrives. It does not select an internal QA sample, conduct an independent audit or determine whether the underlying lending work complied with its obligations. The useful output is a traceable answer to this request, including what the brokerage cannot substantiate.

Start with the notice and name the decision owner

Keep the original notice in the approved record. Capture the requester, reference, selected files, numbered questions, requested period, response deadline and time zone, accepted format and submission route. If a file identifier is unclear, ask the broker to resolve it before retrieving another customer's documents. Preserve subsequent scope clarifications beside the original request.

My Local Broker's published audit process describes notifying participants, making brokers responsible for loading required documents and assessing questions against the evidence supplied. It also describes recording when supporting evidence is absent and following up corrective actions with brokers. This is one aggregator's process; use your own current notice rather than importing its timetable or upload instructions.

Assign three functions: a preparer who retrieves and indexes records; a broker who checks factual responses and explanations; and an authorised release owner who confirms disclosure scope, recipient and final pack. One person may hold the last two functions, but write down their name and approval. Identify the licensee or compliance contact for interpretation questions.

ASIC's RG 205 expects credit licensees to document their compliance measures and enable monitoring and the handling of breaches (RG 205.50 and 205.55). Its outsourcing guidance also expects suitable-provider selection, ongoing performance monitoring and action on provider failures (RG 205.47). Those expectations do not prescribe this response index or make an assistant the compliance decision-maker.

Preserve what the historical file actually contains

Work within the existing approved systems and records process. Record the source item, its original date, any available version or activity history, and when you retrieved it. An export date is not the date the original note was written. If the date or authorship cannot be established, say so.

Keep the historical item distinguishable from a working copy. Do not overwrite a note, change a timestamp, substitute a later document or reconstruct a signature to make the response appear complete. Use the document version-control method when identifying exact copies and their relationship to the original.

Record a missing item as “not located in the specified search” with the systems, search scope and search date. That is more precise than claiming the record never existed. It also does not establish whether the underlying action happened. The broker or compliance owner decides what further investigation and response are appropriate.

Use a request-to-evidence manifest

Create one row for each requested item and selected file. If one question covers several files, split the rows so an answer for one customer cannot silently stand in for another. The following fields form a proposed response manifest, not a regulator's prescribed form.

Audit response manifest fields

Field	What to record
Request identity	Notice reference, question number, exact requested item and selected file ID
Original source	Controlled location, record/version ID, author and recorded creation or receipt date, where available
Search result	Located, partly located or not located; searched systems, date and access limitations
Answer location	Exact attachment, page or record section answering the question
Later material	Separate explanation or remediation reference, actual preparation date, author and stated basis
Open gap	What the original evidence still does not establish; owner and next action
Review and release	Named broker's review, authorised release owner, approved pack version and approval time
Delivery and receipt	Approved destination, sent time, transfer reference, acknowledgement and any rejected item

Use neutral internal file IDs in the manifest and keep it with the controlled response pack. Put only the detail needed to locate and understand the response into each row. A row marked “located” describes retrieval, not an audit finding or assurance that the evidence is sufficient.

Work through a fictional three-item notice

Everything in this exercise is invented. Notice AUD-26-18 selects mock file F-214 and requests three items by 3 pm Sydney time on 16 October 2026:

1. The original needs-analysis record prepared on 4 September
2. The client's email agreeing to the changed loan amount on 9 September
3. The contemporaneous file note explaining the recommended loan term on 9 September

Assistant Alex prepares the manifest on 12 October. Broker Maya Chen is the named factual reviewer and, under this fictional brokerage's approved process, the authorised release owner. Maya refers any compliance interpretation to the nominated licensee contact. The fictional dates illustrate provenance and deadlines; they are not standard response periods.

Fictional response to notice AUD-26-18

Request	Evidence and gap	Response for Maya's review
1: Needs analysis	CRM F-214/document D-11, version 1, recorded 4 September. Retrieved 12 October; complete stored item located	Attachment E-01 identifies D-11. Maya checks that the copy matches the source and answers the requested item
2: Loan-amount email	No matching email found in the approved F-214 CRM correspondence and intake-mailbox search on 12 October	No evidence attachment. Record the search limitation and missing item; Maya owns further enquiries and the wording explaining the gap
3: Term-selection note	No contemporaneous note located in the specified CRM search. Maya prepares explanation X-03 on 13 October from her recollection	Label X-03 as a later explanation, with author, actual date and basis. Keep the absence of the requested original note explicit

The third row must not become “evidence complete” merely because X-03 exists. It answers with later material while retaining the original evidentiary gap. Maya's explanation identifies what she recalls and any uncertainty; Alex does not invent reasons or convert recollection into a dated September note. The external reviewer decides what weight to give the material.

If the missing email subsequently turns up, add its original source and date, the discovery date and a new pack version. Preserve the earlier “not located” search result and submission history. If the team instead changes its process for future loan-amount confirmations, record that separately as remediation; it is not evidence of the September email.

Release the reviewed copy, then prove what arrived

Before approving the fictional pack, Maya checks all three request rows, E-01, X-03 and the proposed covering response. Her approval identifies AUD-26-18 pack version 2, the permitted recipient and submission route. Alex checks that the prepared files match that approved list.

• Confirm the recipient and destination against the verified request and approved process
• Resolve questions about third-party information, disclosure authority or redaction with the responsible owner before transfer
• Keep any approved redacted copy traceable to its original; do not alter the retained source
• Check that links or attachments open through the approved route and contain the intended versions
• Escalate a blocked route or approaching deadline to the owner rather than using personal email or silently widening access

The support access-permissions matrix helps define retrieval and sending rights before assigning this work. A request arriving in the inbox should not itself expand the assistant's access or release authority.

Record submission separately from acknowledgement. In the exercise, the portal records a successful upload, but the reviewer later says X-03 is unreadable. Keep the delivery task open, route the issue to Maya and send the approved readable replacement with a fresh version and receipt reference. Close delivery when the requested acknowledgement confirms the intended pack was received; do not label that event “audit passed”.

Keep outstanding reviewer questions and any corrective actions assigned to their actual owners after delivery closes. For hiring, specify retrieval, indexing, factual checking and receipt follow-up as separate duties, with review boundaries. Discuss the evidence-preparation support your brokerage needs with Mortgage Talent, and identify separately who supplies compliance interpretation and authorises the response.