{"id":9,"date":"2026-09-18T17:38:14","date_gmt":"2026-09-18T16:38:14","guid":{"rendered":"https:\/\/www.inquilion.com\/insights\/?p=9"},"modified":"2026-09-18T17:55:22","modified_gmt":"2026-09-18T16:55:22","slug":"microsoft-365-fca-responsibility","status":"publish","type":"post","link":"https:\/\/www.inquilion.com\/insights\/microsoft-365-fca-responsibility","title":{"rendered":"Microsoft 365 and what the FCA expects you personally to have done about it"},"content":{"rendered":"

Ask the owner of a small FCA-regulated firm who looks after their Microsoft 365, sometimes called Office 365, and you will nearly always hear the same thing: our IT company handles that, or our in-house tech does.<\/p>\n

It is an honest answer, and for the day-to-day it is the right one. It just is not the answer the FCA is looking for. You can hand the running of Microsoft 365 to someone else. You cannot hand over the responsibility.<\/p>\n

Delivery goes to your IT company or in-house tech. Responsibility stays with you.<\/h2>\n

Your IT company or in-house tech decides who gets administrator rights, whether everyone has to use multi-factor authentication, who outside the firm can see client files, how long emails and documents are kept and whether you could get back up and running if something went wrong. That is what they are paid for, and they are usually good at it.<\/p>\n

But those settings are how your firm meets its own obligations: to keep its systems under control, to keep proper records and to carry on operating. The FCA writes those obligations for the firm. It does not write them for your IT company or your in-house tech.<\/p>\n

Here is the gap. The person carrying the responsibility is usually the one person who cannot see the settings. Most business owners have never looked at how their Microsoft 365 is set up. The IT contract, or the in-house job description, covers uptime and how quickly problems get fixed, not what the FCA expects. Nobody has asked the question, so nobody knows the answer.<\/p>\n

A simple example: if your system only keeps its record of who did what for a few months, and a complaint arrives in month seven, you cannot show what happened. Nobody chose that. It was just how it was set up, and it has been that way since day one.<\/p>\n

The regime puts your name on it<\/h2>\n

Under the Senior Managers and Certification Regime, that responsibility is yours personally. Every regulated firm has at least one senior manager, and in a small firm that is very often the owner. Three of the conduct rules apply. Take reasonable steps to make sure the business you are responsible for is controlled effectively. Take reasonable steps to make sure it complies with the rules. And where you delegate, delegate to the right person and keep an eye on how it is going.<\/p>\n

Behind those rules sits a legal duty. If the firm breaks a requirement in an area you were responsible for, the FCA can act against you personally unless you can show you took the steps someone in your position could reasonably be expected to take.<\/p>\n

Notice the wording: reasonable steps. Nobody expects you to be a technician. They expect you to be able to show what you did.<\/p>\n

Reasonable steps means something you can show<\/h2>\n

“Our IT company or in-house tech said it was fine” describes the delegation. It is not evidence that you kept an eye on it. In a lot of firms this is the file that is empty, not because anyone was careless but because nobody realised there was a file to keep.<\/p>\n

What fills it is a dated, independent check of your Microsoft 365 setup against the obligations that apply to your firm, repeated often enough to catch drift. People join and leave. Someone loosens a sharing setting to get a deal over the line and it never gets tightened again. A check from eighteen months ago tells you where you stood eighteen months ago. And it should be written so the person signing it can read it, not just the engineer who built it. This applies just as much when your tech sits in your own office. Nobody can independently check their own work.<\/p>\n

\"A<\/figure>\n

The FCA is not going to fine you for a setting. The exposure is the question that follows something else going wrong: a data incident, a complaint you cannot reconstruct, a supervisory visit. What did you do to satisfy yourself?<\/p>\n

If you are an Appointed Representative<\/h2>\n

The conduct rules apply to your Principal’s senior managers rather than to you directly. That does not make the question go away. Principals are expected to keep an eye on how their ARs control their systems, and your Microsoft 365 setup is one of the few things they cannot see without asking. Expect them to ask.<\/p>\n

What we do<\/h2>\n

Inquilion provides independent Microsoft 365 governance assurance. We look at your setup, compare it with what applies to your firm and write it up so a business owner can read it, sign it and file it. We do not run your IT, sell licences or fix what we find. That stays with your IT company or in-house tech, which is what keeps us independent.<\/p>\n

For small FCA-regulated firms, Inquilion Essentials gives you a monthly record of where your Microsoft 365 governance stands and a fuller annual review against the Handbook. If you want to know what your reasonable-steps file holds today, the first conversation is short.<\/p>\n

For reference<\/h2>\n
    \n
  • Principle 3: organise and control your affairs responsibly and effectively.<\/li>\n
  • SYSC 4.1.1R: control and safeguard arrangements for information processing systems.<\/li>\n
  • SYSC 9: orderly records (SYSC 9.1.1R, or SYSC 9.1.2-A for the MiFID business of common platform firms).<\/li>\n
  • SYSC 4.1.6R: continuity of regulated activities (common platform firms).<\/li>\n
  • COCON 2.2.1R, 2.2.2R and 2.2.3R: Senior Manager Conduct Rules SC1 to SC3.<\/li>\n
  • Section 66A(5), Financial Services and Markets Act 2000: the duty of responsibility.<\/li>\n<\/ul>\n

    Provisions cited were checked against the FCA Handbook and legislation.gov.uk in September 2026. The Handbook is amended regularly; confirm the provisions that apply to your own permissions and category.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

    Your IT company or in-house tech runs Microsoft 365, but the responsibility stays with you. What the FCA expects a business owner to have done, and what to keep on file.<\/p>\n","protected":false},"author":2,"featured_media":18,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"insights_author":"andrew","insights_hero_image":17,"wds_primary_category":0,"footnotes":""},"categories":[1],"tags":[7,2,6,3,8,4,5],"class_list":["post-9","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-insights","tag-appointed-representatives","tag-fca","tag-governance-assurance","tag-microsoft-365","tag-office-365","tag-smcr","tag-sysc"],"_links":{"self":[{"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/posts\/9","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/comments?post=9"}],"version-history":[{"count":11,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/posts\/9\/revisions"}],"predecessor-version":[{"id":24,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/posts\/9\/revisions\/24"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/media\/18"}],"wp:attachment":[{"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/media?parent=9"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/categories?post=9"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inquilion.com\/insights\/wp-json\/wp\/v2\/tags?post=9"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}