NCR Audit Checklist for Debt Counsellors

An NCR audit can land with little notice, and debt counsellors who rely on ad hoc filing and scattered records often spend frantic days reconstructing what should already be in order. The National Credit Regulator audits registered debt counsellors to verify compliance with the National Credit Act, the Debt Counselling Rules, and related obligations. Failing an audit can mean compliance notices, fines, suspension, or deregistration. An NCR audit checklist for debt counsellors gives you a structured way to stay audit-ready so that when the regulator arrives, you can produce what they need without panic. This article explains what an NCR audit involves, provides a practical checklist organised by audit area, outlines case file and financial record requirements, highlights common findings, and shows how to prepare proactively. For the broader regulatory context, see our National Credit Act compliance guide.

What an NCR Audit Involves

Understanding what triggers an audit, who conducts it, and what they examine reduces uncertainty and helps you focus your preparation.

What Triggers an Audit

The NCR may audit a debt counsellor as part of routine supervision, in response to consumer complaints, after a random selection, or when it has reason to believe that non-compliance has occurred. You do not need to have done anything wrong to be audited. The regulator is required to monitor the industry and will visit a cross-section of registered counsellors. Complaints from consumers or credit providers can trigger a targeted audit of your files and processes. Statutory reporting deadlines (such as submission of debt counselling statistics) can also draw attention if returns are late, incomplete, or inconsistent. There is no fixed schedule that guarantees you will not be audited in a given year, so treating every year as a potential audit year is the safest approach.

Who Conducts the Audit

Audits are conducted by NCR staff or authorised inspectors. They will typically contact you to arrange a date and may specify what documentation they want to see in advance, or they may arrive and request access to your premises and records. You are required to cooperate and to produce records that the NCA and the Debt Counselling Rules require you to keep. Refusing access or failing to produce required records can itself result in enforcement action. It is in your interest to have everything organised so that you can respond promptly and completely.

What Auditors Look For

Auditors check that you are operating within the scope of your registration, that you are keeping the records the law requires, that your case files support the work you have done, that fees and trust account handling comply with the rules, and that you are treating consumer data and complaints appropriately. They will sample case files, review financial records, check staff and registration records, and may interview you or your staff. Their goal is to verify that your practice meets the standards set by the NCA and the NCR. The checklist in the next section is organised around these same areas so that you can align your preparation with what auditors actually examine.

The Audit Checklist by Area

Use this checklist as a working document. Go through each area periodically and fix gaps before an audit notice arrives.

Registration and Authorisation

Current NCR registration certificate is displayed and valid; renewal dates are diarised.
All individuals providing debt counselling are individually registered; no unregistered staff conducting counselling.
Registration numbers are used correctly on correspondence, Form 17.2, and marketing.
Any changes to practice name, address, or contact details have been notified to the NCR as required.
You have retained proof of NCR registration requirements compliance (qualifications, clearances, etc.) and can produce it if asked.

Case Files and Documentation

Every debt review case has a dedicated file (physical or electronic) that is complete and retrievable.
Each file contains the documents required under the NCA and NCA record-keeping requirements: application, consent, bureau reports, income/expense evidence, assessment, restructuring proposal, court documents, and correspondence.
Bureau reports (Experian, Datanamix, TransUnion) used for assessments are retained with clear dates and are the versions that were actually used for the decision.
There is a clear audit trail linking bureau data, affordability assessment, and the restructuring proposal or recommendation.
File notes and key decisions are dated and attributable; no undated or anonymous notes.
Files are retained for the full period required by law (typically five years after conclusion of the matter or as prescribed).

Financial Records and Trust Account

A separate trust account is maintained for client funds; no mixing with office or personal funds.
Trust account reconciliations are done at least monthly and retained.
All fees taken from consumers are in line with the prescribed fee structure and are properly recorded and justified.
Withdrawals from the trust account are only for permitted purposes (fees due to the practice, payments to credit providers as agreed, refunds) and are documented.
Bank statements, fee schedules, and payment records are kept and can be produced for the audit period.

Consumer Communications and Disclosure

Consumers received the required pre-engagement disclosure (costs, process, rights) before signing.
All material communications with consumers (and, where relevant, credit providers) are recorded or retained.
Consumers were informed of progress and material steps in their matter; there is evidence of this in the file.
No misleading or unfair marketing; any advertising or website claims are consistent with your registration and the CBA Code of Conduct where applicable.

Complaints Handling

You have a documented process for receiving and responding to consumer complaints.
Complaints are logged with date received, nature, and outcome.
Responses are given within a reasonable time and are documented.
If the NCR forwards a complaint to you, you have a record of the referral and your response.

POPIA and Data Protection

Consumer and credit data are processed in line with POPIA; you have a clear basis for collecting and using personal information.
Data is stored securely; access is limited to those who need it for the case or for compliance.
You can demonstrate that you have considered retention and deletion in line with POPIA and the NCA.

Staff and Training

All counsellors hold current registration and required qualifications.
There are records of continuing professional development or training where the NCR or your professional body requires it.
Roles and responsibilities are clear; delegation to unregistered staff (e.g. admin) does not extend to regulated debt counselling activities.

Case File Documentation Requirements

Auditors will open sample case files and expect to see a complete story: how the consumer came to you, what you did, and what the outcome was. Gaps here are one of the most common sources of audit findings.

Every client file should contain at least the following, in line with the debt review process and NCA expectations:

Application and consent: Signed application for debt counselling and consent for bureau enquiries and disclosure to credit providers.
Bureau reports: The actual reports used for the assessment, from one or more bureaux (e.g. Experian, Datanamix, TransUnion), with the date of the pull and clear linkage to the assessment.
Income and expense information: Documentation or notes supporting the consumer’s income and expenses used in the affordability calculation.
Assessment record: A record of the over-indebtedness and affordability assessment, showing how you reached the conclusion and how the proposed restructure was justified.
Restructuring proposal: The proposal sent to credit providers (and any amendments), plus evidence of submission and, where applicable, court documents.
Correspondence: Key correspondence with the consumer and with credit providers, including consent forms, rejection/acceptance letters, and court-related correspondence.
Fee agreement and payment: Evidence of the fee agreement and that fees were disclosed and charged in line with the prescribed structure.

If your files are held in debt counselling software or a document management system, ensure that the system supports full retrieval by case and that the audit trail (who did what, when) is preserved. Auditors will want to see that the documents in the file are the ones that were used at the time of the decision, not later replacements.

Financial Records and Trust Account Compliance

The NCR takes trust account compliance seriously. Mixing client money with office funds, or failing to reconcile and document movements, is a fast route to serious findings.

Maintain a dedicated trust account for all client funds. Do not use it for practice operating expenses. Record every receipt (fees, payments from consumers for distribution to credit providers) and every payment out (fees due to you, payments to credit providers, refunds). Reconcile the trust account at least monthly to the bank statement and keep those reconciliations on file. Ensure that fee deductions are in line with the prescribed fee structure and that each deduction is clearly tied to a specific case and to the agreed fee. If auditors ask for a sample of trust account transactions, you should be able to produce the underlying file, fee agreement, and proof of entitlement for each withdrawal. Keep bank statements, deposit slips, and payment records for the full retention period required by the NCA and your professional obligations.

Common Audit Findings and Where Counsellors Get Caught

Knowing where others fail helps you avoid the same pitfalls.

Incomplete or missing case files: Files that lack signed consent, bureau reports, or a clear assessment record. Auditors cannot verify that the process was compliant if the file does not show what was done and when.

No clear audit trail: Decisions that cannot be linked back to the bureau data and calculations used. Storing only final letters or PDFs without timestamps and operator attribution makes it hard to demonstrate that the assessment was done properly at the time.

Trust account irregularities: Using the trust account for non-permitted purposes, late or missing reconciliations, or fees that do not match the prescribed structure or the fee agreement in the file.

Registration and authorisation: Unregistered individuals performing debt counselling, or using another counsellor’s registration inappropriately. Out-of-date or incorrect registration details on correspondence or websites.

Complaints and communications: No log of complaints, or no evidence of how they were resolved. Missing disclosure to consumers about costs and process before engagement.

Data protection: No clear basis for holding and using personal data, or poor controls over who can access client files. This overlaps with POPIA compliance and is increasingly scrutinised.

Record retention: Files or financial records destroyed or lost before the end of the required retention period. Inability to produce records when requested.

Addressing these areas systematically using the checklist above significantly reduces the risk of adverse findings.

Preparing Proactively: Systems and Habits

Audit readiness is best built into how you work, not bolted on when you receive a notice.

Run the checklist regularly. Schedule a quarterly or bi-annual review where you or a responsible staff member works through each section of the checklist and fixes gaps. Treat it like a mock audit.

Standardise case file content. Define a minimum set of documents and notes for every new case and ensure every file meets that standard before it is closed. Use templates and structured processes so that nothing is left to memory.

Use systems that support compliance. Spreadsheets and loose folders make it harder to maintain consistent audit trails and retention. Purpose-built debt counselling or case management tools that timestamp actions, attribute them to users, and keep bureau reports linked to assessments reduce the risk of missing or inconsistent documentation. The goal is to have systems that produce the right records as a by-product of normal work.

Keep registration and training up to date. Diarise NCR renewal dates, CPD deadlines, and any notification obligations. Ensure that only registered counsellors perform regulated activities and that their details are current with the NCR.

Document your policies. Have written procedures (or at least clear, documented steps) for complaints handling, trust account management, file opening and closing, and data retention. Auditors appreciate evidence that you have thought through your obligations and embedded them in your practice.

When the NCR does contact you, respond promptly, produce what is asked for, and keep a copy of everything you submit. A calm, organised response reflects well on your practice and reduces the chance of escalation.

Stay Audit-Ready Year-Round

An NCR audit checklist for debt counsellors is only useful if you use it. Work through each area, fix gaps, and revisit the checklist regularly so that when the regulator asks for your records, you can respond with confidence. Purpose-built systems that keep case files, bureau data, and audit trails in one place make it easier to stay audit-ready without last-minute scrambling.

See how structured credit assessment and case documentation can keep your practice audit-ready