How Redrock Supervises and Audits Broker Files
Quarterly compliance reviews, file audits, registers and corrective action — what Redrock's supervision regime looks like day to day for a mortgage broker.
Every credit licensee has to supervise its credit representatives. That is not optional, and any aggregator telling you otherwise is describing a problem rather than a feature. The question worth asking is not whether you will be supervised, but what that supervision actually looks like in practice — how often, how deep, and what happens when something is found.
This article describes Redrock's monitoring regime as a broker experiences it. It is general information about how Redrock operates, not legal or compliance advice — verify current regulatory obligations with ASIC.
Who supervises you, and under what authority
Red Rock Brokers Group Pty Ltd (ABN 40 149 728 030) holds Australian Credit Licence 405961; Red Rock Mortgage Group Pty Ltd holds Australian Credit Licence 384209. If you operate as a credit representative, you are authorised under one of those licences, and the licensee carries the supervision obligation for your credit activities under the National Consumer Credit Protection Act 2009.
That is the chain of accountability: the Act obliges the licensee to supervise; the licensee discharges that through the regime below; you sit inside it. Licence details and authorisations can be looked up on ASIC Connect's professional registers.
Quarterly compliance reviews
Redrock conducts a compliance review for each credit representative on a quarterly cycle. This is a structured review rather than an ad hoc spot check, which matters for two reasons: it is predictable, so you can prepare, and it is regular, so problems surface while they are still small.
A quarterly rhythm means a documentation habit that has drifted gets corrected within a quarter rather than after two years of files. For a new broker, that is the difference between a coaching conversation and a remediation project.
What a file audit examines
File audits are conducted against a compliance document checklist. The audit is asking a straightforward question: does this file demonstrate, on its own, that the credit assistance provided met the applicable obligations?
That last part is the key. A file has to speak for itself. If the reasoning existed only in your head or in a phone call, it did not happen as far as an auditor, a complaint, or a regulator is concerned.
What a good file contains
| Element | What the audit is looking for |
|---|---|
| Fact-find | A complete record of the client's requirements, objectives and financial situation, captured at the time |
| Preliminary assessment | Documented assessment that the credit contract is not unsuitable, with the reasoning visible |
| Reasonable enquiries evidence | Evidence of the enquiries actually made — not a tick box, but what was asked and what was learned |
| Verification documents | Income verification, bank statements or open banking data, and supporting identity and expense documentation |
| File notes | Contemporaneous notes of conversations, client instructions, changes of position, and why options were discussed or discounted |
| Credit proposal disclosure document | The disclosure document required under the National Consumer Credit Protection Act 2009 and issued to the client — within Redrock's framework this is referred to as a Statement of Credit Assistance |
Redrock's best practice standards set expectations across record keeping, file notes, open banking and bank statement verification, income verification, private lending, commercial lending, and business continuity. The standards exist so that "what good looks like" is written down rather than inferred.
The two areas that most commonly let files down are file notes and reasonable enquiries evidence. Both are cheap to do at the time and expensive to reconstruct later.
Consumer files and commercial files are not audited against the same obligations
Best Interests Duty and the responsible lending obligations apply to credit assistance for consumer credit. They do not apply to commercial or business lending. A commercial file is not audited for a preliminary assessment or a BID rationale, because those obligations do not attach to it.
What a commercial file is audited against is Redrock's own file standards, which cover commercial and private lending deliberately. The finding auditors care most about here is misclassification — a consumer purpose recorded as business purpose. Document the purpose test itself, not just the conclusion. See how Redrock evidences Best Interests Duty and responsible lending for where that boundary sits.
Compliance registers and risk monitoring
Beyond individual files, Redrock maintains compliance registers and conducts risk monitoring across the network. Registers capture the things that need to be tracked over time rather than assessed once — complaints, incidents, conflicts, training and accreditation currency, and corrective actions.
Risk monitoring looks across the population of brokers and files for patterns. An individual file audit tells you about one file. Network-level monitoring tells the licensee where systemic risk is building — a lender product being used in a way that generates complaints, a documentation gap appearing across multiple brokers, a training need nobody has articulated.
Corrective action management
When an audit finds a gap, it goes into corrective action management. In practice this means the issue is recorded, an action and owner are assigned, and the item is tracked through to close-out rather than noted and forgotten.
It is worth being direct about how to read this. An audit finding is not a disciplinary event. It is the system doing the thing you are paying it to do — identifying a weakness in your file while the only cost is the effort of fixing it, rather than after a client has complained and the file is being read by someone who is not on your side.
The brokers who get the most out of this treat findings as free feedback on their process.
Breach management and reporting
Where a matter meets the threshold of a reportable situation, it enters breach management. The licensee assesses the matter, determines whether reporting obligations are triggered, and manages the report and any remediation.
Statutory reporting windows apply and can be as short as 10 business days for the most serious matters. Those timeframes, and the tests for what must be reported, are set by legislation and ASIC guidance and are subject to change — verify current requirements with ASIC directly rather than relying on any summary, including this one.
What this means for you as a credit representative is simple and important: escalate promptly. The licensee cannot meet a short statutory window on a matter it learns about late. If something has gone wrong, or might have, tell your compliance contact the same day. Delay converts a manageable issue into a compounding one.
Where the published detail runs out
Redrock publishes the shape of the regime — quarterly cycle, checklist-based audits, registers, corrective action, breach management. It has not published the sampling rate within a quarterly review, the scoring thresholds that trigger escalation, or how long a broker stays under heightened review after a finding.
Those are reasonable things to ask before you sign, and vague answers are informative. Call 1300 667 694 and ask specifically: how many of my files get pulled per review, who conducts it, what triggers an escalation, and how do I get back to normal cadence.
Why supervision is a benefit, not a burden
For a broker starting out, structured supervision does three things that are hard to buy any other way.
It gives you a defensible file. If a complaint arrives — see complaints, disputes and AFCA — the quality of your documentation determines the outcome far more than the quality of your recollection.
It shortens your learning curve. Quarterly feedback against a written standard teaches you the job faster than working alone and discovering the gaps through consequences.
It protects your professional indemnity position. A clean audit history and documented process are what matter when cover is being renewed or a claim is being assessed — and note that your PI cover is yours to hold and renew, not the licensee's. See professional indemnity insurance for mortgage brokers.
Supervision is also part of the broader support structure new entrants receive, alongside mentoring — which is required under MFAA and FBAA membership standards and the licensee's supervision obligations, not by statute. See mentoring at Redrock and file standards and audits: what Redrock checks and why for how that fits together.
Redrock has operated since 2004, is a member of both the FBAA and the MFAA, and is a member of AFCA. Call 1300 667 694 or see the compliance and licensing FAQ.