The takeaway in 30 seconds: When advisers do not return their attestations, the instinct is to view it as a culture problem: people who do not take compliance seriously. It’s almost never that. It’s inbox behavior: a low-urgency email arrives during a busy week, gets mentally filed under “later,” and “later” never comes. At a 15–30 person firm running attestations by email, that produces non-response rates that quietly climb while nobody measures them. The exposure is not the late signature. It is the inability to prove, on the date that matters, who had actually attested, and an email-based process provides no clean way to know.
You sent the attestation cycle three weeks ago. Most of the firm completed it. A handful didn’t. You’ve sent two follow-up emails, mentioned it in a team meeting, and are now individually contacting the four people who still have not signed, two of whom are top producers who are genuinely overwhelmed, and all of whom would tell you, sincerely, that they intended to complete it.
The temptation is to interpret this as a compliance culture problem. It isn’t. Your advisors aren’t refusing to attest. They’re not taking a stand against the code of ethics. They opened the email, registered it as something to handle when things calmed down, and then things didn’t calm down. The attestation didn’t get refused. It got deprioritized by the same cognitive triage everyone applies to a crowded inbox.
Understanding that the failure is behavioral, not cultural, is the first step, because you cannot fix inbox behavior by sending more emails to the inbox.
Why the Email Workflow Fails by Design
An email-based attestation process asks a busy person to do an administrative task with no deadline pressure, no consequence for delay that they can feel in the moment, and no friction if they simply don’t. Every incentive in the advisor’s day points away from it.
Walk through what actually happens at a 15–30 person firm:
- The attestation goes out as an email with a PDF or a form link. It lands among forty other things competing for attention that morning.
- The advisor reads it, recognizes it as low-urgency and non-client-facing, and mentally files it under “later.” This is rational behavior. Advisers are constantly triaging competing priorities, and a compliance form will almost always lose to a client callback.
- No automated reminder fires. The follow-up depends on the CCO noticing the gap and choosing to chase it, which is itself a manual task competing for the CCO’s attention.
- The tracking lives in a spreadsheet updated by hand. As responses trickle in over two or three weeks, the spreadsheet accumulates versions, and the question “who hasn’t signed yet” requires active reconciliation rather than a glance.
None of these steps involve anyone behaving badly. The process is built on the assumption that people will reliably act on low-priority emails without structural prompting, and that assumption breaks down most often for the very people you most need to complete the cycle: the busiest ones.
The Number You’re Not Measuring
Here’s the part that turns an annoyance into exposure. At most email-run firms, nobody is tracking the non-response rate as a metric. You know it’s “a few people.” You don’t know it’s, say, 40% by the original due date (an illustrative figure, but one that wouldn’t surprise anyone who’s run a manual cycle), because the cycle eventually closes at near-100% after enough chasing, and the final number is the only one that gets remembered.
That’s the measurement trap. The process is evaluated by its endpoint, everyone eventually signed, rather than by its condition at any point along the way. So the firm carries a belief (“our attestation compliance is strong”) that’s true at the finish line and false for most of the weeks leading up to it.
The gap between those two facts is invisible until someone asks the question an examiner asks: not “did everyone eventually attest,” but “on this specific date, who had a current, completed attestation on file?” An email-based process struggles to answer that cleanly because the completion data is scattered across inboxes and hand-maintained spreadsheets, and the timestamps, if they exist at all, live in email metadata rather than in a system designed to track and produce them.
What the Downstream Audit Exposure Actually Looks Like
The attestation pile creates three distinct documentation problems, and they compound.
The completion record doesn’t hold up. When the cycle closes, the spreadsheet shows everyone done. But the spreadsheet has been edited by multiple people across multiple weeks, the completion dates were entered manually, and there’s no immutable timestamp tying each attestation to the moment it was actually signed. Under examination, a completion record that can’t demonstrate when each person attested is weaker than it looks.
The mid-cycle gap is undocumented. If an issue arises during the period when 40% had not yet signed, a personal trade that should have been flagged or an outside activity that should have been disclosed, the firm has no clean record establishing whether that individual had a current attestation in effect at the time. The exposure isn’t hypothetical; it’s exactly the kind of timeline an examiner reconstructs.
The follow-up itself isn’t logged. The CCO’s follow-up efforts, the reminder emails, hallway conversations, and individual outreach, represent real supervisory work. But because it happened informally, there’s no record of it. The firm did the work of driving completion and gets no documentary credit for it. If anything, the absence of a logged escalation process makes the program look less rigorous than it actually was.
The Fix Is Structural, Not Motivational
The reason “remind people harder” doesn’t work is that it treats a structural problem as a willpower problem. You can’t out-nag inbox behavior. What changes the outcome is removing the dependence on memory and manual follow-up entirely.
Problem: Email-based attestation relies on busy people acting on low-priority messages and on the CCO manually tracking and following up with non-responders, creating unmeasured non-response rates and a completion record that does not stand up well under examination.
Solution: An automated attestation workflow assigns the cycle to each individual, tracks completion in real time, and automatically escalates overdue items, without requiring the CCO to identify the gap and manually follow up. Each completion is logged with an immutable timestamp tied to a specific person, a specific cycle, and a specific version of the policy. The “who hasn’t signed” question becomes a live dashboard, not a spreadsheet reconciliation.
Outcome: The non-response rate becomes visible while the cycle is still open, so it can be addressed before the due date rather than chased after it. The completion record is auditable by design, with every attestation automatically linked to the exact time it was completed. And the escalation itself is logged, so the firm gets documentary credit for the supervisory effort it was already making. Attestation season stops being a manual reconciliation project and becomes a status check.
This is the type of workflow Smartria automates: assignment, real-time tracking, automatic escalation, and timestamped completion records. The result is that attestation cycles stop becoming a recurring scramble, and completion data remains continuously available in the format an examiner expects.
What to Do With This
Before you change anything, measure the thing you’ve probably never measured.
On your next attestation cycle, track one number: the completion rate on the original due date, not the final rate after follow-up, but the rate on the day the attestation was actually due. That single figure tells you how much of your “strong attestation compliance” is real and how much is the product of weeks of manual follow-up that won’t scale and doesn’t get documented.
Then ask three questions about your current process:
- Can you produce, for any date in the past year, a record of exactly who had a completed attestation on file? If that requires reconstructing from email and spreadsheet versions, that’s your exposure.
- Are your completion timestamps real, generated automatically by the system at the moment of signing, or are they entered manually after the fact?
- Is the follow-up effort logged anywhere, or does the supervisory work of driving completion vanish the moment it’s done?
If the original due date completion rate is high and all three answers are clean, your process is working and you now have the data to prove it. If the rate is lower than you assumed, and for most firms running attestation cycles through email it will be, you’ve identified the gap before an examiner does and know exactly what the solution needs to address.
The advisors aren’t the problem. The inbox is. And you can’t fix the inbox from inside it.
