When a Creditor Client Audits Your Floor, What Does Your QA Record Have to Produce?

The request usually arrives as an email with a spreadsheet attached and a deadline of ten business days. Your placement client is auditing you. They want your call-monitoring policy, evidence that you follow it, and — the part that decides how the next fortnight goes — a specific list of calls pulled by date, collector and account.

Agencies survive that email or they do not, and the difference is almost never the quality of the work. It is whether the work left a record. A floor that handled every one of those calls correctly and cannot demonstrate it is in the same position as a floor that did not.

This is what those audits ask for, in the order they ask, and what a QA record has to be able to produce without a fortnight of scrambling.

A policy is not evidence, and auditors stopped accepting it as one

The first section of every audit questionnaire asks for documents: your call-monitoring policy, your scorecard, your escalation procedure, your training records. Those are easy. Every agency has them, they are usually well written, and producing them takes an afternoon.

The second section is the one that matters, and it asks a different kind of question. Not do you have a monitoring policy but show us it operated. Not do you review calls but how many calls were placed last month, how many were reviewed, and by whom.

The gap between those two sections is where agencies lose audits. A policy describes intent. An audit tests operation. The documents that satisfy the second section are records generated as a by-product of doing the work — and if the work does not generate them automatically, nobody generates them retrospectively in ten days.

The supervisory-examination materials published by the Consumer Financial Protection Bureau are worth reading for exactly this reason, even though they are written for regulators rather than for your client. The structure of the questions is the same: a stated procedure, then a test of whether it happened. The published enforcement actions are the other half of the same education — they describe, in detail, what an operation looked like when the records did not match the policy.

The six things an audit actually asks a QA record for

Strip the questionnaire of its formatting and almost every client audit reduces to six requests. They are worth knowing as a set, because a record that answers all six answers most audits, and a record that answers four of them will fail on the other two every time.

What they ask for	What satisfies it	Where floors come unstuck
Coverage: how many calls, how many reviewed	A count of calls placed and calls reviewed for the period, per collector	The denominator lives in the dialler and the numerator in a spreadsheet, so the two never reconcile
A named call, produced on demand	The audio, the transcript and the review record for a specific date, collector and time	The call exists but nobody can find it inside the retention window without a manual trawl
Findings and what happened next	Each finding with its timestamp, the quoted line, and the action taken	Findings recorded as checkbox scores, so there is nothing to show a month later
Reviewer accountability	Who reviewed each call, when, and whether they confirmed or dismissed a finding	Reviews attributed to a team rather than to a person
Retention and access	How long audio is kept and who has listened to it	No access log, so "who heard this recording" has no answer
Corrective action closure	The coaching or discipline that followed a finding, and evidence it closed	The conversation happened at a desk and was never written down

None of those six is exotic. What they have in common is that each is either generated at the moment the work happens or it does not exist. Reconstruction is not available.

The "prove this call" test

If you want to know how an audit will go before it arrives, run one request against yourself.

Pick a date six weeks ago. Pick a collector. Ask your own floor to produce the audio of a call that collector made on that date, the transcript, the QA finding attached to it if any, and the name of whoever reviewed it. Time how long it takes.

Under fifteen minutes means your record is real. A day means the record exists but is not addressable, which is survivable but expensive. If the answer is "we would have to ask the dialler vendor", the record is not yours, and the audit will find that out.

The reason to run this drill on yourself is that it fails in a specific, diagnosable place almost every time. Usually the audio is there — modern collections platforms keep recordings. What is missing is the connective tissue: the transcript that makes the call searchable rather than scrubbable, the finding anchored to the second rather than to the whole recording, and the name of the human who looked at it. We wrote separately about why storage is not review, and a client audit is the moment that distinction stops being philosophical.

Coverage is where the audit gets uncomfortable

The coverage question — how many calls, how many reviewed — is the one agency owners least want to answer honestly, because for most floors the honest answer is a low single-digit percentage.

Two percent review is not a policy violation in itself. Plenty of monitoring policies specify a sample, and a client who asked for a sample and received one has nothing to object to. The difficulty arrives one question later, when the audit asks what the sample is supposed to demonstrate. A sample that small cannot support a statement about the population, and the arithmetic of why is unforgiving: a behaviour occurring on a small fraction of calls is very likely to be entirely absent from a small sample, and its absence from that sample says almost nothing about whether it happened.

There are two defensible answers to the coverage question and one indefensible one.

Defensible: a stated sample with a stated purpose. "We review a sample sized for coaching signal, not for population inference, and we supplement it with complete review of these specific categories." That is honest and an auditor can work with it.

Defensible: complete coverage on the binary categories. Every call transcribed and screened for the language-anchored requirements, with human review concentrated on what the screen surfaces.

Indefensible: a sample presented as a compliance assurance. A two percent sample described in a policy as demonstrating that the whole floor complied is a claim the maths does not support, and it is the kind of sentence an auditor underlines.

Retention: the audit arrives after the audio would have aged out

Claims and audits both run behind the calls they concern. A dispute about a call made in March frequently surfaces in the following year, and a client audit typically samples a period that closed months ago.

So retention is not a storage decision, it is an audit-readiness decision, and it wants to be made deliberately in both directions. Too short and the record is gone when it is needed. Too long and you are holding recordings of consumers for no stated reason, which is its own exposure and an awkward answer to a different question on the same questionnaire.

Three separate decisions, and floors routinely make only the first:

How long audio is kept. Long enough to cover the dispute and examination windows that apply to your placements, and no longer than you have a reason for.

How long findings and scores are kept, separately. Scores are tiny next to audio and often worth keeping longer, because the trend is what shows a corrective action worked. Keeping the finding after the audio ages out is a common and sensible design.

Who has listened, and when. An access log on stored recordings is the question most floors have never been asked and cannot answer. It becomes urgent the moment a consumer alleges their recording was mishandled. The records and access-control guidance published by the National Institute of Standards and Technology is a reasonable framing even though none of it was written for this industry.

Corrective action is the request that catches people

Coverage and evidence are the requests everyone anticipates. Closure is the one that catches floors that are otherwise in good shape.

The audit asks: you found a problem on this call in April — what did you do about it? And the honest answer is frequently that a supervisor had a conversation with the collector, which was the right thing to do and left no trace.

A finding without a closure record reads, to an auditor, exactly like a finding that was ignored. There is no way to tell the two apart from the outside. That is the whole argument for writing down the follow-up, and it is why the triage loop after a call is flagged needs an outcome and a note rather than just a decision — what a supervisor should actually do with a flagged call covers that loop in detail.

The note does not need to be long. Four things are enough: what was found, what was said to whom, what changes, and when it will be checked. The last item is the one that converts a conversation into a closed loop.

What the rules themselves require is a separate question

Everything above is about audit readiness — the operational question of whether your floor can demonstrate what it did. It is deliberately separate from the question of what the rules oblige you to do, which belongs to your own counsel and to the compliance function that answers to them.

The primary material is public and short enough to read. The Fair Debt Collection Practices Act text sits with the Federal Trade Commission, its implementing regulation is at the Electronic Code of Federal Regulations, and the rulemaking history behind the current text is on the Federal Register. Reading the source is a better use of an afternoon than reading a vendor's summary of it, including ours.

What this article does not do is tell you what your obligations are, and no monitoring tool confers compliance on a floor — it produces a record that a compliant floor can point at. Those are different products and only one of them exists.

The audit that nearly ended us did not find a single call handled wrongly. It found that we could not tell them who had reviewed anything. Twelve months of QA and every score belonged to "the QA team". We passed on remediation and I spent a quarter building an audit trail I should have had on day one.

— Operations director, third-party collections, 14 years, name withheld by request

What to have in place before the email arrives

A short list, in the order that pays off soonest:

1. Every call transcribed, so a request for "any call where this phrase was used" is a search rather than a project.
2. Findings anchored to a timestamp and a quote, never a checkbox.
3. A named reviewer on every review, with confirm-or-dismiss recorded.
4. A closure note on every finding, with a check date.
5. A stated retention window for audio and for findings, decided separately.
6. An access log on stored recordings.
7. A reconciled denominator — calls placed, from the system that placed them, in the same report as calls reviewed.

As of September 2026, our Voice tier does items one to three on every call at $99 per monitored collector per month with supervisors free, and the Compliance tier at $149 adds three-year audio retention and a per-listen audit on every stored recording. The Essentials tier at $39 covers desktop activity and the daily report without voice capture. The features page says what each capability does and pricing has the full detail. The compliance page sets out the consent gate that has to be signed before any recording happens at all.

Two honest constraints that bear directly on audit readiness. Calls tie to collectors and times, not to the account in your platform, so an audit request framed by account number needs a cross-reference from your system of record rather than a lookup in ours. And audio is captured from the collector's computer, which is what makes it work with any softphone — but a desk phone that does not route through the machine produces nothing, so a floor on physical handsets gets the desktop half and not the voice half. Tell us which you run before you buy rather than after.

Frequently asked questions

What does a creditor client audit usually ask a collections agency for?

Documents first — monitoring policy, scorecard, escalation procedure, training records — and then operational evidence: how many calls were placed and how many reviewed in the period, specific calls produced on demand with their audio and review record, findings with timestamps, the name of each reviewer, the retention window and access log for recordings, and evidence that corrective action following a finding was closed out.

Is reviewing a small sample of calls a problem in an audit?

Not in itself. A monitoring policy that specifies a sample and delivers one is internally consistent. The problem is describing a small sample as assurance about all calls, because the arithmetic does not support that claim — a behaviour appearing on a small fraction of calls will usually be missing from a small sample entirely. State what the sample is for, or screen every call on the binary categories and concentrate human review on what surfaces.

How long should call recordings be kept for audit purposes?

That depends on the dispute and examination windows that apply to your placements, and it is a question for your own counsel rather than for a vendor. What is worth deciding deliberately is that audio retention, finding retention and access logging are three separate decisions — findings are small and often worth keeping after the audio ages out, because the trend is what demonstrates a corrective action worked.

Why does an auditor care who reviewed a call?

Because a finding with no reviewer attached is an assertion with nobody accountable for it, and a dismissed finding with no record of who dismissed it is worse than no finding at all. Attribution to a team rather than to a person is the single most common gap we see, and it is the one that turns an otherwise clean audit into a remediation plan.

Can a monitoring tool make our floor meet its obligations?

No, and any vendor saying otherwise is describing something that does not exist. A tool produces a record: what was said, when, who reviewed it, what followed. Whether the conduct in that record meets your obligations is a judgement your compliance function and your counsel make. The record is what lets them make it from evidence instead of from memory.

We are on desk phones — can we still answer the call-production request?

Not from us, on the voice side. Audio capture reads the collector's computer, so a handset that does not route through the machine produces nothing to transcribe or score. The desktop activity and daily reporting still work. If your audit exposure is specifically about call content, the honest answer is that you need either a softphone on the floor or recording at the telephony layer, and we would rather say so before you buy.