Skip to main content
How-to

How to check compliance and process adherence in support conversations

PlaybookUpdated November 1, 202610 min readunitQ Editorial

Last updated November 1, 2026. Published by unitQ. We built this guide from the compliance and process questions support leaders raise when they evaluate support QA, the UK Financial Conduct Authority’s published findings on outcomes monitoring, and how unitQ Support QA grades support conversations across chat, email, messaging, voice and IVR (automated phone menus).

To check compliance and process adherence in support conversations, write each required step as a pass/fail check with a clear definition of a fail, grade the conversations you connect against those checks instead of a hand-picked sample, and review every miss next to the conversation that produced it. Then break the misses down by contact reason, team and vendor so you can fix the cause behind them.

Quick answer

  • Write each rule as a check with a plain-language definition, a clear fail and worked examples.
  • Keep compliance checks (identity verification, privacy handling, required disclosures) separate from process checks (escalations, policy steps).
  • Mark checks as not applicable when they don’t fit a conversation, so they don’t distort the score.
  • Grade the conversations you connect, then review each miss with its evidence.
  • Break misses down by contact reason, BPO vendor, in-house team, manager and agent to find the pattern.

What's the difference between compliance and process adherence?

Compliance checks cover the rules your business must follow, such as verifying identity before discussing an account, handling personal data properly or giving a required disclosure. Process adherence covers the steps your own playbook requires, such as escalating when a case meets your criteria or following your refund policy. You grade both the same way: as pass/fail checks against a definition your team writes.

If you’re new to support QA as a discipline, start with what support QA is and how it works.

Check typeExample checkWhat a fail looks like

Compliance

Identity verified before account details are shared

The agent confirms an order address before the customer passes verification

Compliance

Required disclosure given

A cancellation request closes without the disclosure your policy requires

Compliance

Personal data handled per policy

The agent asks the customer to send a full card number in chat

Process

Escalation offered when criteria are met

A customer asks for a supervisor twice and the conversation ends without an escalation

Process

Refund policy followed

The agent promises a refund outside the eligibility window your policy sets


Why does sample-based review miss compliance gaps?

Sample-based review misses compliance gaps because a rule that’s broken in a small share of conversations rarely shows up in a small, hand-picked review queue. A skipped disclosure can repeat many times before anyone samples a conversation where it happened.

Regulators expect evidence, too. In its July 2026 review of outcomes monitoring under the Consumer Duty, the UK Financial Conduct Authority (FCA) wrote: “Collecting data, listing metrics or reporting management information (MI) will not, by itself, show whether customers are receiving good outcomes” 2. The same review adds: “Firms using third parties to deliver part of their services are still responsible for their customers’ outcomes” 2. That applies to UK financial services firms, and it’s a useful standard for any team that outsources support to a BPO.


Step 1: Turn each rule into a written check

Start with the policy or SOP itself and rewrite each requirement as a check with three parts: what it means, what counts as a fail, and worked examples of the edge cases. A check that two reviewers would grade differently isn’t ready yet.

Here’s what a finished check looks like:

  • Check: Identity verified before account details are shared.
  • Fail: The agent shares a balance, order details or an address before the customer completes verification.
  • Edge case: The customer volunteers their account details unprompted. The agent still completes verification before confirming anything.

In unitQ Support QA, you define each quality check in plain language: what it means, which answers count as a fail, and worked examples that show the edge cases. Your team owns and edits the rubric in Tag Studio, the rubric editor in unitQ Support QA. You can attach your policy or SOP document as reference material and refine a check with AI.

Not sure where to start? unitQ Support QA can suggest draft checks from a sample of your own conversations, and your existing QA guidelines if you add them. Your team reviews, edits and approves every check before it’s used. For more on structuring the full rubric, see our guide to support QA scorecards.


Step 2: Mark which checks apply to which conversations

Mark a check as not applicable when it doesn’t fit a conversation. A disclosure that’s required only for cancellations shouldn’t count against a password-reset chat, and a scorecard that fails it there will hide the real misses in noise.

In unitQ Support QA, checks that don’t apply to a conversation are left out of the score. You can also weight rubric groups to match how you score quality, so a missed identity check can carry more weight than a missed sign-off.


Step 3: Grade the conversations you connect

Grade the conversations you connect against your checks. That way a rare miss has the same chance to surface as a common one.

unitQ Support QA supports all your support channels, including chat, email, messaging, voice and IVR (automated phone menus), through integrations with platforms such as Zendesk, Salesforce Service Cloud, Intercom, Freshdesk, Kustomer, Amazon Connect and Five9. It grades the compliance and process checks you define, such as identity verification, privacy handling or a required disclosure, as pass/fail on the conversations you connect. It flags missed steps that show up in the conversation, such as a skipped identity check, a required disclosure that wasn’t given, or an escalation that should have happened, checked against the process you define 1.

Before a new check counts toward anyone’s score, run it on past conversations and read the results. You can try a check on real past conversations before it goes live, using Testbench in unitQ Support QA. Edit and refine checks as often as you need before the changes go live.


Step 4: Review every miss with its evidence

A compliance result is only useful when a reviewer can open the conversation behind each fail and see why it failed. Without that link, a low score is hard to act on and easy to argue with.

In unitQ Support QA, every scored miss links back to the conversation. unitQ Support QA gives you one quality score built from your rubric, with competency, outcome, operations and compliance views beside it, in the Quality report.

Keep a record of what you decided about each pattern and what you changed. The FCA’s review notes that stronger examples included “a clear audit trail showing how MI translated into decisions, actions and improved outcomes” 2.

See unitQ Support QA

Run as many rubrics and scorecards as your policies require: one shared standard for in-house teams, BPOs and AI agents, or bot-specific checks for loops, false containment and handoffs.

See unitQ Support QA

Step 5: Find the pattern behind repeated misses

Break misses down by contact reason, team, vendor and agent to see whether a gap belongs to one person, one queue or one process. When a disclosure is missed across a whole contact reason, look at training, macros and the process itself before you coach individual agents.

unitQ Support QA breaks scores down by contact reason, line of business, BPO vendor vs in-house team, region, manager and agent, all on the same scorecard. Small samples are flagged, so you don’t act on a pattern built from a handful of conversations. AI-generated findings come with recommended next actions, each tagged with a suggested owner such as operations, enablement, QA or conversation design.


Step 6: Include AI agents in the review

If an AI agent talks to your customers, audit its conversations too, using criteria built for how bots fail: loops, wrong information and handoffs at the wrong moment.

unitQ Support QA grades human and AI agents side by side in one product, on as many rubrics and scorecards as your policies require, with one shared standard or bot-specific checks, independent of the vendor that built the bot. AI agents get an independent audit either way: is containment real, was the information correct, did the bot loop or dead-end, escalate when it shouldn’t, misunderstand the issue, or resolve it inaccurately, and how often conversations recover after reaching a person 1. The bot audit is configured for your workspace during setup. For a deeper walkthrough, read what AI agent QA is.


How do you check refund handling and other steps outside the chat?

Grade the refund steps that show up in the conversation, then confirm the back-office action in the system that records it. In the conversation, you can check whether the agent confirmed eligibility, explained the policy correctly, gave the timeline your policy states and avoided promising anything outside it. Whether the refund actually posted lives in your billing or order system’s own records, so pair your QA results with those reports.


Which approach fits your team?

The right mix depends on your volume, your vendors and how regulated your lines are, and the options can be combined.

  • Manual spot checks fit small teams, low volumes and the first weeks of a brand-new policy, when you’re still learning what a fail looks like.
  • Automated grading across the conversations you connect fits teams with higher volumes, several BPO vendors or regulated lines where a rare miss still matters.
  • A hybrid fits teams that want both: automated grading surfaces the misses, and experienced reviewers handle sensitive cases, edge cases and changes to the checks.

Frequently asked questions

Process adherence in customer support is how consistently agents follow the steps your playbook requires, such as verifying identity, escalating when a case meets your criteria or following your refund policy. Teams measure it by writing each step as a pass/fail check and grading support conversations against those checks, then reviewing the misses with the evidence.

Write each compliance rule as a pass/fail check with a clear definition of a fail and worked examples. Grade the conversations you connect against those checks, mark checks as not applicable where they don't fit, and review every fail next to the conversation that produced it before acting on it. Then break results down by team and contact reason.

Grade the refund steps visible in the conversation: whether the agent confirmed eligibility, explained the policy correctly, stated the right timeline and avoided promises outside the policy. Then confirm the refund itself posted using your billing or order system's records. Together, the two show both what the customer was told and what happened.

No. Automated QA gives you evidence of how your conversations follow the rules you define, and it helps you find misses a manual sample can skip. Your compliance and legal teams still own the obligations, the policies and the remediation. Treat QA results as monitoring evidence that supports their work, not as a certification.

Grade BPO and in-house conversations against the same compliance checks, then break the results down by vendor and team. That gives you one comparable view instead of each vendor reporting on its own work. The UK Financial Conduct Authority notes that firms using third parties to deliver services remain responsible for their customers' outcomes.

Mark those checks as not applicable when they don't fit the conversation. A cancellation disclosure shouldn't affect the score of a password-reset chat. Leaving inapplicable checks out of the score keeps compliance results honest and makes real misses easier to spot in reports broken down by contact reason.

unitQ's security page states: "unitQ is SOC 2 Type II compliant." It also states: "unitQ is compliant with the EU General Data Protection Regulation (EU GDPR)." And: "The unitQ datacenters are compliant with ISO 27001, ISO 27017 and ISO 27018 certifications." Read the full security page and privacy policy before connecting support data.

See how it works

See how unitQ Support QA turns your compliance and process rules into pass/fail checks.

Related guides

Sources 4 references
  1. unitQ Support QA product page (process adherence examples; independent bot audits). https://www.unitq.com/products/unitq-support-qa/ Accessed October 8, 2026.

  2. UK Financial Conduct Authority, "Outcomes monitoring: good practice and areas for improvement," published July 27, 2026. https://www.fca.org.uk/publications/good-and-poor-practice/outcomes-monitoring-good-practice-and-areas-improvement Accessed October 8, 2026.

  3. unitQ security page (SOC 2 Type II, EU GDPR and ISO 27001/27017/27018 datacenter statements, quoted word for word). https://www.unitq.com/security/ Accessed October 8, 2026.

  4. unitQ privacy policy. https://www.unitq.com/privacy-policy/ Accessed October 8, 2026.