The audit call you are not ready for

It is not the regulation that catches companies out. Most compliance teams know the rules well enough. What trips them up is the gap between knowing the rules and being able to show — clearly, quickly, under pressure — that they actually followed them.

That gap is usually filled with spreadsheets.

Compliance with the Market Abuse Regulation is, on paper, a manageable set of obligations: maintain accurate insider lists, apply closed periods, manage PDMR transactions and approvals, document delayed disclosure decisions. In practice, each one requires ongoing coordination across legal, finance, HR and the company secretariat. And in most organisations, that coordination happens through a patchwork of email threads, shared drives and manually-updated files.

When things are quiet, this more or less works. When things are not quiet — an earnings period, a deal, a sudden personnel change — the cracks show fast.

Where the real compliance risk actually hides

Insider list accuracy is a good example. The format is prescriptive; ESMA's template leaves little room for 'close enough.' But the list does not stay static. Corporate actions, M&A, financing rounds — each creates a new event, a new population to log, notify, confirm and archive. Every one of those touchpoints is an opportunity for the record to drift from reality.

Closed periods are another. 30 calendar days before the announcement of an interim or year-end report sounds simple — until you factor in multiple report types, multiple jurisdictions, directors who join or leave mid-window and internal restrictions that extend beyond the standard period. One missed alert is not just an admin error. It becomes a potential personal trading issue.

PDMR transaction management compounds this. When pre-clearance, approvals and threshold tracking live in people's inboxes, there is no central view of what is pending versus approved, no reliable year-to-date aggregation and no clean audit trail to reconstruct when someone asks. The EU Listing Act's changes to the annual notification threshold — now €20,000, with national regulators able to move it up to €50,000 or down to €10,000 — make 'how we have always done it' an increasingly fragile defence.

And then there is delayed disclosure, which is where 'we made a reasonable call' stops being sufficient. Regulators want more than a plausible justification. They want a structured record of the decision — what information was held, by whom, when the decision was taken and on what basis. If that record exists across three inboxes and a shared drive no-one has updated recently, you have a problem.

The coordination burden no-one officially owns

There is a pattern that tends to emerge in fragmented environments. Compliance becomes the human connective tissue between legal, company secretary and finance — passing information between teams, chasing confirmations, reconciling records that do not quite match. It works, after a fashion. But it is not scalable and it creates a specific kind of risk: the handoff risk, where each function can honestly say they did their part and the organisation still cannot evidence a complete control chain.

This is the uncomfortable truth about compliance workflows built on general-purpose tools. The risk does not live in any one spreadsheet. It lives in the spaces between them.

What a single controlled workflow actually changes

InsiderLog is built around the idea that MAR compliance should work as one connected workflow rather than a collection of separate processes. Insider lists are stored in the ESMA-mandated format, with event-based and PDMR lists managed in one place. Closed periods are applied and monitored automatically, with alerts sent to the right people at the right time. PDMR transactions are handled end-to-end — from approval and reporting through to NCA submission — with dashboards that give compliance a live view of what is pending. Delayed disclosure decisions are documented in the required format and remain retrievable. And everything is timestamped, archived and auditable.

The value is not just efficiency, though that matters. It is that when the regulator calls — or when an internal question needs answering fast — the answer exists in one place and holds together as a coherent record.

That is the difference between a workflow and a workaround.

Schedule a consultation with a compliance specialist to see how InsiderLog replaces fragmented tools with one audit-ready workflow.