Schedule 3: Timing of providers’ assessments Cross-cutting duties Section 34: Record-keeping and review duties
This section sets out the record-keeping and review obligations that apply to providers of regulated search services.
	Providers of regulated search services are obliged to keep a written record of the risk assessments that they carry out. They must also keep written records explaining which of the measures recommended in a code of practice they are taking. Where a provider is taking an alternative approach to that recommended in a code of practice, it must keep a written record explaining what it is doing instead and how that amounts to compliance with the relevant duties.
	Subsection (6) requires providers to review compliance with the relevant duties regularly and after making any significant change to their service.
	Subsection (7) provides OFCOM with the ability to exempt categories of providers from the need to keep written records and carry out reviews. It is anticipated that this power could be used for small, low risk services to ensure these service providers do not face an unnecessary regulatory burden. Where OFCOM consider an exemption is no longer appropriate, they may revoke that exemption. Under subsection (8), OFCOM must publish the details of any such exemptions or revocation of exemptions with reasons.
	Subsection (9) specifies the duty Category 2A providers having made a record of a risk assessment, or revising such a record, to supply OFCOM with a copy of the record in full as soon as practicable.