Financial services: Building your 2024 internal audit plan

Credit risk

In January, the PRA published a Dear CEO letter to deposit-takers highlighting the importance of credit risk during this period of economic uncertainty. So far, these risks haven’t crystallised significantly (as per the Bank of England’s Financial Stability Report from July), but it’s a key area to watch out for and you need to monitor your credit risk closely. You also need to think about IFRS 9 compliance, and Basel 3.1 implementation – specifically the standardised and internal ratings-based approaches to credit risk.

What to include in your scope?

Economic factors such as inflation, the cost of living crisis, interest rates, and energy costs are all increasing your credit risk profile. To mitigate the risks, you can review your credit risk management framework to make sure it remains fit for purpose, and check your credit portfolio to identify any non-performing assets and assess asset quality. This includes examining watchlist criteria and triggers, staging of assets, recovery rate assessments, limit setting and monitoring, covenant monitoring, collateral valuations, provision levels and changes.

The regulators will expect assurance over traditionally high-risk areas, and may want further data on retail credit card portfolios or unsecured personal loans. Reviewing your early warning indicator framework can support early intervention, and it’s important to consider early outreach options for customers and review your lending criteria to reduce further credit risk moving forward.

Climate risk

Managing climate risk remains an ongoing challenge in the financial sector, with a raft of benchmarking and reporting approaches in place. This includes requirements around greenwashing controls, climate risk, ESG programme reviews, and readiness assessments. Key regulatory developments include the PRA’s recent thematic feedback of written auditor reporting and the Taskforce on Nature-related Financial Disclosures (TNFD), which aims to reduce the risk of biodiversity loss. 

What to include in your scope?

For your internal audit planning, there are a number of areas to include in your scope. First off, there’s SS3/19 implementation and the follow up Dear CEO letters, and you’ll need to think about your climate risk governance, risk management, scenario analysis and modelling, counterparty engagement, climate accounting, disclosures and data.

More specifically, you need to think about how each of these areas relate to your wider strategy, risk management framework, risk appetite statement, committee structures, and three lines of defence. You ultimately need to reflect these risks in your internal and external reporting, so it’s essential to think about what qualitative and quantitative data you have available, and how they can feed into TCFD and Pillar 3 disclosures, and wider risk management approaches.

Key areas for review include model risk (including scenarios selection, stress-testing, impact on the ICAAP impact and governance arrangements), and counterparty engagement strategies to manage those timeframes, and close the gaps on data, reporting and decision-making over time. It’s also important to sense check your climate data, including the reliability of carbon emissions reporting and independently assess the methodologies used to inform your data inputs.

Internal audit may also want to review any plans for TNFD implementation. While this is currently voluntary, there’s a good chance of it becoming mandatory over time. Early adoption, and drawing on synergies with the TCFD, can support an effective implementation and improve risk management processes.

Cyber security

Effective cyber security and resilience processes are also integral to operational resilience and financial stability. This was recently highlighted in a speech by Elizabeth Stheeman, of the Bank of England’s Financial Policy Committee who stated that direct impacts of a cyber incident could lead to financial losses and liquidity stresses. There could also be contagion across the market, which could lead to indirect impacts. As such, financial services need to consider their cyber security controls and audit activity to reduce the potential for operational disruption and to help maintain financial stability across the sector.

What to include in your scope?

When putting together your 2024 internal audit plan, you need to consider your compliance with a range of regulatory approaches and best practice frameworks. This will help you establish effective operational and cyber resilience processes, and actively support financial stability in line with wider market activity.

Key considerations include:

• Establishing and maintaining effective controls, governance and oversight processes in line with the FCA’s principles for business and the PRA’s fundamental rules.
• Developing continual improvement processes to implement findings from the FCA’s Cyber Co-ordination Groups, and lessons learned from the PRA’s 2022 Cyber Stress Test.
• Compliance with the European Cyber Resilience Act and NIS2 for UK firms that do business in the EU (although this still applies as good practice for firms that are out of scope).
• Benchmarking best practice in line with the NCSC’s Annual Review 2023, to support good cyber hygiene, stay on top of the threat landscape and boost resilience. This includes international reviews such as the EBA’s recent observations on IT and cyber risk and findings from its IT risk questionnaire from its annual Supervisory Review and Evaluation.
• Reviewing key cyber components to support operational resilience processes, DORA, the EBA Guidelines on ICT and security risk management, and the PRA’s SS2/21 on ‘Outsourcing and Third-Party Risk Management’.
• Assessing compliance with the Bank of England’s CBEST and CQUEST expectations to improve supervisory oversight and reduce cyber risks.

You also need to think about your cyber governance processes to make sure you are reporting issues promptly, with effective Board engagement and oversight.

Consumer Duty

The Consumer Duty embodies a significant shift in regulatory expectations. Previously, it was enough to demonstrate fair treatment of customers and avoid poor outcomes – but now you need to proactively demonstrate how you’re ensuring good customer outcomes. To meet the challenge, you need to review your culture to embed outcome-orientated behaviours across the firm. With the regulation now in force for open book products, many firms are struggling to move to business as usual and demonstrate good outcomes for all retail customer groups and all in-scope products and services. Meanwhile, firms with closed book products must work towards the July 2024 deadline for implementing the equivalent infrastructure. 

What to include in your scope?

The Consumer Duty is a flagship initiative for the FCA, and it wants the rules to be a catalyst for tangible, significant improvements, not just in firms’ policies, procedures, and management information (MI), but in better outcomes for customers.

So, the key ‘exam question’ is: how effective are the changes you’ve made to demonstrate that you consistently generate good outcomes and good value from your products and services; and to ensure you can intervene meaningfully when this may not be the case?

Internal audit needs to think about supporting and overseeing the business regarding:

• following through on any implementation actions that were not ready by 31 July 2023, including producing and refining the MI needed to measure good outcomes
• obtaining post-implementation assurance that it complies with Consumer Duty so that the board can ‘sleep at night’ in the knowledge that the firm meets the FCA’s expectations by truly delivering good outcomes for their customers
• closed book actions to ensure it can confidently set about meeting the next key milestone of 31 July 2024, including a project plan that is sufficiently detailed, appropriately resourced and feasible in the remaining timeframe
• optimisation – ensuring that customer outcome-orientated thinking and practices are embedded; and turning some of the tactical fixes of the past few months into something more strategic and robust – ie Consumer Duty ‘by design'.

Recovery, resolution, and wind-down planning

Financial services firms continue to face challenges around capital, liquidity, and loss of investor confidence, with high-profile casualties such as Silicon Valley Bank. As such, we’ve seen new rules on solvent exit, to address concerns around the quality of wind-down plans, and trading activity wind-down plans, to wind down trading activities in an orderly way. These concerns were reflected in a recent Bank of England speech, which highlights the need for proportionate regulation, effective risk measurement, adequate operational resources, and the ability to fail safely throughout recovery and resolution.

What to include in your scope?

While all firms need to think about recovery and resolution planning, systemically and non-systemically important firms have a range of different requirements:

• Systemically important firms need to think about their trading activity wind-down plans, which need to be in place by March 2025 – they also need to consider how these fit into wider requirements operational continuity in resolution
• Non-systemically important firms need to think about their solvent exit plans, which must be ready by Q3 of 2025; these plans will replace the solvent wind-down option, which has been a key driver of s166 reviews, and firms need to consider longer timeframes, use of technology and operational barriers to success

When implementing these regulations internal audit also needs to think how these elements interact with the Resolvability Assessment Framework. This includes consistency and alignment across all strands of recovery and resolution regulation, completion of the self-assessment report, and consideration of how the resolution strategy will affect the MREL calculation.