Our quarterly internal audit hot topics will give you a thematic view across new and emerging risks on the regulatory horizon that's applicable across financial services.
For more insight and guidance, get in touch with our team.
Our risk focus radar combines our view of key priorities with an extract from the UK Regulatory Initiatives Grid (where key milestone or formal engagement is planned), representing the risks and key priorities for 2022 raised by the FCA (Financial Conduct Authority), PRA (Prudential Regulation Authority) and leading UK regulatory bodies.
We identify the risk priorities at a single glance for the four key sectors segmented by time and risk dimensions to help develop audit-planning and forecast upcoming requirements.
Key developments
The PRA provided an update on its 2024 supervisory priorities and its expectations of firm in the Dear CEO letter sent to UK deposit-takers on 11 January 2024. Financial resilience was highlighted as a key focus area for deposit-takers and international banks. Ongoing assessment of individual firms' capital and liquidity positions and planning is one of the ways the PRA will aim to achieve this objective.
More recently on 4 April 2024 the FCA published results of the final Financial Resilience Survey issued in October 2023. From 1 January 2024, this survey was replaced with the new financial resilience regulatory return FIN073. Through FIN073, the FCA will be able to continue to collect financial resilience information on liquidity, income, and net-asset position, while reducing the burden on firms. For the final survey, firms were asked nine questions, some with multiple parts. In total, there are 19 individual data points collected from the survey, including optional questions. Areas of focus include amount of liquidity resource, estimated cash needs, and expected cash inflows, negotiated extensions with creditors/delayed payment, net profit or loss in the given period, expectation on decrease in profits/increase in losses, impact of the current macroeconomic environment, revenue size, and support under a government-backed loan scheme.
What should happen now?
Key developments
The FCA highlights that under the Consumer Duty, firms should act to deliver good outcomes for all customers, including those with characteristics of vulnerability.
On 20 February 2024 the FCA published its findings on its webpage, following a review of firms' implementation of the Consumer Duty. It has also published the results of the second survey of firms carried out in November 2023, together with a summary of the key information it found. The FCA welcomes the improvements made by various organisations to deliver better outcomes for their retail customers since the Duty came into force in July 2023. However, there are areas for improvement.
The FCA will conduct consumer research as well as gather information from firms and consumer representatives to make its assessment. It intends to share its findings by the end of 2024.
In addition, on 20 February 2024, the FCA published a speech by Sheldon Mills, FCA Executive Director, Consumers and Competition, on the Consumer Duty. In the speech, Mr Mills summarises the FCA's view of the progress organisations have made in the implementation of the Duty, the challenges firms face when assessing their products and services against the price and value outcome under the Duty. With only a few months till 31 July 2024, Mr Mills identified areas of particular focus by organisation which include gaps in monitoring data, fair value in closed products, keeping customer connection, and vested rights.
More recently the FCA published a press release on 15 March 2024, announcing that it's to conduct a review into firms' treatment of customers in vulnerable circumstances. The review will look at areas including firms' understanding of consumer needs, the skills and capability of staff, product, and service design communications, and customer service. They'll also consider whether these support the fair treatment of customers in vulnerable circumstances, the outcomes consumers in vulnerable circumstances receive, and whether they're as good as the outcomes of other consumers.
What should happen now?
Organisations should take the needs of vulnerable customers into account at every stage of the customer journey, specifically:
Key developments
The House of Commons Treasury Committee published On 23 January 2024 a transcript of the oral evidence session held on 17 January 2024 as part of its 'Sexism in the City' inquiry. The FCA published a statement on 8 March 2024 that responds to the House of Commons Treasury Committee's report on its inquiry. The FCA continues to believe that greater diversity and inclusion (D&I) within firms can only be a catalyst to deliver improved internal governance, decision making and risk management. The FCA notes that the Committee shares its view that change is needed.
The FCA has now received responses to consultations on inclusion and diversity (D&I) from 257 responders to its consultation paper on D&I in the financial sector (CP23/20). Both regulators are working through responses and considering the feedback received, including whether to make any adjustments to their proposed policy. The FCA's early analysis of responses indicates that one area of detailed feedback is how the D&I strategy should work in relation to firms operating on a cross-border basis with a global strategy. There's also interesting feedback on how its proposals on non-financial misconduct interact with existing employment, equalities, and criminal laws.
What should happen now?
The FCA’s main feedback is that D&I strategy should work in relation to all line items operating on a cross-border basis with a global strategy. It believes that there's a link to risk management, and reduced diversity can lead to group-think, which has some potential consequences for risk management. With its secondary competitiveness objective and consumer protection mandate it believes the work it's doing is relevant, and that stronger diversity in an organisation will support that objective. There's also interesting feedback on how its proposals on non-financial misconduct interact with existing employment, equalities and criminal laws.
Key developments
The European Central Bank (ECB) published a report on 23 January 2024 on the results of an assessment of the alignment of the EU banking sector with the EU climate objectives, together with a related blog post by Frank Elderson, ECB Executive Board Member and Supervisory Board Vice-Chair. Responding to the survey closed on 29 March 2024. In the report, the ECB quantifies the most pronounced transition risks in the sector's credit portfolio, analysing 95 banks covering 75% of euro area loans. Key findings were that banks' credit portfolios are substantially misaligned with the goals of the Paris Agreement, leading to elevated transition risks for roughly 90% of the banks assessed; 70% of the banks face elevated reputational and litigation risks as they're publicly committed to the Paris Agreement, but their credit portfolios are still measurably misaligned with it.
The Financial Stability Board (FSB) published its work programme for 2024 on 24 January 2024. Some of the priority areas of work and new initiatives include addressing financial risks from climate change. The FSB will continue to co-ordinate international work in this area. This will include analysis of the relevance of transition plans for financial stability and a stocktake of regulatory and supervisory initiatives related to the identification and assessment of nature-related financial risks.
Furthermore, on 29 January 2024, the EBA published a survey to allow it to receive information from credit institutions on their methodologies to classify exposures to ESG risks, as well as on the accessibility and availability of ESG data for this purpose. The aim of the survey is to collect qualitative information on credit institutions' current practices to inform its work on the feasibility of introducing a standardised methodology to identify and qualify exposures to ESG risks.
What should happen now?
Key developments
The ECB will carry out a stress test during 2024 of the resilience of 109 directly supervised banks to a cyber-attack. In the press release on 3 January 2024, it states that it will test how banks respond to and recover from a cyber-attack rather than their ability to prevent it. "Under the proposed approach to the stress test, a bank's daily business operations will be disrupted by an attack and the bank will test how it responds and recovers, including its measures to activate emergency procedures and contingency plans and to restore normal operations". Supervisors will then discuss findings with each bank including how it coped during regular supervisory review process. The exercise’s main findings will be communicated in the summer of 2024.
On 28 March 2024, the FCA announced the launch of a new cyber resilience assessment tool in its regulation round-up. With the Bank of England (BoE) and the PRA, the FCA has launched a new threat-led penetration test assessment tool, STAR-FS (Simulated Targeted Attack and Response assessments for Financial Services). The tool, which will sit alongside CBEST, would mimic a cyber-attack on an organisation’s important business services and the technology and people supporting those services. This would enable regulators and firms to better understand vulnerabilities and take remedial action, improving the resilience of individual firms and the wider financial system.
More recently, the European Systemic Risk Board (ESRB) published a report on 16 April 2024 on advancing macroprudential tools for cyber resilience. In the report, the ESRB reviews the existing operational tools used to respond effectively to a systemic cyber incident, at both the national and the supra-national levels.
What should happen now?
Key developments
The aforementioned PRA Dear CEO letter sent to UK deposit-takers, insurance firms and international banks highlighted operational resilience as one of the PRA's key areas of focus. In the supervisory statement SS1/21 (Operational resilience: Impact tolerances for important business services), mandates that by March 2025, financial institutions must demonstrate their ability to remain within impact tolerances for all their important business services (IBS). In this letter, the PRA reminds firms that they have just over a year left to meet the operational resilience expectations as set out in SS1/21. By no later than March 2025, firms should be able to demonstrate that they can remain within impact tolerances for all their important business services.
The PRA continues to observe firms engaging with third party providers, undertaking significant transformations and utilising cloud computing capabilities. It expects these to be well managed, including mitigating the risks associated with these relationships and notifying the PRA of material arrangements. Furthermore, it expects the scenarios tested to include cyber-related disruptions.
What should happen now?
Key developments
We continue to see persistent inflation, elevated interest rates levels, and more demanding and astute depositors which continues to exercise pressure on banks. A blog post by Kerstin af Jochnick, of the ECB: priorities to help banks withstand headwinds, highlights that "while asset quality has remained strong so far, with the aggregate NPL ratio of supervised banks standing at 1.85% in the third quarter of 2023 (2.27% excluding cash balances at central banks), we expect some deterioration in banks" asset-quality owing mainly to a weaker growth environment, still-high inflation and higher borrowing costs, all of which are weighing on households and firms.
In the Dear CEO letter sent to UK deposit-takers providing an update on its 2024 supervisory priorities and its expectations of firms, credit risk is one of the key areas of focus. Specifically, the PRA looks to assess organisations credit risk management with a particular focus on how credit risk management practices have evolved, as well as any changes to firms' business mix and credit exposures. In addition, counterparty credit risk, will remain a key area of supervisory focus through 2024, exposures to non-bank financial institutions across certain business lines. In particular, the PRA will look for further improvements in firms' ability to identify and assess correlations across financing activities with multiple clients, and for market depth to be taken into consideration as quantitative tightening reduces the level of reserves in the financial system.
To further improve the PRA's understanding of both credit risks, the Bank of England (BoE) will run an exploratory system-wide exercise in 2024.
Ms. af Jochnick's post highlights that taken together, these developments explain why addressing structural deficiencies in banks’ credit risk management frameworks will remain a key supervisory focus in the future. Its targeted reviews, deep dives conducted by Joint Supervisory Teams and on-site inspections will largely continue from last year. It will make certain adjustments in order to focus on the portfolios that are more sensitive to macroeconomic factors, such as residential and commercial real estate, and small and medium-sized enterprises. It will continue investigating banks’ provisioning practices under the IFRS 9 framework. The ECB also plan to strengthen its engagement with banks on counterparty credit risk management by accelerating the remediation of findings from last year’s targeted horizontal review and on-site inspections, and monitoring how banks meet our supervisory expectations.
What should happen now?
Key developments
The House of Commons Treasury Committee published a letter on 10 January 2024, from the PRA (dated 8 January 2024) relating to, among other things, the resourcing of the PRA for the approval of firms' internal ratings based (IRB) approaches. The PRA acknowledged in the letter the recent difficulties in its approval of firms' IRB approaches for the calculation of risk-weighted exposure amounts for credit risk. The difficulties were due to considerable engagement from the PRA for firms seeking IRB permissions for the first time using the PRA's modular approach; the short data histories available to relatively young firms may extend the timeline (typically 18 months) for approval of their IRB approaches; firms with existing IRB permission seeking change or update typically require two or more submissions and consequently they're taking longer than the expected six months to process. The PRA states that there has been a bottleneck in the processing of IRB submissions, with demand exceeding its capacity on occasions. It intends to increase its capacity in 2024 and expects that pressure on its resources will abate once existing IRB firms have completed their transition to hybrid models.
Model risk continues to be a key area of focus for regulators. On 21 March 2024, the ECB recently fined Crédit Mutuel EUR 3.54 million for internal models breaches the bank didn't apply floors set by the ECB for calculating credit risk for certain exposures. This constitutes serious negligence as said floors were clearly stipulated in the relevant ECB decisions. 17 May 2024 is a key milestone for SS1/23 MRM principles for Banks. The PRA highlights in the Dear CEO letters that ‘before the model risk management (MRM) principles for banks come into force, it expects firms within scope to conduct an initial self-assessment of their MRM frameworks and, where relevant, prepare remediation plans to address any identified shortcomings’.
More recently on 19 February 2024, the European Central Bank (ECB) published a revised version of its guide to internal models under the Single Supervisory Mechanism (SSM). The revised guide provided:
Clarifying how banks should go about including material on climate-related and environmental risks in their models.
17 May 2024 a key milestone for SS1/23 MRM principles for Banks. The PRA highlights in the aforementioned Dear CEO letters that "before the model risk management (MRM) principles for banks come into force, it expects firms within scope to conduct an initial self-assessment of their MRM frameworks and, where relevant, prepare remediation plans to address any identified shortcomings".
What should happen now?
Key developments
The FCA published on 8 February 2024, a corporate document on reducing and preventing financial crime. As it passes the midpoint of its three-year strategy the document summarises the progress made in this area and work delivered over the last 18 months prioritising tackling fraud, money laundering, and sanctions evasion. Looking ahead the FCA identifies four areas of focus where further collaborative effort can help shift the dial decisively on reducing and preventing financial crime. These are data and technology, collaboration, consumer awareness, and metrics.
A key FCA focus in 2024 will be "supporting the government's proposals to reform the anti-money laundering (AML) supervisory regime. It considers that the option of a single professional service supervisor offers the best opportunity to deliver on the aims of the reform".
More recently, the FCA published a Dear CEO letter on 5 March 2024, sent to Annex I financial institutions concerning common control failings identified in anti-money laundering (AML) frameworks. In the letter, the FCA sets out details of common weaknesses it has observed in recent assessments of certain Annex I financial institutions' AML frameworks. These include business model, risk assessment, due diligence, governance, management information, policies, and procedures.
The Wolfsberg Group published on 26 March 2024, a framework for auditing a financial crime risk management (FCRM) programme for effectiveness under the Wolfsberg Factors, which it considers are the key elements of an effective anti-money laundering (AML) and counter-terrorist financing (CTF) programme. The Wolfsberg group believes that internal audit (IA) can assist financial institutions (FIs) in the fight against financial crime by measuring FCRM outcomes using the Wolfsberg Factors. IA can leverage these principles to complement their existing audit methodology, while retaining their role as an independent review function.
What should happen now?
Key developments
The FCA's Market Watch 78 published 4 April 2024 covers some of its recent supervisory observations, covering the completeness and accuracy of instrument reference data (IRD) under RTS 23. The FCA highlights issues including:
Data quality processes, Invalid issuer legal entity identifiers (LEIs) – best practice, cancelled instrument reference data, use of dummy values, and breach notifications.
What should happen now?
Exchanges, trading venues and investment firms with systematic internalisers (SIs) should consider reviewing the FCA's observations against their implementation of RTS 23.
Key developments
The Investment Association (IA) published a report on 8 March 2024, providing insights and suggested actions for asset managers following the commencement of reporting obligations of climate-related disclosures under the ESG sourcebook. The report sets out the IA review of investment managers’ entity, product, and on-demand reporting, some of the key challenges faced in implementing the TCFD reporting requirements, as well as a list of 10 key areas for asset managers to consider in their reporting going forward.
"The report focuses on key themes that have emerged from the first round of asset manager reporting, which saw large asset managers report in line with the Financial Stability Board's (FSB) Taskforce on Climate-related Financial Disclosures (TCFD) recommendations and make disclosures at entity and product level". Several findings were found in entity level report, product level and on-demand reporting.
What should happen now?
The FCA published a portfolio letter on 1 March 2024 providing an interim update on its supervisory strategy for the asset management and alternatives portfolios. The letter explains that the update reflects changes in the external risk environment and work that has been completed since its February 2023 portfolio letter. The update also provides the FCA's forward areas of focus for this sector over the next year.
What should happen now?
The FCA expects firms' CEOs to discuss the letter with their Board and executive committee and consider whether the risks of harm are present and adopt strategies for mitigating them. The areas of focus highlighted in the letter are consistent with the multi-year plan the FCA has previously set out and are intended to provide clarity to organisations on the FCA's areas of regulatory focus for the year ahead. In the event of unexpected future events, the FCA notes that it may need to reconsider the plan but, if this happens, it will provide an update. Supervisory priorities include:
Key developments
The International Association of Insurance Supervisors (IAIS) published a draft application paper on 14 March 2024, on supervising diversity, equity, and inclusion (DEI) in the insurance sector. The draft application paper follows on from the IAIS's 2022 stocktake report on DEI in the insurance sector, which was a first step to inform further work to promote DEI in insurers' governance and conduct of business.
The IAIS explains what's meant by DEI and why it's relevant in the context of an insurer's corporate governance, risk management and corporate culture. It highlights at a high level some of the risks that may arise in an insurer due to a lack of DEI. Such risks include safety and soundness risk, misconduct risk, reputational risk, talent risk, and legal and regulatory risk.
IAIS acknowledges that local circumstances, particularly the legal, cultural, and historical context, will influence how DEI is considered, and the actions taken by supervisors and insurers themselves, to enhance DEI within the sector. It advises that the application paper should therefore be read with this context in mind.
What should happen now?
The draft application paper explains relevant matters for supervisors which are equally important for insurers. It highlights areas that supervisors should look out for and provides a non-exhaustive list of possible warning signs that an insurer might need to enhance its DEI efforts. These can be "lack of challenge in board discussions, resistance to change, and longstanding compliance breaches." It also covers warning signs that highlight shortcomings or problems with the embedding of DEI, such as disparaging or dismissive attitudes to promoting DEI, limited or stagnant diversity metrics, poor internal communications on DEI, and DEI-washing.
Potential steps that a supervisor could take, on either an industry-wide or insurer-specific basis, ranges from using soft powers (such as speeches and Dear CEO letters) to more formal interventions (such as the introduction of supervisory expectations, standards, rules or similar). The paper provides a non-exhaustive list of positive actions that's being taken by some insurers to promote DEI internally such as staff training and education on it at all levels and feedback from staff surveys (covering topics such as culture, behaviours, freedom to contribute and remedial action to address issues).
Key developments
The International Association of Insurance Supervisors (IAIS) published a consultation on 27 March 2024, on revisions to supervisory material related to the holistic framework. The IAIS is proposing to make changes to certain Insurance Core Principles (ICPs) and related standards in the Common Framework for the Supervision of Internationally Active Insurance Groups (ComFrame) that form part of the holistic framework. It's proposing to amend its standards and guidance material relating to Liquidity risk, counterparty risk-appetite, and contingency funding plans, and recovery and resolution plans.
What should happen now?
Feedback on the draft revisions is invited by 27 June 2024. The IAIS plans to finalise the revisions, considering consultation feedback, by the end of 2024, following which the IAIS will also prepare and consult on necessary updates to the associated supporting material.
Key developments
The FCA undertook the review which assesses firms’ claims-handling processes for valuing vehicles which have been stolen or written-off (‘total-loss’ claims) after seeing evidence that some consumers are being offered settlement values lower than a fair estimate of their vehicle's market value. It surveyed 12 firms (that together make up around 70% of the market) to get information about their claims-handling processes, including valuation, or claims on vehicles that have been stolen or written-off. This included a data request to help it assess how settlement amounts compared with initial guide valuations. It also assessed firms' oversight and controls and how far they monitor the outcomes of these ‘total loss’ claims.
The FCA published on 27 March 2024, a new webpage setting out the findings from this multi-firm review into insurers' claims-handling processes for valuing vehicles that have been stolen or written-off (total-loss claims). Results of this exercise is disclosed at an aggregate industry level.
What should happen now?
How can CDOs and data leaders rise to the challenges and opportunities of AI adoption?
The Treasury Committee has released their report exploring diversity, equity and inclusion (DE&I) in financial services. We take a look at the report and the key implications for firms.
The Code update asks companies to report on the effectiveness of their material controls and is now sharpening the focus on how material third party risks are managed. Complying with the regulations requires careful assessment and strategic planning to ensure resilience and compliance.
Our in-person and virtual events will put you in touch with our technical teams who have already undertaken engagements and gained valuable experience in these areas.
Our experts will share valuable insights on leveraging technology to ensure accuracy and reliability in model validation processes, with a special emphasis on expected credit loss (ECL) models.
Tuesday 17 September 2024 | 10.00 am - 11.00 am
The FCA's diversity and inclusion (D&I) survey revealed systemic challenges around representation and inclusion at financial firms. In this session, you'll hear how embracing diversity can drive innovation and enhance client services for your business.
Wednesday 26 June 2024 | 10.00am – 11.15am
Get the latest technical updates, insights, events and guidance to support your internal audit function, straight to your inbox.
