Financial services internal audit hot topics

Key developments

The PRA published a letter on September 10 2024 sent to chief risk officers (CROs) of lenders relating to the thematic findings of the internal audit review of the credit risk management framework (CRMF) for non-systemic banks and building societies. The review was designed to provide assurance to the firms' boards and to the regulator on the overall effectiveness of the control framework and in the specific areas of focus, which were the governance and control environment over credit and affordability assessments, approval processes, and portfolio management. 

33 UKDT non-systemic banks and building societies took part in this exercise, representing 13% of non-systemic firms' lending exposures; six were banks, and the remainder were building societies. The PRA notes that its findings reinforce the need for some organisations to continue to enhance their portfolio management controls and affordability assessments, with consideration of changes in the macroeconomic environment to ensure that new lending is sustainable. 

What should happen now?

Areas for improvement include:

• affordability assessments
• the quality assurance and underwriting process
• the quality of management information
• the calibration of firms' credit risk appetites

The PRA encourages the senior management function responsible for identifying, assessing, and mitigating risks to the business, and a source of independent challenge, to consider whether its organisation is well placed to assess how the points raised in the letter relate to their business and review how they’re being addressed. It recommends that organisations should consider using the points raised in the letter as a reference when they next review and assess their CRMF controls to identify areas that might need strengthening.

Key developments

On August 6 2024, the BoE published a paper setting out findings from its second assessment of the resolvability of the eight major UK banks (namely Barclays, HSBC, Lloyds Banking Group, Nationwide, NatWest Group, Santander UK, Standard Chartered and Virgin Money UK) as part of the Resolvability Assessment Framework (RAF). The RAF is the BoE's approach to assessing the extent to which banks are prepared for resolution, checking for well-tested capabilities and the ability to react quickly and flexibly. The BoE has used this second RAF assessment to assess the major UK banks' progress against issues outstanding from the first assessment in 2022 and to undertake more detailed assessments of their preparations under the adequate financial resources outcome. 

The BoE concludes that the banks have continued to improve their resolution preparation, including embedding this into their everyday business and addressing issues raised in the first assessment.

What should happen now?

• The BoE tested for the first time through the RAF how the banks' preparations for resolution work in practice. The BoE expects the banks to address the feedback from both this and the previous assessment and to continuously maintain and improve their resolvability capabilities. The BoE plans to engage with the major UK banks over the coming months so that they can continue to make progress on resolvability.
• The next RAF assessment for the major UK banks will focus on the continuity and restructuring outcome, including banks' readiness to plan quickly for and execute restructuring options to address the causes of failure and restore viability. 

Key developments       

The objective of the Corporate Governance Code 2024 (the code) published on January 22 2024 is to "enhance transparency and accountability of UK plc and help support the growth and competitiveness of the UK and its attractiveness as a place to invest”. 

The code suggests annual reports should include a statement of how the board has monitored and reviewed the effectiveness of internal control frameworks; a declaration of effectiveness of the material controls as at the balance sheet date; and a description of any material controls that haven’t operated effectively as of the balance sheet date, the action taken, or proposed, to improve them, and any action taken to address previously reported issues. 

The FRC notes that the scope of internal controls hasn’t changed from the 2018 Code and provided example areas where material control might exist which include 'reporting' in addition to financial, operational and compliance controls.

Provision 29 relating to internal controls will apply for financial years beginning on or after January 1, 2026. Boards will be required to provide a declaration of effectiveness of the material controls as at the balance sheet date for accounting periods commencing on or after January 1, 2026.

What should happen now?

The key change to the code from 2018 is the explicit declaration requirement. The FRC explained that if the 2018 requirements were already being met, the effort needed to meet the provision shouldn’t be too great. The following could be considered as your organisation embarks on setting up its internal controls framework to meet this requirement:

• Leverage the FRC's guidance on the definition of material control and identify all material controls, ensuring there’s a framework in place for all the controls to be assessed at least annually
• Material controls will differ from organisation to organisation. Undertake a scoping exercise to determine the material risks and controls for your organisation, engaging the board to judge what’s material
• Define and implement an assurance strategy

The FRC is aware of the need to give organisations time to put the internal controls framework in place.

Key developments

EBA guidelines EBA/GL/2016/07 provide a detailed clarification of the definition of default and its application, covering key aspects such as the days past due criterion for default identification, indications of unlikeliness to pay, conditions for the return to non-defaulted status, treatment of the definition of default in external data, application of the default definition in a banking group and specific aspects related to retail exposures. On July 22 2024, the EBA published a peer review report on the application of the definition of default under Article 178 of the Capital Requirements Regulation (575/2013) (CRR). The review focused on the guidelines across the following three major areas:

• Implementation of EBA/GL/2016/07 in the supervisory framework
• Effectiveness of the procedure for the submission of the application
• Effectiveness of the assessment for checking compliance with the definition of default 

Each year, the PRA receives written reports from auditors of the major UK-headquartered banks and building societies, as laid out in chapter eight of the auditors part of its rulebook. Auditors respond to questions on issues of supervisory interest. This year, questions related to IFRS 9 expected credit loss accounting (ECL) and accounting for climate risk. On September 27 2024, the PRA published a letter sent to chief financial officers (CFOs) of selected deposit-takers providing thematic feedback from its review of written auditor reports received in 2024.

The PRA was pleased with the “continued efforts by firms to navigate the uncertainty from the higher interest rate environment, progress made in redeveloping new IFRS 9 models, along with enhanced monitoring and governance capabilities, aimed at better capturing risk. However, we continue to see variation in practice and scope to further embed high quality practices.”

For the next round of written auditor reporting, the PRA has asked for auditors' views on progress against the areas of focus,on ECL, set out in the letter. 

What should happen now?

Overall, the peer review found that the Guidelines have been fully or largely incorporated into the supervisory framework by all supervisors reviewed. The report identifies several follow-up measures and recommendations for certain competent authorities, as well as best practices that would benefit other competent authorities. These include: 

• considering and documenting the elements used to determine the basis of risk-based supervision of the definition of default and the supervisory review and evaluation process assessments
• potentially aligning self-assessment questionnaires on the definition of default submitted to banks
• considering the appropriate frequency and depth of assessments
• establishing minimum checks on IT systems used by credit institutions to calculate elements of the definition of default
• aligning remedial actions in the context of local versus cross-border institutions

The EBA plans to conduct a follow-up peer review of the implementation of the measures included in the report in two years' time.

Model risk continues to remain elevated. The summary feedback from the PRA's review of auditors' responses as it relates to IFRS 9 ECL include:

• organisations should challenge the completeness of post-model adjustments (PMAs) to ensure provisions reflect actual expectations of credit losses. This includes the impact of the higher interest rate environment on affordability and refinance risk for retail and corporate exposures
• organisations should actively monitor their model redevelopment plans to ensure capabilities are enhanced to better capture risk. They should also consider the end state governance and controls for these new models at the point of model redevelopment to ensure alignment with supervisory statement (SSm) 1/23 – model risk management principles for banks
• default experience remains limited, meaning loss given default (LGD) models remain calibrated on historical data. Organisations should continue to challenge whether the recovery assumptions that drive LGD are realistic and to compensate for the risk of historical bias where uncertainty exists over recovery outcomes.

Organisations are encouraged to engage with their auditor by performing their own assessment against the areas of focus. Annex 1 of the letter provides further feedback and areas of focus that are aligned with and build on the expectations in SS1/23.

Key developments

On September 5 2024, the FCA published a speech by Sarah Pritchard, FCA Executive Director, Markets and International, on taking a targeted and outcomes-based approach to tackling financial crime.

Fighting financial crime remains a priority for the FCA and a key commitment in its three-year strategy. The regulator highlights that financial crime isn’t just an issue for the financial sector but for other sectors too. As such, sharing data and intelligence is a vital tool in staying one step ahead.

What should happen now?

Key points from the speech:

• Targeted approach to enforcement: The FCA is enforcing its regulations with vigour. In the last financial year, it charged 21 individuals with financial crime offences: the highest number of charges in any single year. In 2023, it secured three times as many freezing orders as in 2022, restraining more than £21 million in assets of individuals under investigation.
• Authorisation: The FCA wants firms to have the right systems and controls in place before it authorises them, so they aren't used to facilitate financial crime. In the last financial year, 36% of Annex 1 firms – that’s firms seeking to register with the FCA for anti-money laundering purposes only – withdrew their applications or had their applications rejected.
• Data and technology: The regulator has increased its capacity to identify illegal financial promotions on websites or social media. It’s tackling fraud faster by scanning approximately 100,000 websites every day to identify those that appear to be scams. The FCA has created a dedicated financial crime function within its Consumer Investments department, working proactively to identify outliers, spotting trends earlier and dealing with threats before they "spread like wildfire". 

The cost of financial crime compliance, including customer due diligence and anti-money laundering, can be significant. The FCA believes that all the right elements are now in place to shape that debate. As part of its outcomes-based mindset towards financial crime, it will be sharing its approach, expectations, and findings more publicly and more frequently than ever so that organisations can target their approach and know what good looks like.

Key developments

On June 26 2024, The FCA published its findings of a review of how 20 large insurance firms approached outcomes monitoring under the Consumer Duty. It conducted this review of larger firms to test the implementation of these new requirements and to share findings.  

What should happen now?

Some firms showed good progress in developing a clear and comprehensive firm-wide approach to monitoring customer outcomes. However, many firms need to make improvements in their monitoring, strengthening monitoring MI to ensure it’s outcome (rather than process) driven and comprehensive enough to provide the relevant board or committee a reasonable view of whether the requirements of the duty are being met. 

Some examples of bad practice include:

• significant focus on processes being completed rather than on outcomes delivered
• some of the reporting to the board or committee had limited insight into actual customer outcomes. This was often due to the metrics or data not being comprehensive enough, or data lacking analysis and explanation
• few organisations could provide clear evidence of the direct link of monitoring of outcomes to proactive action being taken to improve these outcomes, where necessary.

All insurers, insurance intermediaries and outsourced service providers operating within the insurance sector should consider the FCA's findings. Retail financial services firms in other sectors may also find its observations useful. Firms that identify gaps in their compliance with the FCA's rules are encouraged to act immediately and put robust plans in place to address any shortcomings.

Key developments

The FCA published a report on August 21 2024, setting out the findings from its product oversight and governance (POG) thematic review relating to general insurance and pure protection products. This review considered whether firms are meeting their product governance obligations for general insurance (GI) and pure protection (PP) products under these new rules. The FCA assessed product oversight and governance arrangements of insurance manufacturers and distributors against what’s required under PROD 4. This included 28 insurance manufacturers and 39 insurance distributors, covering ten different general insurance and pure protection products. The review focused on whether firms have assessed and can demonstrate that their products and services offer fair value and whether they have taken effective action where products may not be providing the intended value.

What should happen now?

The review found that most product manufacturers have materially strengthened their product oversight and governance arrangements and appointed appropriate senior managers responsible for product governance. However, there were some shortcomings or inconsistencies in many firms' arrangements and how they applied them. Many firms weren’t fully meeting the requirements under PROD 4 and couldn’t ensure or prove that their products were delivering fair value. The FCA was very disappointed to see many firms failing to meet their PROD obligations fully. 

Key findings include:

• many product manufacturers didn’t appear to have implemented effective products
• governance frameworks weren’t compliant with PROD 4
• weaknesses in the quality of the fair value assessment (FVAs) undertaken by many firms
• target market statements were often too high-level and lacked granularity
• lack of understanding or meeting of responsibilities under PROD 4.2 where several parties were involved in manufacture
• many manufacturers hadn’t appropriately considered their distribution arrangements or choice of distributors, given the product and target market. Many were also not providing appropriate and timely information to their distributors.

All manufacturers and distributors of general insurance and pure protection products are expected to consider the report urgently and assess whether, and to what extent, the identified issues apply to their activities. Any firm that identifies POG shortcomings is expected to act promptly to remediate them, which includes paying redress to customers where harm is identified.

The FCA is giving feedback to the firms involved in the review. It’s also considering the most appropriate supervisory and regulatory actions it can take to address the identified issues as soon as possible.

Key developments

On August 21 2024, the FCA published its general insurance (GI) value measures data, covering January to December 2023. This is the second full year of GI value measures data.

The latest data collection continues to highlight some products that don’t appear to be delivering fair value as required by PROD4 and the Consumer Duty. The FCA is concerned a number of firms appear to be reporting data that could suggest a large difference between the risk price and the total price paid by the customer. This may present similar risks of harm as those identified in the Guarantee Asset Protection (GAP) insurance market.

What should happen now?

The FCA emphasises that firms must be fully compliant with our PROD 4 rules, which include the following:

• A firm must make sure that the product approval process identifies whether the product provides fair value to customers in the target market. This includes whether it will continue to do so for a reasonably foreseeable period, including following renewal (PROD 4.2.14A R)
• A firm must be able to clearly demonstrate how any product provides, and will provide for a reasonably foreseeable period, fair value: PROD 4.2.14C R (1).
• Where the firm is unable to identify and clearly demonstrate that a product provides fair value, the firm mustn’t market the product or permit the product to be distributed or must have made sure appropriate changes have been made so that fair value will be provided (PROD 4.2.14C R (2).
• The risk price and the total price paid by the customer should bear a reasonable relationship to the actual costs incurred by the firm or any other person involved in the distribution arrangement, the quality of any benefits, and the costs or quality of any services provided: PROD 4.2.14M E.
•  A firm must, as far as reasonably possible, ensure the distribution arrangements for a non-investment insurance product avoid or minimise the risk of negatively impacting the fair value of the insurance product or package: PROD 4.2.14N R.

The FCA advises senior leaders (SMFs) and board members to take note of its actions on GAP insurance. They must satisfy themselves that the products their firms offer provide good value to consumers and ensure their firms are compliant with PROD 4 and the Consumer Duty. Where data suggests that value appears low, the FCA states it will be in touch with firms later in 2024 to understand their products and the actions they have taken to improve value. Where it believes a firm has failed to act and is still providing poor value products, it will intervene where necessary to protect consumers.

Key developments

The International Association of Insurance Supervisors (IAIS) considers operational resilience as an outcome that emerges from a wide array of practices and disciplines. On August 8 2024, it published a draft application paper on operational resilience objectives aimed at providing a sound and consistent foundation to support supervisory authorities in developing and strengthening their approaches to supervising insurers' operational resilience. The objectives are outcomes-based and don’t set out new requirements (instead, providing clarity on the application of existing supervisory materials).

The objectives constitute the first phase of a two-part consultation. The second phase relates to the development of a draft toolkit to support the objectives by setting out relevant supervisory practices. This will be progressed in the second half of 2024.

What should happen now?

The objectives address:

• the relationship between operational resilience, governance, and operational risk management
• key elements of an approach to operational resilience that encourages the effective and holistic management of insurers' people and processes
• objectives for insurance supervisors

The consultation closed on October 11, 2024. The IAIS aims to consult on the draft toolkit in the first half 2025, following which the two phases of this work will be integrated into a single application paper.