Financial services - sector challenges series

The third in our fortnightly series of guest blog posts focusing on sector specific challenges from an internal audit perspective.

Take a look through the lens of financial services.

​​Guest blog post by the Banking and Financial Services Sector Advisory Panel

A perfect storm describes an event in which a rare combination of circumstances drastically aggravates the event - is a perfect storm building for financial services? 

Internal auditors in financial service firms face multiple, competing priorities, and sometimes knowing where to focus our time and efforts is a challenge. Key elements currently facing financial service firms include:

• The global pandemic – is your firm aware of the guidance published by the FCA to help make sure customers are protected and markets continue to function well – for example, supporting those having difficulty with mortgage, loan or credit card payments? Has your firm implemented the FCA’s latest guidance on helping customers get refunds due to cancellations caused by the pandemic?
• Operational resilience – the FCA states that it is critical that firms understand the services they provide and invest in resilience. Is your firm working towards compliance with policy statement PS21/23?
• Operational readiness for a zero or negative Bank Rate - the recent ‘Dear CEO’ letter from the PRA requires firms to be operationally ready for a zero or negative Bank Rate within six months. Is your firm ready now or is it taking appropriate actions?’
• Regulation – overall there has been an increase in regulation and we need to maintain our focus on the high volume of new guidance. For example, the interest rate benchmark LIBOR is being wound down this year and firms must take appropriate action to transition to alternative rates by the end of 2021. And the FCA has recently published guidance on the fair treatment of vulnerable customers. It wants to drive improvements in the way firms treat vulnerable consumers and bring about a practical shift in firms’ actions and behaviour. Does your firm understand the needs of vulnerable customers and does it need to make any changes to meet the standards set by the Principles for Businesses (Principles)?
• Heightened conduct and reputational risk – the earliest date that businesses can now enforce mortgage repossessions has been moved to 1 April 2021 although businesses have now been permitted to repossess goods and vehicles from 31 January 2021. However, businesses must consider how repossessions would impact vulnerable customers and ensure repossessions are carried out as a last resort; does you firm have plans in place for this and has it considered the potential risks?
• Climate change and environmental sustainability – considering the damage to infrastructure and assets, threatening businesses’ reputations, and introducing a whole new level of regulatory and compliance risks that will increasingly test our resilience. The UK Treasury has published a Roadmap that sets out an indicative path towards mandatory climate-related disclosures across the UK economy aligned with the recommendations of the Taskforce on Climate-related Financial Disclosures – what is your firm doing to prepare for this?
• New technology – digitisation and artificial intelligence are changing the way work is done. The FCA recently published the results of a review into how financial firms manage technology change. The impact of change failures and the practices utilised within the industry to help reduce the impact of incidents resulting from change management. Has your firm considered the findings of this review – is change well-managed in your firm?
• Cybersecurity and data security – increased frequency of cyber-attacks and potential concerns regarding the security of data when so many are working remotely.
• Macroeconomic and geopolitical uncertainty – making budgeting and forecasting challenging, both from a financial and customer behavior perspective.

So, how might we circumnavigate this storm – without the need for a bigger boat!

Some ideas for you to consider…

• Focus on what is important to our stakeholders – stay close to the board, the audit committee and understand the expectations of our regulators.
• Be prepared to adapt and evolve the audit plan – maybe an annual plan will be a thing of the past. Take a look at risk-based internal audit planning in financial services.
• Make sure you are practicing risk-based auditing – we cannot audit everything; focus on what matters.
• Traditional approaches to audit may not be appropriate or possible – maybe more deep-dive rather than full-scope audits to get to the heart of what matters. More timely feedback to stakeholders – less formal audit reports.
• Undertaking an audit will be different now – remote working presents opportunities and challenges. How do we audit virtually - for example, how do we see sufficient evidence when a walkthrough is completed by video call?
• Think about providing insight – internal audit is in a great position to be able to ‘join-the-dots’ and share these views with their stakeholders which may mean less audit work.
• Think about coordinated assurance – with second line (and external audit) to make the best use of available resources, are all parties aligned on the new and emerging key risks?

The blog post ‘Help, my crystal ball is broken’ (see related below) provides some great tips on managing uncertainty and continuing to provide assurance.

And above all, please do not forget to look after your own well-being and that of your team. Dealing with a storm is always a challenge and working as a team to use our limited resource to meet those challenges is important right now. As we have recently seen, even a slight gust of wind can send a ship off course and block a global shipping route!

Watch out for our next blog post in this series on local authorities. Coming the w/c 17 May.

Related blog posts

Help! My crystal ball is broken!

Central government - sector challenges | Construction - sector challenges