How to Close a Dear CEO Letter Without Inviting Follow-Up

A Dear CEO letter response is not a compliance exercise. It is a supervisory judgement about your firm, made by a reader who is scanning for signals of grip, honesty, and proportionality. The goal is to close the file. Too many responses do the opposite: they over-promise, over-explain, and hand the supervisor fresh threads to pull.

Key Executive Takeaways

• A closing response answers every concern with evidence of action taken, not action planned, and quantifies residual risk in the firm's own words.
• The most common failure is volume: long annexes, aspirational roadmaps, and unprompted disclosures that create new supervisory questions.
• Structure the response so a supervisor can, in ten minutes, confirm the issue is understood, owned by a named SMF, and closed with a defined evidence base.

Read the letter the supervisor actually sent

Before drafting, separate the letter into three categories: findings that apply to your firm, findings that partially apply, and thematic points included for the sector. Responding to all three with equal weight is a classic error. It suggests you have not diagnosed your own position. Where a finding does not apply, say so directly and give one line of evidence. Do not pad.

Identify the supervisor's underlying concern, not just the stated one. A letter about governance of product oversight is usually a letter about whether the board sees the right MI. Answer the underlying concern, or the follow-up letter will surface it explicitly.

Structure the response for a ten-minute read

Supervisors read the covering letter, the executive summary, and the first paragraph of each section. Everything else is reference material. Build for that reading pattern.

A workable structure:

1. Covering letter from the CEO, one page, naming the SMF accountable for each theme and confirming board discussion.
2. Executive summary, two pages maximum, with a table mapping each concern in the Dear CEO letter to the firm's position, action taken, and status.
3. Thematic sections, each opening with a plain statement of what the firm found, what it changed, and what evidence exists.
4. Appendices only where they close a point. Board minutes extracts, MI samples, policy version histories. No aspirational documents.

Close each concern in the response itself

A concern is closed when three things are visible: the firm understood it, acted on it, and can prove the action landed. Use past tense wherever possible. "The committee's terms of reference were amended on 14 March and the revised MI pack was presented to the April board" closes a point. "We are enhancing our framework" opens one.

Where work is genuinely ongoing, give a specific completion date, a named owner, and the evidence that will exist at that point. Vague timelines are the single most reliable trigger for follow-up.

What most firms get wrong

Volunteering weaknesses the supervisor did not raise. Transparency is a virtue, but a Dear CEO response is not the venue for a general confession. If a separate issue exists, address it through the usual channels, not by bolting it onto this response.

Treating the response as a project plan. Roadmaps with Gantt charts, workstream leads, and RAG statuses invite the supervisor to track delivery. You have created a supervisory programme where none existed.

Inconsistency between the covering letter and the detail. Supervisors read for tone mismatches. A confident CEO letter sitting on top of hedged operational detail signals that the CEO does not know what is happening.

Over-attribution to third parties. Blaming vendors, outsourcers, or the previous management team reads as poor ownership. Own the issue, then explain what changed.

What good looks like

A good response is short, specific, and finished. It reads as though the firm has already moved on. It contains no phrases like "continuous improvement," "journey," or "embedding." It names people, dates, and documents. It quantifies residual risk in the firm's own risk appetite terms. It closes.

Next step

Before sign-off, have someone outside the drafting team read the response with one question in mind: what would I ask next if I received this? If they can generate three questions in ten minutes, the response is not ready.

Frequently Asked Questions

Should the board formally approve the response?

Yes, and the covering letter should say so. Supervisors expect board oversight of Dear CEO responses. Reference the specific board or committee meeting and date. Do not attach the full minutes.

How long should the response be?

Rarely more than fifteen pages including the covering letter and executive summary. Longer responses signal either genuine breadth of issue or an inability to prioritise. Both invite scrutiny.

What if we disagree with a finding?

Say so, once, clearly, with evidence. Do not argue at length. If the disagreement is material, request a meeting rather than debating in writing. Written pushback tends to harden supervisory positions.

Should we share the response with our auditors?

Assume yes. External auditors will ask, and inconsistency between the response and audit representations creates its own problems. Align the language before sending.

When should we expect follow-up regardless of quality?

Where the letter formed part of a multi-firm review, expect a thematic follow-up irrespective of your response. Where the concern touches on culture, governance, or SMF accountability, expect the supervisor to test the response at the next routine engagement. Prepare the SMF accordingly.