How to Structure a Section 166 Scoping Response That Limits Reviewer Overreach

The scoping phase of a Section 166 review is the single most important moment in the entire exercise. Once the terms of reference are signed, the skilled person's remit, methodology, and reporting style are effectively fixed, and every subsequent conversation becomes a negotiation from a weaker position. Firms that treat scoping as a procedural formality tend to end up with reviews that expand sideways into adjacent business lines, backwards into historic conduct, and upwards into governance findings that were never the regulator's original concern.

Key Executive Takeaways

• The scoping response, not the final report, is where reviewer overreach is prevented; contest the framing, timeframe, and methodology before the terms of reference are signed.
• Push for a report structured around factual findings against defined tests, not open-ended opinions on culture, governance, or management effectiveness.
• Manage the skilled person relationship as a tripartite one from day one, with clear protocols on interim findings, factual accuracy rights, and regulator communication.

Read the requirement notice with forensic care

The regulator's requirement notice or draft terms of reference will contain the seeds of every scope expansion that follows. Look for open-textured phrases: "including but not limited to", "root cause", "associated governance arrangements", "any related matters identified". Each of these is a door the skilled person will walk through. Your scoping response should propose specific, closed formulations in their place: defined populations, defined date ranges, defined product sets, defined tests.

If the notice references "root cause analysis", propose that this means causal analysis of the specific failings identified, not a broader diagnostic of the control environment. If it references governance, propose that governance is in scope only where a direct causal link to the identified issue is established on the evidence.

Fix the methodology before the skilled person does

Most overreach happens through methodology choices made by the skilled person after appointment. Pre-empt this by proposing:

• Sample sizes and sampling methodology, with statistical justification.
• File review templates and the specific tests to be applied.
• The evidential standard for findings (balance of probabilities, with documentary support).
• A defined interview list, with a mechanism for adding names only by agreement.
• Clear treatment of privileged material and legal advice.

If you leave methodology to the skilled person's discretion, expect sample sizes to grow, interview lists to expand, and thematic findings to appear that were never contemplated in the requirement notice.

Shape the reporting construct

The reporting format determines what the skilled person can say. Push for a findings-based report structured around the defined tests, with each finding supported by specific evidence. Resist formats that invite narrative opinion on culture, tone from the top, or management competence unless the regulator has explicitly required this.

Secure three procedural rights in the terms of reference: a factual accuracy review before any interim or final report is shared with the regulator, a management response appended to the report, and a protocol for how the skilled person raises new issues discovered during the review. Without the third of these, mission creep is guaranteed.

Manage the tripartite relationship deliberately

Once appointed, the skilled person owes duties to the regulator but is paid by you. Establish weekly working-level meetings, a single point of contact, and a written protocol on regulator communication. Insist that the skilled person shares draft findings with you before sharing with the regulator, other than in circumstances of statutory notification. This is standard and reasonable; firms that do not ask for it often do not get it.

What good looks like

A well-scoped Section 166 response reads like a contract, not a letter. It contains defined terms, closed lists, specific timeframes, and explicit methodology. It anticipates the moments where scope will drift and closes them in advance. It preserves the firm's ability to respond to findings before they crystallise. And it does all of this while accepting the substantive concern the regulator has raised, because visible resistance to the regulator's underlying purpose is what turns a contained review into a wider supervisory problem.

Before you sign the terms of reference, ask one question: if the skilled person produced the most expansive report their remit permits, could you live with it? If not, the scope is not tight enough yet.

Frequently Asked Questions

How much can we realistically push back on the regulator's proposed scope?

More than most firms assume. Regulators expect scoping negotiation and generally accept tighter, more specific formulations provided the underlying concern is fully addressed. What they will not accept is resistance to the substance of the concern itself.

Should we propose the skilled person, or let the regulator choose?

Proposing a shortlist of firms with relevant expertise is almost always better than accepting the regulator's choice. It signals engagement and gives you some influence over methodology culture, though the regulator retains final approval.

Can we claim privilege over materials provided to the skilled person?

Privilege is preserved in principle, but the mechanics need to be agreed in the terms of reference. Address this explicitly at scoping, including how privileged legal advice on the underlying issue will be handled.

What if the skilled person identifies issues outside the agreed scope?

The terms of reference should require the skilled person to raise any such matters with the firm and the regulator jointly, rather than expanding the review unilaterally. Without this protocol, out-of-scope findings routinely appear in final reports.

How long should scoping take?

Two to four weeks of active negotiation is normal for a substantive review. Firms that sign terms of reference within days almost always regret it.