How to Structure a Section 166 Scoping Response That Limits Reviewer Overreach
This guide sets out how to respond to an FCA or PRA Section 166 scoping notice in a way that constrains the skilled person's remit without antagonising the regulator. After reading, you will know how to shape the scope, methodology, and reporting terms before the skilled person is appointed.
The scoping phase of a Section 166 review is the single most important moment in the entire exercise. Once the terms of reference are signed, the skilled person's remit, methodology, and reporting style are effectively fixed, and every subsequent conversation becomes a negotiation from a weaker position. Firms that treat scoping as a procedural formality tend to end up with reviews that expand sideways into adjacent business lines, backwards into historic conduct, and upwards into governance findings that were never the regulator's original concern.
Key Executive Takeaways
- The scoping response, not the final report, is where reviewer overreach is prevented; contest the framing, timeframe, and methodology before the terms of reference are signed.
- Push for a report structured around factual findings against defined tests, not open-ended opinions on culture, governance, or management effectiveness.
- Manage the skilled person relationship as a tripartite one from day one, with clear protocols on interim findings, factual accuracy rights, and regulator communication.
Read the requirement notice with forensic care
The regulator's requirement notice or draft terms of reference will contain the seeds of every scope expansion that follows. Look for open-textured phrases: "including but not limited to", "root cause", "associated governance arrangements", "any related matters identified". Each of these is a door the skilled person will walk through. Your scoping response should propose specific, closed formulations in their place: defined populations, defined date ranges, defined product sets, defined tests.
If the notice references "root cause analysis", propose that this means causal analysis of the specific failings identified, not a broader diagnostic of the control environment. If it references governance, propose that governance is in scope only where a direct causal link to the identified issue is established on the evidence.
Fix the methodology before the skilled person does
Most overreach happens through methodology choices made by the skilled person after appointment. Pre-empt this by proposing:
- Sample sizes and sampling methodology, with statistical justification.
- File review templates and the specific tests to be applied.
- The evidential standard for findings (balance of probabilities, with documentary support).
- A defined interview list, with a mechanism for adding names only by agreement.
- Clear treatment of privileged material and legal advice.
If you leave methodology to the skilled person's discretion, expect sample sizes to grow, interview lists to expand, and thematic findings to appear that were never contemplated in the requirement notice.
Shape the reporting construct
The reporting format determines what the skilled person can say. Push for a findings-based report structured around the defined tests, with each finding supported by specific evidence. Resist formats that invite narrative opinion on culture, tone from the top, or management competence unless the regulator has explicitly required this.
Secure three procedural rights in the terms of reference: a factual accuracy review before any interim or final report is shared with the regulator, a management response appended to the report, and a protocol for how the skilled person raises new issues discovered during the review. Without the third of these, mission creep is guaranteed.
Manage the tripartite relationship deliberately
Once appointed, the skilled person owes duties to the regulator but is paid by you. Establish weekly working-level meetings, a single point of contact, and a written protocol on regulator communication. Insist that the skilled person shares draft findings with you before sharing with the regulator, other than in circumstances of statutory notification. This is standard and reasonable; firms that do not ask for it often do not get it.
What good looks like
A well-scoped Section 166 response reads like a contract, not a letter. It contains defined terms, closed lists, specific timeframes, and explicit methodology. It anticipates the moments where scope will drift and closes them in advance. It preserves the firm's ability to respond to findings before they crystallise. And it does all of this while accepting the substantive concern the regulator has raised, because visible resistance to the regulator's underlying purpose is what turns a contained review into a wider supervisory problem.
Before you sign the terms of reference, ask one question: if the skilled person produced the most expansive report their remit permits, could you live with it? If not, the scope is not tight enough yet.
Frequently Asked Questions
How much can we realistically push back on the regulator's proposed scope?
More than most firms assume. Regulators expect scoping negotiation and generally accept tighter, more specific formulations provided the underlying concern is fully addressed. What they will not accept is resistance to the substance of the concern itself.
Should we propose the skilled person, or let the regulator choose?
Proposing a shortlist of firms with relevant expertise is almost always better than accepting the regulator's choice. It signals engagement and gives you some influence over methodology culture, though the regulator retains final approval.
Can we claim privilege over materials provided to the skilled person?
Privilege is preserved in principle, but the mechanics need to be agreed in the terms of reference. Address this explicitly at scoping, including how privileged legal advice on the underlying issue will be handled.
What if the skilled person identifies issues outside the agreed scope?
The terms of reference should require the skilled person to raise any such matters with the firm and the regulator jointly, rather than expanding the review unilaterally. Without this protocol, out-of-scope findings routinely appear in final reports.
How long should scoping take?
Two to four weeks of active negotiation is normal for a substantive review. Firms that sign terms of reference within days almost always regret it.
Frequently asked questions
How much can we realistically push back on the regulator's proposed scope?
More than most firms assume. Regulators expect scoping negotiation and generally accept tighter, more specific formulations provided the underlying concern is fully addressed. What they will not accept is resistance to the substance of the concern itself.
Should we propose the skilled person, or let the regulator choose?
Proposing a shortlist of firms with relevant expertise is almost always better than accepting the regulator's choice. It signals engagement and gives you some influence over methodology culture, though the regulator retains final approval.
Can we claim privilege over materials provided to the skilled person?
Privilege is preserved in principle, but the mechanics need to be agreed in the terms of reference. Address this explicitly at scoping, including how privileged legal advice on the underlying issue will be handled.
What if the skilled person identifies issues outside the agreed scope?
The terms of reference should require the skilled person to raise any such matters with the firm and the regulator jointly, rather than expanding the review unilaterally. Without this protocol, out-of-scope findings routinely appear in final reports.
How long should scoping take?
Two to four weeks of active negotiation is normal for a substantive review. Firms that sign terms of reference within days almost always regret it.
Related guides
How to Structure an Operational Resilience Self-Assessment That Withstands Regulator Challenge
This guide sets out how to build an operational resilience self-assessment that holds up to FCA and PRA impact tolerance scrutiny. After reading, senior leaders will know how to sequence evidence, frame judgements, and pre-empt the challenges supervisors are most likely to raise.
How to Structure a Section 165 Response That Limits Scope Creep
This guide sets out how to respond to an FCA Section 165 information request in a way that satisfies the statutory duty without widening the supervisory perimeter. After reading, you will know how to scope, sequence, and caveat your response to close down inference-driven follow-ups.
How to Structure an SM&CR Statement of Responsibilities to Avoid Accountability Gaps
This guide sets out how to draft a Statement of Responsibilities that stands up to FCA and PRA scrutiny without creating unintended liability. Readers will learn how to allocate prescribed responsibilities cleanly, close overlap and gap risks, and produce a document that supports rather than undermines the SMF holder.
How to Structure a Pillar 2 Liquidity Narrative That Anticipates PRA ILAAP Challenge
This guide sets out how to build an ILAAP liquidity narrative that pre-empts the specific challenges PRA supervisors raise on Pillar 2 risks. After reading, senior leaders will know how to sequence the document, where to concentrate evidence, and how to defend judgement calls under supervisory pressure.
How to Structure a Solvency II ORSA Narrative That Pre-empts PRA Capital Challenge
This guide sets out how to build an ORSA narrative that anticipates PRA scrutiny on capital adequacy, risk quantification, and management action credibility. After reading it, senior insurance leaders will know how to sequence the document, evidence key judgements, and close the gaps supervisors most often probe.
Where a specific question needs an outside answer, quickly
Polar Insight's Expert Network connects leadership teams with practitioners who can speak to a precise regulatory, commercial, or stakeholder question before a decision is finalised.
Explore Expert Network