How to Structure a Section 166 Skilled Person Review Response

A Section 166 notice is not a routine audit. It is the FCA or PRA formally borrowing a third party's eyes to test something they are already concerned about, at the firm's cost. How the firm responds shapes supervisory posture for years. The response is judged as much on conduct and candour as on technical remediation.

Key Executive Takeaways

• Treat the skilled person as an extension of the regulator's inquiry, not as a vendor to be managed, and structure your internal response accordingly.
• Establish a single governance spine early, with clear board oversight, defined evidence workflows, and one accountable executive owner.
• The firms that come out well are those that surface problems the reviewer has not yet found, not those that defend a position that will not hold.

Read the requirement notice properly before doing anything else

The scoping document defines everything that follows. Read it against the supervisory correspondence that preceded it. Identify what the regulator is actually worried about, which is often broader than the literal scope. Map the notice to your own known issues: control weaknesses raised in internal audit, matters flagged by the second line, near misses. If there is a gap between what the regulator has asked about and what you know is fragile, plan for that gap to close during the review.

Agree the scope in writing with the regulator and the skilled person before work starts. Ambiguity here costs months later.

Set up governance that will hold under pressure

Appoint a single accountable executive, usually the relevant SMF holder, with authority to commit resources and make disclosure calls. Establish a steering committee that meets weekly, with legal, compliance, the relevant business line, and a board representative. The board, or the appropriate committee, should receive structured updates at every scheduled meeting and ad hoc when material findings emerge.

Document decisions contemporaneously. If a judgement call is made about scope, evidence, or disclosure, record the reasoning at the time. Reconstruction after the fact reads badly.

Build the evidence operation

Set up a dedicated data room with version control and access logs. Nominate evidence coordinators in each affected function. Every document going to the skilled person should be reviewed for accuracy, completeness, and consistency with other material already provided. Contradictions between submissions damage credibility more than the underlying issue usually would.

Keep a live log of every question asked, every document provided, and every meeting held. This becomes essential when the draft report arrives and you need to respond to specific findings.

Engage the skilled person substantively

The skilled person is independent and reports to the regulator, but they are not adversarial. Give them access, context, and the internal analysis you have already done. Withholding known issues in the hope they will not be found is the single biggest mistake firms make. Skilled persons are experienced. They find things. When they find something you knew about and did not raise, your credibility collapses.

Be direct about weaknesses. Explain what you have already done and what is planned. A firm that has diagnosed its own problem and started fixing it is treated very differently from one that appears to have been caught.

Handle the draft report with discipline

You will typically have a chance to comment on factual accuracy. Use it precisely. Correct factual errors with evidence. Do not use the comment process to argue with characterisations or conclusions, which reads as defensive and rarely changes the report. If you disagree with a material finding, address it through your own management response, not by attempting to soften the reviewer's language.

Own the remediation

The report is the beginning, not the end. Build a remediation plan with named owners, realistic dates, and evidence requirements for closure. Report progress to the regulator on the cadence they expect. Independent validation of closure, often by internal audit or a separate third party, is usually worth the cost.

What good looks like

A firm that treats a Section 166 as an opportunity to demonstrate competent self-governance, rather than a threat to be contained, changes its supervisory relationship for the better. The reverse is also true. Defensive, incomplete, or inconsistent responses inform enforcement referrals.

The decision point now: is your governance structure genuinely capable of running this response, or does it need reinforcing before the first meeting with the skilled person?

Frequently Asked Questions

Should we use external legal counsel throughout?

Yes, for material reviews. Counsel helps with privilege, disclosure judgements, and interaction with the regulator. Choose a firm with direct FCA or PRA experience, not just a general regulatory practice.

How much should the board be involved?

More than most boards expect. The board should approve the response strategy, receive regular updates, and personally review the draft report and management response. Skilled person reviews frequently surface governance findings, and board engagement is itself part of what is assessed.

Can we challenge the skilled person's findings?

You can and should correct factual errors with evidence. Challenging judgement-based conclusions rarely succeeds and often damages your position. If you genuinely disagree, set out your view in the management response and demonstrate it through remediation.

What if we find something worse than the original scope during the review?

Raise it, with the skilled person and, through appropriate channels, with the regulator. Concealment discovered later is treated as a separate and more serious matter. Proactive disclosure, with a clear plan, is almost always the better path.

How long do these reviews typically take?

Three to nine months for the review itself, with remediation running twelve to twenty-four months beyond that. Plan resourcing accordingly. Under-resourcing the response is a common and visible failure.