How to Structure a Section 166 Skilled Person Review Response
This guide sets out how senior leaders in regulated firms should structure their response to a Section 166 skilled person review, from the moment the requirement notice arrives to the remediation phase. It covers governance, evidence, stakeholder handling, and the judgement calls that determine whether the firm emerges credibly or damaged.
A Section 166 notice is not a routine audit. It is the FCA or PRA formally borrowing a third party's eyes to test something they are already concerned about, at the firm's cost. How the firm responds shapes supervisory posture for years. The response is judged as much on conduct and candour as on technical remediation.
Key Executive Takeaways
- Treat the skilled person as an extension of the regulator's inquiry, not as a vendor to be managed, and structure your internal response accordingly.
- Establish a single governance spine early, with clear board oversight, defined evidence workflows, and one accountable executive owner.
- The firms that come out well are those that surface problems the reviewer has not yet found, not those that defend a position that will not hold.
Read the requirement notice properly before doing anything else
The scoping document defines everything that follows. Read it against the supervisory correspondence that preceded it. Identify what the regulator is actually worried about, which is often broader than the literal scope. Map the notice to your own known issues: control weaknesses raised in internal audit, matters flagged by the second line, near misses. If there is a gap between what the regulator has asked about and what you know is fragile, plan for that gap to close during the review.
Agree the scope in writing with the regulator and the skilled person before work starts. Ambiguity here costs months later.
Set up governance that will hold under pressure
Appoint a single accountable executive, usually the relevant SMF holder, with authority to commit resources and make disclosure calls. Establish a steering committee that meets weekly, with legal, compliance, the relevant business line, and a board representative. The board, or the appropriate committee, should receive structured updates at every scheduled meeting and ad hoc when material findings emerge.
Document decisions contemporaneously. If a judgement call is made about scope, evidence, or disclosure, record the reasoning at the time. Reconstruction after the fact reads badly.
Build the evidence operation
Set up a dedicated data room with version control and access logs. Nominate evidence coordinators in each affected function. Every document going to the skilled person should be reviewed for accuracy, completeness, and consistency with other material already provided. Contradictions between submissions damage credibility more than the underlying issue usually would.
Keep a live log of every question asked, every document provided, and every meeting held. This becomes essential when the draft report arrives and you need to respond to specific findings.
Engage the skilled person substantively
The skilled person is independent and reports to the regulator, but they are not adversarial. Give them access, context, and the internal analysis you have already done. Withholding known issues in the hope they will not be found is the single biggest mistake firms make. Skilled persons are experienced. They find things. When they find something you knew about and did not raise, your credibility collapses.
Be direct about weaknesses. Explain what you have already done and what is planned. A firm that has diagnosed its own problem and started fixing it is treated very differently from one that appears to have been caught.
Handle the draft report with discipline
You will typically have a chance to comment on factual accuracy. Use it precisely. Correct factual errors with evidence. Do not use the comment process to argue with characterisations or conclusions, which reads as defensive and rarely changes the report. If you disagree with a material finding, address it through your own management response, not by attempting to soften the reviewer's language.
Own the remediation
The report is the beginning, not the end. Build a remediation plan with named owners, realistic dates, and evidence requirements for closure. Report progress to the regulator on the cadence they expect. Independent validation of closure, often by internal audit or a separate third party, is usually worth the cost.
What good looks like
A firm that treats a Section 166 as an opportunity to demonstrate competent self-governance, rather than a threat to be contained, changes its supervisory relationship for the better. The reverse is also true. Defensive, incomplete, or inconsistent responses inform enforcement referrals.
The decision point now: is your governance structure genuinely capable of running this response, or does it need reinforcing before the first meeting with the skilled person?
Frequently Asked Questions
Should we use external legal counsel throughout?
Yes, for material reviews. Counsel helps with privilege, disclosure judgements, and interaction with the regulator. Choose a firm with direct FCA or PRA experience, not just a general regulatory practice.
How much should the board be involved?
More than most boards expect. The board should approve the response strategy, receive regular updates, and personally review the draft report and management response. Skilled person reviews frequently surface governance findings, and board engagement is itself part of what is assessed.
Can we challenge the skilled person's findings?
You can and should correct factual errors with evidence. Challenging judgement-based conclusions rarely succeeds and often damages your position. If you genuinely disagree, set out your view in the management response and demonstrate it through remediation.
What if we find something worse than the original scope during the review?
Raise it, with the skilled person and, through appropriate channels, with the regulator. Concealment discovered later is treated as a separate and more serious matter. Proactive disclosure, with a clear plan, is almost always the better path.
How long do these reviews typically take?
Three to nine months for the review itself, with remediation running twelve to twenty-four months beyond that. Plan resourcing accordingly. Under-resourcing the response is a common and visible failure.
Frequently asked questions
Should we use external legal counsel throughout?
Yes, for material reviews. Counsel helps with privilege, disclosure judgements, and interaction with the regulator. Choose a firm with direct FCA or PRA experience, not just a general regulatory practice.
How much should the board be involved?
More than most boards expect. The board should approve the response strategy, receive regular updates, and personally review the draft report and management response. Skilled person reviews frequently surface governance findings, and board engagement is itself part of what is assessed.
Can we challenge the skilled person's findings?
You can and should correct factual errors with evidence. Challenging judgement-based conclusions rarely succeeds and often damages your position. If you genuinely disagree, set out your view in the management response and demonstrate it through remediation.
What if we find something worse than the original scope during the review?
Raise it, with the skilled person and, through appropriate channels, with the regulator. Concealment discovered later is treated as a separate and more serious matter. Proactive disclosure, with a clear plan, is almost always the better path.
How long do these reviews typically take?
Three to nine months for the review itself, with remediation running twelve to twenty-four months beyond that. Plan resourcing accordingly. Under-resourcing the response is a common and visible failure.
Related guides
What Regulators Actually Read For When They Open Your Submission
This guide explains what UK and international financial regulators are genuinely assessing when they review a submission, from authorisation packs to thematic responses. After reading it, you will know how to prepare a submission that demonstrates real control, judgement and self-awareness, rather than one that merely covers the required fields.
How to Write an ICAAP Narrative That Shows Real Capital Judgement
This guide sets out how to construct an ICAAP document that evidences genuine board-level thinking about capital adequacy, not formulaic compliance. After reading, you will know how to sequence the narrative, where to place judgement, and how to make the document defensible under supervisory challenge.
How to Prepare a Credible Response to a Section 165 Request
This guide explains how to respond to an FCA or PRA Section 165 information request with the rigour, accuracy and timeliness regulators expect. After reading it, you will know how to mobilise the right people, control the production process, and engage credibly with the supervisor throughout.
How to Prepare a Credible ILAAP Submission That Reflects Genuine Liquidity Risk Thinking
This guide sets out how to produce an ILAAP that demonstrates real liquidity risk understanding rather than template compliance. Readers will finish with a clearer view of what supervisors actually test, where submissions typically fall short, and how to build a document the board can defend.
How to Build a Credible ICAAP Narrative That Withstands Supervisory Scrutiny
This guide explains how to construct an ICAAP document that reads as a genuine articulation of risk, capital adequacy and board ownership rather than a compliance artefact. After reading, you will know what supervisors actually test for, where most narratives fall apart, and how to sequence the work so the story holds together under challenge.
Where a specific question needs an outside answer, quickly
Polar Insight's Expert Network connects leadership teams with practitioners who can speak to a precise regulatory, commercial, or stakeholder question before a decision is finalised.
Explore Expert Network