How to Structure a Section 166 Skilled Person Review Response
This guide sets out how senior leaders in regulated firms should structure their response to a Section 166 skilled person review, from the moment the requirement notice arrives to the remediation phase. It covers governance, evidence, stakeholder handling, and the judgement calls that determine whether the firm emerges credibly or damaged.
A Section 166 notice is not a routine audit. It is the FCA or PRA formally borrowing a third party's eyes to test something they are already concerned about, at the firm's cost. How the firm responds shapes supervisory posture for years. The response is judged as much on conduct and candour as on technical remediation.
Read the requirement notice properly before doing anything else
The scoping document defines everything that follows. Read it against the supervisory correspondence that preceded it. Identify what the regulator is actually worried about, which is often broader than the literal scope. Map the notice to your own known issues: control weaknesses raised in internal audit, matters flagged by the second line, near misses. If there is a gap between what the regulator has asked about and what you know is fragile, plan for that gap to close during the review.
Agree the scope in writing with the regulator and the skilled person before work starts. Ambiguity here costs months later.
Set up governance that will hold under pressure
Appoint a single accountable executive, usually the relevant SMF holder, with authority to commit resources and make disclosure calls. Establish a steering committee that meets weekly, with legal, compliance, the relevant business line, and a board representative. The board, or the appropriate committee, should receive structured updates at every scheduled meeting and ad hoc when material findings emerge.
Document decisions contemporaneously. If a judgement call is made about scope, evidence, or disclosure, record the reasoning at the time. Reconstruction after the fact reads badly.
Build the evidence operation
Set up a dedicated data room with version control and access logs. Nominate evidence coordinators in each affected function. Every document going to the skilled person should be reviewed for accuracy, completeness, and consistency with other material already provided. Contradictions between submissions damage credibility more than the underlying issue usually would.
Keep a live log of every question asked, every document provided, and every meeting held. This becomes essential when the draft report arrives and you need to respond to specific findings.
Engage the skilled person substantively
The skilled person is independent and reports to the regulator, but they are not adversarial. Give them access, context, and the internal analysis you have already done. Withholding known issues in the hope they will not be found is the single biggest mistake firms make. Skilled persons are experienced. They find things. When they find something you knew about and did not raise, your credibility collapses.
Be direct about weaknesses. Explain what you have already done and what is planned. A firm that has diagnosed its own problem and started fixing it is treated very differently from one that appears to have been caught.
Handle the draft report with discipline
You will typically have a chance to comment on factual accuracy. Use it precisely. Correct factual errors with evidence. Do not use the comment process to argue with characterisations or conclusions, which reads as defensive and rarely changes the report. If you disagree with a material finding, address it through your own management response, not by attempting to soften the reviewer's language.
Own the remediation
The report is the beginning, not the end. Build a remediation plan with named owners, realistic dates, and evidence requirements for closure. Report progress to the regulator on the cadence they expect. Independent validation of closure, often by internal audit or a separate third party, is usually worth the cost.
What good looks like
A firm that treats a Section 166 as an opportunity to demonstrate competent self-governance, rather than a threat to be contained, changes its supervisory relationship for the better. The reverse is also true. Defensive, incomplete, or inconsistent responses inform enforcement referrals.
The decision point now: is your governance structure genuinely capable of running this response, or does it need reinforcing before the first meeting with the skilled person?
Frequently Asked Questions
Should we use external legal counsel throughout?
Yes, for material reviews. Counsel helps with privilege, disclosure judgements, and interaction with the regulator. Choose a firm with direct FCA or PRA experience, not just a general regulatory practice.
How much should the board be involved?
More than most boards expect. The board should approve the response strategy, receive regular updates, and personally review the draft report and management response. Skilled person reviews frequently surface governance findings, and board engagement is itself part of what is assessed.
Can we challenge the skilled person's findings?
You can and should correct factual errors with evidence. Challenging judgement-based conclusions rarely succeeds and often damages your position. If you genuinely disagree, set out your view in the management response and demonstrate it through remediation.
What if we find something worse than the original scope during the review?
Raise it, with the skilled person and, through appropriate channels, with the regulator. Concealment discovered later is treated as a separate and more serious matter. Proactive disclosure, with a clear plan, is almost always the better path.
How long do these reviews typically take?
Three to nine months for the review itself, with remediation running twelve to twenty-four months beyond that. Plan resourcing accordingly. Under-resourcing the response is a common and visible failure.
Frequently asked questions
Should we use external legal counsel throughout?
Yes, for material reviews. Counsel helps with privilege, disclosure judgements, and interaction with the regulator. Choose a firm with direct FCA or PRA experience, not just a general regulatory practice.
How much should the board be involved?
More than most boards expect. The board should approve the response strategy, receive regular updates, and personally review the draft report and management response. Skilled person reviews frequently surface governance findings, and board engagement is itself part of what is assessed.
Can we challenge the skilled person's findings?
You can and should correct factual errors with evidence. Challenging judgement-based conclusions rarely succeeds and often damages your position. If you genuinely disagree, set out your view in the management response and demonstrate it through remediation.
What if we find something worse than the original scope during the review?
Raise it, with the skilled person and, through appropriate channels, with the regulator. Concealment discovered later is treated as a separate and more serious matter. Proactive disclosure, with a clear plan, is almost always the better path.
How long do these reviews typically take?
Three to nine months for the review itself, with remediation running twelve to twenty-four months beyond that. Plan resourcing accordingly. Under-resourcing the response is a common and visible failure.
Related guides
How to Structure a Skilled Person Review Response That Minimises Supervisory Escalation
This guide sets out how to respond to a Section 166 review in a way that demonstrates genuine engagement, accurate self-assessment, and credible remediation. After reading, you will know how to sequence your response, manage the skilled person relationship, and present findings to your regulator in a way that supports supervisory confidence.
How to Structure a Wind-Down Plan That Supports Solvent Exit
A practical guide to building a Wind-Down Plan that meets the FCA's expectations under WDPG and genuinely supports a solvent exit. After reading, you will know what the FCA tests for, where firms commonly fall short, and how to sequence the work so your plan holds up under supervisory review.
How to Structure an SMCR Statement of Responsibilities That Withstands FCA Scrutiny
A practical guide to drafting Statements of Responsibilities that give the FCA a clear, defensible picture of individual accountability. Readers will finish with a working method for identifying gaps, allocating Prescribed Responsibilities cleanly, and keeping SoRs aligned with how the firm actually runs.
How to Structure an RRP Data Submission That Meets Bank of England Expectations
A practical guide to assembling a Recovery and Resolution Plan data submission that withstands Bank of England review under the RRD framework. Readers will finish with a clearer view of sequencing, data lineage, and the judgement calls that separate credible submissions from those that trigger follow-up challenge.
How to Structure a MIFIDPRU ICARA That Withstands FCA Scrutiny
A practical guide to building an ICARA document that demonstrates genuine understanding of harm, capital and liquidity adequacy under MIFIDPRU. Readers will come away with a clearer view of what the FCA expects, where firms typically fall short, and how to sequence the work so the document reflects real governance rather than retrofitted analysis.
Where a specific question needs an outside answer, quickly
Polar Insight's Expert Network connects leadership teams with practitioners who can speak to a precise regulatory, commercial, or stakeholder question before a decision is finalised.
Explore Expert Network