How to Structure a Skilled Person Review Response That Minimises Supervisory Escalation

A Section 166 notice is a signal that your regulator has lost a degree of comfort in an area of your firm. The response you build over the following weeks and months will either rebuild that comfort or deepen the concern. The quality of that response is less about rhetoric and more about whether the firm has genuinely understood what went wrong, owns it, and can fix it.

Understand what the regulator is actually testing

A Section 166 is rarely only about the technical subject matter. The regulator is also testing whether the firm can diagnose its own weaknesses, whether senior management genuinely owns the issues, and whether the control environment will hold up under future stress. Your response needs to answer all three questions, not just the first.

Read the scoping letter carefully and in full. The phrasing of the scope, the lookback period, and the reporting requirements tell you what the supervisor is worried about. If the scope feels wider than the stated concern, that is usually deliberate.

Set up the response with the right governance

Appoint a single accountable executive, usually an SMF, to own the firm's side of the review. Stand up a steering group with legal, compliance, risk, and the relevant business head. Brief the board early and schedule regular updates. If the issue touches a prescribed responsibility, the relevant SMF must be visibly engaged throughout.

Agree internally how you will handle disagreement with the skilled person before it arises. The worst outcome is an uncoordinated pushback from a business line that the executive and board have not sanctioned.

Engage the skilled person as an independent assessor

The skilled person is not your adviser and not your adversary. They are performing a regulated function and their report goes to the regulator. Give them full access, complete documents, and candid interviews. Attempts to manage the narrative, selectively disclose, or coach interviewees almost always surface and do serious damage.

Where you disagree with an emerging finding, engage on the evidence, not the conclusion. Provide additional documents, offer further interviews, and ask for the analytical basis. If the finding still stands, accept it and focus your energy on the remediation.

Build a remediation plan the regulator will believe

This is where most firms underperform. A credible plan has: specific actions tied to each finding, named owners at SMF or direct report level, realistic but ambitious timelines, resource commitments (people, budget, external support), interim milestones, and a clear definition of what "done" looks like for each workstream. Include how you will test effectiveness after implementation, not just completion.

Avoid two common failures. First, bundling multiple findings into vague workstreams that lose accountability. Second, committing to timelines the firm cannot meet; slippage against a remediation plan is itself an escalation trigger.

Manage the regulatory conversation

Keep your supervisor informed throughout, not only at report delivery. Flag emerging themes early. Share your intended remediation approach before it is finalised where appropriate. Ensure the messages your supervisor hears from the CEO, Chair, Chief Risk Officer, and skilled person are consistent.

When the final report lands, respond formally and promptly. Acknowledge findings in full, set out the remediation plan, and commit to a reporting cadence. If there are findings you genuinely dispute on evidence, say so clearly and explain why, but do so sparingly.

What good looks like at the close

A well-handled Section 166 can leave a firm in a stronger supervisory position than before it started. The regulator sees a management team that diagnoses honestly, remediates rigorously, and communicates straight. The next decision point is simple: has your firm set up the governance, resourcing, and senior ownership needed to deliver that outcome, or are you still treating the review as a document exercise?

Frequently Asked Questions

Should we challenge findings we disagree with?

Yes, but on evidence and sparingly. Provide the skilled person with additional material and analysis before the report is finalised. Challenging published findings to the regulator without new evidence looks defensive and usually backfires.

How much should the board be involved?

More than most firms assume. The board should approve the response governance, review the remediation plan, and receive regular progress updates. For significant reviews, board minutes should evidence substantive discussion, not noting.

Who should own the remediation plan?

A named SMF with authority, budget, and time to deliver. Shared ownership across functions without a single accountable executive is a common failure mode.

What triggers supervisory escalation after a Section 166?

Usually three things: slippage against remediation timelines, new issues emerging that were in scope but missed, or inconsistent messaging between the firm and the skilled person. All three are avoidable with disciplined execution.

Can we use our own advisers alongside the skilled person?

Yes, and most firms should. Separate legal and remediation advisers help the firm respond effectively without compromising the skilled person's independence. Keep the roles clearly delineated.