Responding to a Section 166 Review: A Practical Guide
This guide sets out how to run an effective response to a Section 166 skilled person review, from scoping through to remediation. After reading, you will know how to resource the review properly, manage the skilled person relationship, and position findings in a way that strengthens your standing with the regulator.
A Section 166 notice is not a procedural inconvenience. It is a signal that the FCA or PRA wants independent assurance on something it does not yet trust you to evidence yourself. How you respond over the following weeks will shape supervisory posture for years, influence capital and permissions conversations, and set the tone for any enforcement referral decision. The firms that come through well treat the review as an opportunity to demonstrate genuine control, not as a document production exercise.
Treat scoping as the most important phase
Most firms underweight scoping because the skilled person has not yet been appointed or the regulator has issued a draft requirement notice. This is the moment of maximum influence. Push for precision on the review period, the population to be tested, the methodology (controls-based, outcomes-based, or both), and what will constitute sufficient evidence. Ambiguity here becomes expensive later when the skilled person interprets scope broadly and you have no basis to push back.
If the regulator's draft scope misses the actual risk or includes areas where you have already remediated, say so with evidence. Credible challenge at scoping stage is welcomed. Pushing back after findings land is not.
Build the response team properly
Appoint a single accountable executive, usually a SMF holder, with authority to make decisions in real time. Underneath, you need a dedicated programme team: a review lead, a legal lead (internal or external), a data and evidence lead, and senior business representatives from each in-scope area. This is not a job for the second line alone. If the business owners of the processes under review are not visibly engaged, the skilled person will notice and the regulator will hear about it.
Book the time. A material Section 166 will consume 20 to 40 percent of several executives' calendars for three to six months. Plan for that explicitly rather than pretending it fits around the day job.
Manage the skilled person relationship with care
The skilled person reports to the regulator, not to you. Treat them as an independent professional whose job is to form an honest view. That means:
- Give them full access to people, systems and documents, including unflattering ones.
- Do not filter interviewees or coach them on messaging. If someone is anxious, prepare them on process and factual accuracy, not on narrative.
- Respond to information requests fast and completely. Delay is read as obstruction.
- Ask for regular informal readouts so you can address misunderstandings on fact, not challenge judgement after the report lands.
Where you genuinely disagree with an emerging finding, raise it early with evidence. Reserved disagreement in a formal response letter at the end carries far less weight than a documented factual correction mid-review.
Get ahead of findings
The strongest signal you can send is that you found problems before the skilled person did and were already fixing them. Run your own parallel diagnostic from the moment the notice arrives. If you identify issues, disclose them, log them, and start remediation. This is not about managing optics. It is about demonstrating that your control environment actually works.
Beware the opposite failure: minimising findings in management responses, arguing against clear evidence, or committing to remediation you cannot deliver. All three damage credibility more than the original issue.
Design remediation that will survive scrutiny
Remediation plans should address root cause, not symptoms. If the finding is poor consumer outcomes, the fix is not a new policy document. It is a change to the operating model, the incentive structure, the data flows, or the governance. Build in independent validation of closure, with evidence standards agreed up front. Expect the regulator to come back and test whether remediation stuck.
The decision point
Before the skilled person starts fieldwork, hold an honest internal session: do we know what they will find, and are we comfortable with it? If the answer is no, start remediating now. If the answer is yes, resource the response to prove it.
Frequently Asked Questions
Who should own the Section 166 response internally?
A named SMF holder with executive authority, supported by a dedicated programme team. Delegating primary ownership to compliance or internal audit alone signals the firm does not take it seriously.
Should we use external legal counsel?
Usually yes, particularly where there is a realistic prospect of enforcement referral or where privilege considerations around the parallel internal diagnostic are material. Engage them early, not after findings emerge.
How candid should we be with the skilled person?
Fully candid on fact. Filtering, selective disclosure, or coached testimony tends to surface and is treated far more seriously than the underlying issues.
What if we genuinely disagree with a finding?
Raise it during the review with evidence, not in a management response at the end. If the disagreement is on judgement rather than fact, document your reasoning clearly and accept that the skilled person's view will carry weight with the regulator.
How do we know remediation is enough?
When an independent party can evidence that the root cause has been addressed, the control is operating effectively over a sustained period, and the outcomes the regulator cared about have measurably changed.
Frequently asked questions
Who should own the Section 166 response internally?
A named SMF holder with executive authority, supported by a dedicated programme team. Delegating primary ownership to compliance or internal audit alone signals the firm does not take it seriously.
Should we use external legal counsel?
Usually yes, particularly where there is a realistic prospect of enforcement referral or where privilege considerations around the parallel internal diagnostic are material. Engage them early, not after findings emerge.
How candid should we be with the skilled person?
Fully candid on fact. Filtering, selective disclosure, or coached testimony tends to surface and is treated far more seriously than the underlying issues.
What if we genuinely disagree with a finding?
Raise it during the review with evidence, not in a management response at the end. If the disagreement is on judgement rather than fact, document your reasoning clearly and accept that the skilled person's view will carry weight with the regulator.
How do we know remediation is enough?
When an independent party can evidence that the root cause has been addressed, the control is operating effectively over a sustained period, and the outcomes the regulator cared about have measurably changed.
Related guides
How to Prepare for an FCA Supervisory Visit: A Practical Guide
This guide sets out how senior leaders in regulated firms should prepare for an FCA supervisory visit, covering document readiness, stakeholder alignment, and how to engage credibly on the day. After reading it, you will know what to prioritise in the weeks before the visit, what good looks like in the room, and where firms most often undermine themselves.
How to Structure an SM&CR Statement of Responsibilities to Avoid Accountability Gaps
This guide sets out how to draft a Statement of Responsibilities that stands up to FCA and PRA scrutiny without creating unintended liability. Readers will learn how to allocate prescribed responsibilities cleanly, close overlap and gap risks, and produce a document that supports rather than undermines the SMF holder.
How to Prepare for a PRA Periodic Summary Meeting as CEO or Chair
This guide sets out how CEOs and Chairs of PRA-regulated firms should prepare for a Periodic Summary Meeting, from pre-reading the PSM letter to anticipating supervisory challenge. After reading, you will know what the PRA is actually testing, how to prepare substantively, and what good engagement looks like on the day.
How to Prepare for a Regulator Meeting When the Rules Are Open to Interpretation
A practical guide for senior leaders preparing for a regulator meeting where the published rules leave genuine room for interpretation. Covers how to form a defensible position, anticipate the supervisor's reading, and engage credibly without overclaiming certainty.
What Regulators Actually Read For When They Open Your Submission
This guide explains what UK and international financial regulators are genuinely assessing when they review a submission, from authorisation packs to thematic responses. After reading it, you will know how to prepare a submission that demonstrates real control, judgement and self-awareness, rather than one that merely covers the required fields.
Where internal confidence may exceed external evidence
Polar Insight helps leadership teams test critical assumptions against stakeholder, market, regulatory, and operational reality before risk compounds.
Explore Stakeholder Proximity