Structuring a PRA MRA Remediation Response That Closes Findings Cleanly

Most MRAs do not close on the first attempt. They close on the second or third, after the PRA has seen enough supervisory evidence to be confident the root cause is genuinely addressed, not just the symptom named in the original finding. The firms that close cleanly are the ones that treat the MRA as a precise commitment with defined boundaries, backed by evidence a supervisor can test independently. The firms that struggle are usually the ones that either underscope the response and invite challenge, or overscope it and import adjacent issues the PRA had not raised.

Start with a disciplined reading of the finding

The MRA text is the contract. Pull out the specific control weakness, the risk the PRA attached to it, and any timeline or expectation set out in the supervisory letter. Write these down verbatim. Then articulate, in one paragraph, what closure looks like from the supervisor's perspective. If your team cannot agree on that paragraph, you are not ready to design remediation.

Where the MRA is ambiguous, raise it with your supervisor early rather than guessing. A short clarification call, minuted, is far better than six months of work addressing the wrong problem.

Separate root cause from presenting issue

The presenting issue is what the PRA saw. The root cause is why it happened. A credible response addresses both, but the distinction matters for scoping. If the presenting issue was a data quality failure in regulatory reporting, the root cause might be unclear ownership between finance and risk. Fix the data, but also fix the ownership, and say so explicitly.

What goes wrong: firms either fix only the surface issue (inviting a repeat finding) or launch a sprawling transformation programme that pulls in unrelated control weaknesses, creating new disclosures the PRA then pursues.

Design evidence the supervisor can test

For each remediation action, specify: what was done, who did it, when, how effectiveness was measured, and where the supporting artefacts sit. The PRA should be able to pick any item in your closure pack and trace it to a document, a decision log, or a sample of output. Thin evidence is the main reason MRAs reopen.

Good evidence usually includes: redesigned policy with version control, training completion records, a post-implementation effectiveness review covering at least one full cycle of the control, and independent assurance (second or third line) confirming the control operates as designed.

Sequence governance sign-off properly

Board or committee approval should come after the effectiveness review, not before. Signing off a remediation plan is not the same as signing off closure. The PRA wants to see that the accountable SMF, typically the SMF4 or relevant business SMF, has personally reviewed the effectiveness evidence and formed a judgement that the control now works.

Minute the discussion properly. A line in the minutes saying "the committee noted the update" is not sign-off. The minutes should record the evidence reviewed, the challenge made, and the basis for the closure judgement.

Manage the submission itself

Structure the closure pack with a short executive summary (one page), the original MRA text, the root cause analysis, the remediation actions mapped to the finding, the effectiveness evidence, the governance trail, and the independent assurance opinion. Keep it tight. A 200-page pack signals uncertainty; a focused 30 to 50 page pack signals control.

Submit through your usual supervisory contact with a covering note that states clearly: the firm considers the MRA closed on the basis set out, and welcomes supervisory review.

The decision point

Before you submit, ask one question: if the PRA chose to test this closure with a targeted review or a Section 166, would the evidence stand up without further work? If the answer is anything other than yes, the response is not ready.

Frequently Asked Questions

How long should remediation take before we submit closure?

Long enough for the redesigned control to have operated through at least one full cycle, and for an independent effectiveness review to have been completed. For most control remediations, that means six to twelve months of operation post-implementation. Submitting earlier invites challenge on sustainability.

What if the PRA raises new issues during closure review?

Address them separately rather than folding them into the original MRA. Conflating findings makes it harder to close either. If a genuinely new issue emerges from your own remediation work, self-report it promptly; concealment is far more damaging than the finding itself.

Should we use external assurance?

For material MRAs, yes. Internal audit opinion is usually sufficient for lower-severity findings, but for anything touching capital, liquidity, governance, or risk framework integrity, external independent assurance strengthens the closure case significantly.

What does scope expansion actually look like in practice?

It typically takes the form of follow-on information requests, a widened thematic review, or additional MRAs issued off the back of weaknesses the firm itself disclosed in an overbuilt response. The lesson is to answer precisely, evidence thoroughly, and resist the temptation to demonstrate effort by showing unrelated work.