PRA issues a further Dear CEO Letter over Regulatory Reporting
The PRA remains concerned over the quality of regulatory reporting following the findings of a series of recent S.166 reviews.
The PRA on Friday (10 September) issued a further Dear CEO letter in relation to regulatory reporting. The previous letter issued in October 2019 set out the PRA’s expectations for regulatory reporting, including the requirement for firms to demonstrate their adherence to standards, which was followed by a series of S.166 reviews.
The latest letter reflects on the findings of those reviews and it is clear that the PRA remains concerned with progress in the areas outlined in its original letter. The tone expresses growing frustration that the industry is not meeting the standards expected of it, with a concluding reminder that, where a firm falls short of its expectations, the PRA will consider the full range of supervisory responses and enforcement powers at its disposal.
The PRA has stated on more than one occasion that it expects firms to exercise the same rigour in their regulatory reporting as they apply to their financial reporting. The industry has often found this challenging, owing to growing complexity of rules, changes in their business and the need for greater investment. However, the PRA is clear that it is not willing to compromise, and that all firms need to achieve this level of quality within their regulatory reporting framework.
Overall, we were disappointed to find significant deficiencies in a number of firms’ processes used to deliver accurate and reliable regulatory returns. It was clear that multiple firms did not treat the preparation of their regulatory returns with the same care and diligence that they apply to financial reporting shared with the market and counterparties… …We expect all firms to submit reliable and accurate regulatory returns and for the regulatory reporting process to receive no less rigour than financial reporting.
Key thematic findings
Many firms across the industry, including many of the largest banks, have implemented significant enhancement or remediation programs to further improve their regulatory reporting frameworks. However, based on the the PRA’s feedback from S.166 reviews commissioned to date, it is clear that there is still work to do in this area. The key thematic findings include:
- Governance and ownership
- “Senior accountability and ownership is fundamental to the production and integrity of a firm’s financial information and regulatory reporting” - responsibilities are dispersed and delegated too far down the organisation.
- The senior manager accountable for regulatory reporting should be “empowered to have overall oversight of the effectiveness of front-to-back processes and cross-functional processes to ensure the delivery of accurate and reliable regulatory returns"
- “There should be robust processes for independent testing and validation, including internal audit, to ensure regulatory returns are reliable and accurate”
- “…poor governance around key regulatory interpretations including a lack of basic documentation, periodic reviews, and/or appropriate sign-off”
- Controls
- “Poor documentation [of operating models] led to a lack of understanding of both the controls and their effectiveness, and ultimately errors in reporting. This was exacerbated by the high degree of manual intervention in the end to end processes for regulatory returns.”
- Where IRB models were used, the control environment around them was not sufficient, with poor record keeping of model approvals and the chronology of model changes that require regulatory approval or notification.
- Firms were seen to use too many end user computing (EUC) solutions, which were insufficiently overseen, documented or controlled
- Reconciliation processes for regulatory reporting were insufficiently robust “We expect firms to have a formal and comprehensive process reconciling regulatory flows to appropriate records, including the general ledger, for every submission cycle"
- Data and Investment
“…many firms have not prioritised investment in regulatory reporting, leading to reduced capacity and capability compared with financial reporting. Focus is often placed on implementing tactical fixes rather than strategic ones. In particular, a lack of strategic investment at some firms has led to outdated reporting system infrastructure and the need for significant manual intervention to fill data and system gaps.”
What should Boards, Audit Committees and Senior Management be doing
The PRA letter is clear that firms have not made sufficient progress in improving their governance and control frameworks for regulatory reporting, and that where the PRA has concerns over the quality of reporting it will not hesitate to take action. It concludes:
…we will continue to use a range of available options including further skilled person reviews. We would also note that, where individual firms fall short of our expectations, we will consider the full range of supervisory responses and enforcement powers at our disposal.
Firms that have been the subject of S.166 reviews should have clearly articulated, resourced and funded plans to remediate any findings.
Firms that have not had S.166 reviews should carefully review the letter and assess their regulatory reporting processes to ensure that their infrastructure, controls and governance meet PRA expectations. If there are gaps, plans should be put in place to address any shortcomings in short order in expectation that a S.166 may arise.
How we can help
Our Regulatory Reporting experts have a wealth of experience working with a range of financial institutions to review capital, leverage, liquidity and other core regulatory requirements to help strengthen the end to end framework for regulatory reporting.
We offer a range of scopes for assurance review, which can be tailored according to individual requirements, benchmarking against the ICAEW framework (TECH 03/17/FSF) and our target operating model for best in class regulatory reporting.
Our team also includes individuals who have worked for regulators, in regulatory reporting and financial control functions and in the business, with the ability to leverage strong data analytics capabilities.
