‘Wake-up call’ for UK financial firms as internal control failures drive £1bn fines
UK financial services firms, which faced £1bn worth of fines since 2021 for internal control failings, should be “seriously concerned”, says the Chartered Institute of Internal Auditors (CIIA).
More than half of the 97 Financial Conduct Authority (FCA) enforcement cases analysed by CIIA relate to firms “not getting the basics right”, with many linked to poor anti-money laundering oversight and fraud prevention.
The CIIA said the failings “have caused significant consumer and market harm”, affecting millions of customers, and cited financial services giants including Nationwide, Starling, HSBC, and Barclays for weak internal controls.
Many companies were already warned by internal auditing teams about internal weaknesses, but failed to act or address issues, including in high-risk areas such as financial crime.
“When more than half of FCA fines are rooted in internal control failures, to the value of over £1bn, this should seriously concern boards across the financial services sector and beyond,” CIIA president, Arleen McGichen, said.
McGichen added that in high-risk areas such as anti-money laundering, “there should be zero tolerance” for internal failings.
‘Wake up call’ for management and audit groups
Alongside this, thirteen of the financial services providers were found to be operating without an internal audit system at all, suggesting “potential gaps in the scope of the FCA’s current rules and regulations.”
The findings should be taken as a “wake-up call” for senior management, audit committees, board members, and both regulators and auditors, who should consider strengthening internal controls.
Along with the FCA, the CIIA has urged the Prudential Regulation Authority (PRA) to strengthen its supervisory approach, which oversees more than 1,500 financial institutions, including insurance companies, banks, and major investment companies.
Regulators should move beyond oversight and instead directly challenge firms when their audit coverage is weak and step in if high-risk areas, including financial crime, are “delayed, superficial, or non-existent,” the body stated.