Compliance Governance Reviews for FCA-Regulated Firms
An independent, evidence-based review of how your firm is really governed: your SMCR arrangements, board and committee effectiveness, risk and compliance frameworks, management information and Consumer Duty oversight. You receive a RAG-rated gap analysis and a prioritised action plan your board can act on straight away.
Why governance is where the FCA starts
SYSC 4.1.1R requires every firm to have robust governance arrangements: a clear organisational structure with well-defined, transparent and consistent lines of responsibility, and effective processes to identify, manage, monitor and report the risks it is or might be exposed to. When something goes wrong, the questions are always the same. Who was responsible? What did the board know? What did it do about it? Can you prove it?
A compliance governance review answers those questions before your supervisor asks them. We test whether your arrangements work in practice, not simply whether the documents exist.
What has changed in 2026
- SMCR Phase 1 reforms (FCA PS26/6). Most changes took effect on 24 April 2026, with further changes from 10 July 2026. They include a revised 12-week rule for replacement Senior Managers, longer validity for criminal records checks, removal of overlapping certification requirements, greater flexibility for SMF18 holders at solo-regulated firms to hold FCA prescribed responsibilities, and revised thresholds for enhanced firms.
- Non-financial misconduct. Changes to the Conduct Rules (COCON), aligned with the FCA's non-financial misconduct policy (PS25/23), apply from 1 September 2026. Your fitness and propriety, conduct breach and HR processes need to reflect them.
- SMCR Phase 2 is coming. HM Treasury intends to legislate to remove the Certification Regime from primary legislation, and the FCA has said it expects to consult on broader reforms later in 2026.
- Consumer Duty board reporting. Under PRIN 2A.8.4R, at least annually your governing body must review and approve the report on the outcomes retail customers are receiving, confirm whether it is satisfied the firm is complying with the Consumer Duty, and assess whether future business strategy is consistent with it.
Less administration is not less accountability. The reforms remove some paperwork. They do not remove the need to show who is responsible for what, what reasonable steps they take, and that your board acts on what it is told.
What a governance review covers
Every review is scoped to your permissions, size and risk profile. A typical review covers three connected areas.
1. SMCR, board and committee effectiveness
- Statements of Responsibilities and allocation of prescribed responsibilities (SYSC 24); management responsibilities maps and handover arrangements for enhanced firms (SYSC 25)
- Evidence of reasonable steps for each Senior Manager
- Certification, fitness and propriety assessments and Conduct Rules training, breach identification and notification, including the non-financial misconduct changes
- Board and committee terms of reference, composition, quality of challenge and decision records
- Accuracy of your FCA Register and Directory entries
2. Risk and compliance frameworks, MI and oversight
- Risk appetite, risk register and risk assessment methodology
- Compliance monitoring programme (SYSC 6): risk-based design, coverage, testing quality and follow-through to closure
- Financial crime oversight: MLRO (SMF17) reporting, business-wide risk assessment and the board's engagement with the MLRO report
- Management information: does it tell the board what it needs to know, and does anyone act on it?
- Breach, complaint and incident escalation; outsourcing and appointed representative oversight where relevant
3. Consumer Duty governance and outcomes
- How the Duty is reflected in strategy, governance, leadership and people policies (PRIN 2A.8.1R)
- Outcomes monitoring across products and services, price and value, consumer understanding and consumer support
- The annual governing body report: content, evidence, challenge and the actions agreed
- Incentives and remuneration that are consistent with good customer outcomes
- Oversight of customers with characteristics of vulnerability and the board Consumer Duty champion role, where one is appointed
How the review works
- Scoping call. We agree the areas in scope, the people we need to speak to and the timetable. You receive a fixed-fee proposal before any work starts.
- Document request and desk review. We review your governance map, Statements of Responsibilities, terms of reference, board and committee packs, minutes, MI, risk and compliance monitoring records and Consumer Duty reporting.
- Interviews. Structured conversations with Senior Managers, non-executive directors, compliance, the MLRO and key staff, testing whether people understand and exercise their responsibilities.
- Observation and testing. Where possible we observe a board or committee meeting, and we trace a sample of issues from MI, to discussion, to decision, to completed action.
- Reporting. A written report with an executive summary, RAG-rated findings mapped to the relevant FCA rules and guidance, root causes, and prioritised recommendations with suggested owners and timescales.
- Board debrief. We present the findings to your board or senior management and answer their challenge. An optional follow-up review confirms that remediation has worked.
What we commonly find
In the firms we have reviewed, the same issues recur, regardless of sector or size:
- Statements of Responsibilities adapted from templates, which do not match who actually makes decisions.
- Minutes recording that papers were "noted", with no evidence of challenge, decision or follow-up.
- MI packs full of data but light on thresholds, trends and analysis, so problems are visible only with hindsight.
- Compliance monitoring plans driven by the calendar rather than by risk, and findings raised but never closed.
- Consumer Duty board reports that describe activity rather than evidencing outcomes.
- Reasonable steps that exist only in a Senior Manager's head, and not on paper.
None of these is difficult to fix once it is identified. All of them are difficult to explain to a supervisor after the event.
When to commission a review
- Ahead of your annual Consumer Duty board report
- After a new Senior Manager appointment, change in control or rapid growth
- Before applying for a Variation of Permission
- Following FCA correspondence, a Dear CEO letter or a supervisory visit
- After a significant breach, complaint spike or incident
- When non-executive directors or investors want independent assurance
- To prepare for SMCR Phase 2
Who we work with
FCA-regulated small and medium-sized firms, including mortgage and general insurance intermediaries, consumer credit firms, payment and e-money institutions, investment managers, claims management companies, fintech firms and cryptoasset businesses.
Why Compliance Consultant
Senior practitioners, not junior checklists
Reviews are led by Lee Werrell, Chartered FCSI, with more than 25 years' experience of FCA regulation, and delivered with our team of senior associate consultants. You speak to people who have sat on the other side of the table.
Independent, proportionate and practical
We tell you plainly what a supervisor would see, and what to fix first. Scope is sized to your firm, and every recommendation is written so the person who owns it knows exactly what to do. Making Compliance Work.
Frequently asked questions
What is a compliance governance review?
It is an independent assessment of how your firm is directed and controlled: who is accountable for what, how the board and committees make and record decisions, whether your risk, compliance and financial crime frameworks work in practice, and how you oversee customer outcomes under the Consumer Duty. It measures your arrangements against FCA rules and guidance, including SYSC, the SMCR rules, COCON and PRIN 2A.
Is this the same as a skilled person (section 166) review?
No. A skilled person review is required by the FCA under section 166 of the Financial Services and Markets Act 2000, and the skilled person reports to the regulator. Our governance review is commissioned by you, for you. Firms often use it to identify and fix weaknesses before they attract supervisory attention.
Do the 2026 SMCR reforms mean we have less to do?
Slightly less administration, but not less accountability. The Phase 1 changes in PS26/6 streamline certain processes, and Phase 2 may go further if legislation proceeds. Your Senior Managers still need clear responsibilities and evidence of reasonable steps, and the non-financial misconduct changes from 1 September 2026 add to what your conduct and fitness processes must capture.
Can you review our Consumer Duty board report?
Yes. We can review the report itself against PRIN 2A.8, or look at the wider picture: the outcomes monitoring behind it, the quality of board challenge, and whether the actions agreed are actually delivered.
How long does a review take?
We agree the timetable at scoping. It depends mainly on the scope, the size of your firm and how quickly documents and interviewees are available.
How are fees set?
After the scoping call we provide a written proposal with a fixed fee, quoted net of VAT, so you know the full cost before any work begins.
Will you share our findings with the FCA?
No. The report is prepared for your firm and how you use it is your decision. If the review identifies a matter that you may need to notify to the FCA, we will tell you so that you can consider your obligations promptly.
Can you help us fix what you find?
Yes. We can support remediation directly, from redrafting Statements of Responsibilities and terms of reference to redesigning MI and your compliance monitoring programme, and we offer ongoing retainer support so improvements are sustained.
Related services
Know where your governance stands before the FCA asks
Book a free, no-obligation discovery call to discuss your firm and the scope of review that would suit it.
UK 0800 689 0190 | International 020 8243 8620 | info@complianceconsultant.org
Compliance Consultant and Compliance Doctor are trading styles of UK Compliance Consultant Limited, Companies House number 14805896.
