Many companies were already warned by internal auditing teams about internal weaknesses, but failed to act or address issues, including in high-risk areas such as financial crime. “When more than half of FCA fines are rooted in internal control failures, to the value of over £1bn, this should seriously concern boards across the financial services sector and beyond,” CIIA president, Arleen McGichen, said. McGichen added that in high-risk areas such as anti-money laundering, “there should be zero tolerance” for internal failings.

‘Wake up call’ for management and audit groups Alongside this, thirteen of the financial services providers were found to be operating without an internal audit system at all, suggesting “potential gaps in the scope of the FCA’s current rules and regulations.” The findings should be taken as a “wake-up call” for senior management, audit committees, board members, and both regulators and auditors, who should consider strengthening internal controls. Along with the FCA, the CIIA has urged the Prudential Regulation Authority (PRA) to strengthen its supervisory approach, which oversees more than 1,500 financial institutions, including insurance companies, banks, and major investment companies. Regulators should move beyond oversight and instead directly challenge firms when their audit coverage is weak and step in if high-risk areas, including financial crime, are “delayed, superficial, or non-existent,” the body stated.