PRA letter on thematic findings on the reliability of regulatory reporting

The PRA has written to bank and building society CEOs with its thematic findings on the reliability of regulatory reporting.

This letter builds on the PRA’s October 2019 letter and incorporates findings from the recent thematic s166 reviews of credit and market risk regulatory returns at a number of market participants. Overall, the letter reflects the PRA’s disappointment that it continues to find significant deficiencies in regulatory reporting arrangements across the industry and its expectations that firms should focus on ensuring that all areas of prudential regulatory reporting frameworks are fit for purpose to deliver complete, timely and accurate regulatory returns.

The PRA expects prudential regulatory reporting processes to be as rigorous as those for financial reporting. This is not a new expectation from the regulator but will require a significant step-change for many firms, where regulatory reporting arrangements are substantially less advanced than those for financial reporting.

A lack of investment in the regulatory reporting infrastructure in the past has increased the risk of material misstatement as a result of fragmented systems, poor data quality and manual workarounds. Firms will need to invest, first to baseline their current reporting arrangements and then to upgrade these arrangements to meet the PRA’s expectations around delivering complete, timely and accurate regulatory returns.

The thematic s166 reviews have confirmed the PRA’s concerns that firms do not meet its expectations on multiple aspects of regulatory reporting and that deficiencies often give rise to material errors in regulatory reporting submissions:

• Governance – relevant senior managers should have effective oversight of end-to-end processes, including cross-functional and jurisdictional processes. This may be challenging in larger firms where different components of the regulatory reporting process are owned by different functions and may reside in multiple global locations. Changes to the role and responsibility boundaries and hand-off arrangements are required in many firms to demonstrate effective ownership of end-to-end regulatory reporting.
• Systems and Data – tactical rather than strategic fixes have resulted in outdated regulatory reporting infrastructure with greater reliance placed on manual processes and controls, increasing the risk of material misstatements. Firms need to invest strategically in reporting infrastructure and in developing complete and accurate regulatory data to deliver accurate regulatory reporting. Appropriate governance review and approval as well as documentation of the approaches, assumptions and judgements adopted is needed where incomplete data is used to calculate and populate returns.
• Controls – regulatory reporting control frameworks have not evolved sufficiently to provide an effective framework to deliver complete and accurate reporting. The PRA expects that significant investment will be required across the industry to:
  • Establish suitable regulatory reporting target operating models;
  • Improve and automate the regulatory reporting system infrastructure;
  • Reduce reliance on manual interventions (e.g. usage of spreadsheets and EUCs); and to
  • Improve the quality and quantum of regulatory reporting resources.
• Interpretations - governance and documentation of regulatory interpretations continue to be below expectations. The PRA expects firms to act now, if they did not do so following the 2019 letter, to improve the depth and quality of interpretational documentation, to establish appropriate governance approval channels and to document approvals on a periodic basis.
• Assurance – regulatory reporting arrangements should be subject to independent validation, testing and review to assess their suitability. We have seen increased focus from Internal Audit functions in the last two years at many firms, but more needs to be done across first line assurance and second line oversight. Delivery of these is likely to require both internal and external assurance to provide full coverage and enable comparison against common industry practice and PRA expectations.
• Documentation – improvements are required across all regulatory reporting components. Issues were identified across documentation of governance and ownership allocation, regulatory interpretations and their approval, controls, model usage and data suitability. This continues the theme from the 2019 letter that firms are expected to have comprehensive documentation in place.
  

The PRA has made it clear that the focus on regulatory reporting is here to stay and that firms need to act now to address any shortcomings in their arrangements. Where firms fall short of the expectations set, the PRA will consider “the full range of supervisory responses and enforcement powers”. We therefore expect a wave of further reviews (including thematic s166 reviews and firm-specific targeted reviews) to follow in the coming months.

As a leading provider of regulatory reporting advisory services and s166s reviews, KPMG is well placed to support firms in assessing the suitability of their regulatory reporting infrastructure, as well as helping them to develop strategic improvement and remediation programmes where existing arrangements may not meet the expectations laid out by the PRA or do not align to common industry practice.

If you would like to discuss the direct implications of the letter for your firm and how KPMG can support you in meeting the PRA’s expectations, please contact us: