The challenge
A regulated firm needed a clear assessment of its control framework and operating evidence following supervisory concerns. Policies, system records, case material and management explanations had accumulated across several submissions. The task was to connect that evidence to the concerns and distinguish historical limitations from current improvements.
What MEMA did
- Agreed a review framework connecting regulatory concerns, the firm’s commitments and the controls to be tested.
- Organised policies, governance records, case packs and system evidence so that subsequent submissions could be assessed against the original position.
- Tested relevant operating records and chronologies rather than relying on policies, walkthroughs or completion declarations alone.
- Considered management responses and later evidence, crediting resolved points and refining requests where a narrower question remained.
- Applied challenge to the findings and reporting, keeping historical evidence gaps distinct from current control design and implementation.
- Set out remaining corrective work and the evidence needed to verify closure, with sustained effectiveness assessed separately.
The review journey
Select a stage to see the work involved.
1. Scope and preparation
Established the review objectives, evidence needs and testing approach.
2. Evidence and testing
Examined the programme, relevant case records and system evidence.
3. Response and reconciliation
Assessed explanations and further material against the points already raised.
4. Challenge and reporting
Refined conclusions, made limitations clear and delivered the review report.
5. Remediation and assurance
Defined the corrective work and separate testing needed to demonstrate operation.
What was delivered
MEMA completed the independent review and delivered a report with a clear remediation framework and supporting evidence trail. The work gave management an organised basis for its next regulatory engagement and corrective programme.
What this does not claim
This case study does not state or imply that the FCA accepted the report, approved the firm’s controls or varied or removed a requirement. It is not a promise of the same outcome for another firm. Public examples elsewhere in this hub are fictional, not extracts from this engagement.
Client-identifying details and distinctive engagement information have been omitted. The worked examples elsewhere in this hub are fictional and do not reproduce the client's records.
Apply the approach to your firm
Build your preparation list or talk to MEMA about a defined review scope.
