The report found that the organisation’s existing approach to incident response and crisis management is 'inadequate', and criticised the FCA for not implementing a single framework to support staff in providing effective responses to incidents and potential crisis situations.
As a result, it is not possible to establish who is accountable for the FCA’s approach to incident response and crisis management, who has approved delegated authority to act on behalf of the FCA, or what the roles and responsibilities of particular FCA staff members are during a crisis.
It also concluded that further work is required to improve the capability of FCA staff members to implement appropriate and timely responses to incidents.
A seperate report also found that there is still a lack of awareness amongst FCA staff of the risks associated with the handling of market sensitive information.
The FCA previously came under fire for announcing a probe into closed-book policies, causing shares of major insurance companies to drop by up to 22% before the review was clarified.
In October 2015, the FCA responded to a Treasury Select Committee report which criticised the regulator's handling of market sensitive information by agreeing to all of the TSC's 22 recommendations, including a programme of annual reviews.
In the audit report, FCA management responded:
"It is evident that as an organisation, we run a number of very different risks whilst trying to ensure that we meet our statutory objectives. Risks and issues can crystallise from a number of sources and areas (e.g. people, firms, markets etc), which are difficult to predict and often unexpected. In addition, these risks and issues can migrate into ‘incidents’ or a ‘crisis’ within a rapid time frame. As such, it is imperative for the organisation that our incident response and crisis management processes work well and are embedded within all the relevant areas. As such, we take seriously any findings in relation to this area.
"We accept that the overall structure in place does not provide sufficient clarity within the organisation, and would benefit from the implementation of a single consistent framework, with clear lines of delegated authority and which is embedded within the organisation.
"We will enhance the current frameworks structure to provide a single framework to meet your ‘recommended outcomes’. We intend to continue utilising the principles of ensuring that any framework we implement is complementary to existing frameworks, and is simple, clear and easy to invoke. Additionally, as suggested above, due to the complexity and pace of issues faced, we will provide clear policies and processes for staff for a variety of scenarios, including the uncontrolled release of price sensitive information. However, in practice we are reliant on the judgment of our staff to act appropriately in specific circumstances, so we cannot be overly prescriptive. We must continue to trust our staff to be able to exercise their judgement in dealing with issues and allow them to be empowered to make decisions. We agree that we will make regular review of, and test the framework, and agree that lessons from exercising against various scenarios will allow us to further improve the framework."
The FCA received further criticism last week when MPs debated a motion of no confidence in the FCA, in which it was described as "weak, toothless and anaemic".
Conservative MP Guto Bebb argued that the FCA is 'not fit for purpose', citing the regulator's redress scheme for the mis-selling of interest rate swap products, the handling of the Connaught Income Fund, the FCA’s involvement in the report on the failures of HBOS, and the decision not to move ahead with the review of banking culture.
