Tematilsyn om kontrollfunksjonen og internrevisjonfunksjonen

The headline finding is not a catalogue of individual breaches but a structural weakness: several compliance control plans were insufficiently operationalised and only loosely connected to the firm's actual risk profile. For compliance and internal audit leaders, this is a familiar and portable message. Regulators across Europe — and the FCA in its own supervisory work on fund managers' control environments — are increasingly testing whether plans are executable artefacts with owners, timetables, testing methodologies and evidence trails, rather than narrative documents that restate regulatory text.

A plan that cannot be traced back to a documented risk assessment is now a supervisory finding in its own right. What this means for firms: expect scrutiny of the linkage between enterprise risk assessments, control mapping, monitoring calendars and internal audit coverage. Firms operating across the EEA and UK should assume the same methodology will be applied by their local supervisor.

Recommended actions: (1) re-test whether each control in your plan maps to an identified risk and has a named owner, frequency and evidence standard; (2) check internal audit's risk-based coverage against the same risk picture and document any rationale for gaps; (3) ensure governing bodies receive evidence-based MI on control effectiveness, not status assertions; (4) retain documentation to demonstrate the plan is operated, not just approved. No new rules are introduced, but supervisory expectations on evidence quality are being tightened.