• Register
Return to: Home > News > Service Lines > CIIA publishes updated guidance on risk management in UK financial services

CIIA publishes updated guidance on risk management in UK financial services

The UK Chartered Institute of Internal Auditors (CIIA UK) has released guidance on how financial institutions in the UK should manage risks in an updated edition of the Guidance on Effective Internal Audit in Financial Services, widely known as the Financial Services Code.


Q&A: Code on managing risk in UK financial services revamp - CIIA UK policy and external relations director Alisdair McIntosh discusses the changes to the code and how it aims to strengthen the internal audit function within companies. 


The updated guidance builds on the original code which was published in July 2013 in the aftermath of the 2008 financial crisis. The review of the code was initiated by the CIIA and conducted by an independent committee of senior industry members, chaired by Mike Ashley, chair of the audit committee of Barclays and involved two rounds of consultation with the sector between September 2016 and March 2017.

The key changes to the code include the following requirements:

  • Internal audit reporting annually on whether firms are adhering to their risk management framework.
  • Internal audit reviewing actions taken by the firm following any significant adverse event, such as regulatory breaches.
  • Internal audit plans must be regularly reviewed taking into account new and emerging risks.
  • Looking critically at the work of the organisations other control functions in terms of processes and quality.
  • Underlining the central role internal audit should play in assessing the culture of the firm, including whether behaviours are in line with stated values, ethics, risk appetite and policies.
  • Audit committees must discuss objectivity and independence of its chief internal auditors annually after seven years in the role.

CIIA chief executive, Ian Peters, said: “The enhanced Code should help ensure that internal auditors can play their full part in effectively protecting the assets, reputation and sustainability of their organisations. Internal auditors now need to drive these changes forward.  They should demand, and get, stronger backing from audit committees and board.  Boards, in turn, should expect and demand more from internal audit departments.”

Top Content

    Choosing the right location can have cast-iron benefits

    As Game of Thrones, one of the biggest television shows of all time, comes to an end, Joe Pickard looks at how tax incentives offered to television and film production companies help the wider economy.

    read more

    Primary financial statements: a game changer in reporting?

    International Accounting Standards Board chair Hans Hoogervorst delivered a speech at the Seminario International sobre NIIF y NIF, organised by the Consejo Mexicano de Normas de Información Financiera in Mexico. The Accountant presents the highlights.

    read more

    FASB readies standards for the netflix generation

    The US Financial Accounting Standards Board (FASB) has updated its accounting standard for entertainment, with a specific eye on keeping up to date with how episodic content, such as television programmes, is consumed in the modern world. Jonathan Minter reports.

    read more

    Brexit: why it takes two to tango

    Former TA editor Vincent Huck, now editor of Insurance Asset Risk, looks at why Brexit might unleash geopolitical intrigue in Europe’s accounting standard-setting scene – and why IFRS 17 will be an incredible source of opportunity for firms in the coming years.

    read more
Privacy Policy

We have updated our privacy policy. In the latest update it explains what cookies are and how we use them on our site. To learn more about cookies and their benefits, please view our privacy policy. Please be aware that parts of this site will not function correctly if you disable cookies. By continuing to use this site, you consent to our use of cookies in accordance with our privacy policy unless you have disabled them.