SMF11 Chair of the Audit Committee: Responsibilities, Approval and CP26/37

SMF11, the Chair of the Audit Committee function, is the senior management function held by the non-executive director who chairs the board committee overseeing the firm's internal audit system. It applies only at Enhanced firms and dual-regulated firms that have such a committee. It is an approved role today; the FCA's CP26/37 and the PRA's CP14/26 propose to make it notified.

What SMF11 covers

SUP 10C.5A.9R defines the chair of the audit committee function as having responsibility for chairing, and overseeing the performance of, any committee responsible for the oversight of the firm's internal audit system, including a committee set up under the internal audit requirements for SM&CR firms. The test is the committee's job, not its name: an "Audit Committee", an "Audit and Risk Committee" or an "Audit and Compliance Committee" all count if they oversee internal audit.

The holder is a non-executive director, often a qualified accountant or former audit partner. Audit committees also commonly oversee financial reporting and the external auditor. SYSC 4.1.11G describes an audit committee as examining management's controls, compliance arrangements and the internal audit function, and acting as the link between management and the external auditors, with formal terms of reference.

SMF11 works closely with SMF5, the Head of Internal Audit. SMF5 runs internal audit; SMF11 protects its independence and holds it to account. See our SMF5 guide.

If a firm sets up an audit committee voluntarily, chairing it is still SMF11 (SUP 10C.5A.2G).

Example: an Enhanced asset manager outsources internal audit to an accounting firm. The non-executive who chairs its audit committee holds SMF11, approved by the FCA, and is the natural holder of the prescribed responsibility for the independence of outsourced internal audit.

For the full set of roles see our Senior Management Functions guide.

Which firms need an SMF11

SUP 10C Annex 1 lists SMF11 only for Enhanced firms. CP26/37 confirms that at dual-regulated firms SMF11 is a PRA function, defined in the PRA Rulebook.

What the SMF11 holder is personally accountable for

Statement of Responsibilities. This is the document, held by the regulator, that lists what this person answers for. For SMF11 it records chairing the audit committee and overseeing its performance, plus prescribed responsibilities. It should be less extensive than an executive's (SUP 10C.11.34G). Our guide to statements of responsibilities covers drafting.

Prescribed responsibilities. These are specific duties the rules require a firm to give to a named senior manager. SYSC 24 Annex 2 names SMF11 as the most appropriate holder of:

• PR J: safeguarding the independence of, and overseeing the performance of, the internal audit function, including the SMF5 holder
• PR J-2: at certain insurers that outsource internal audit, providing for an effective internal audit function and overseeing it
• PR J-3: at Enhanced firms, taking reasonable steps to ensure everyone performing outsourced internal audit is independent of the people performing external audit

At dual-regulated banks the PRA's PR J must go to an oversight function such as SMF11 (PRA Allocation of Responsibilities).

Conduct Rules. The SMF11 holder must follow the Individual Conduct Rules, including Rule 6 on the Consumer Duty, and the Senior Manager Conduct Rules SC1 to SC4 in COCON 2. SC4, disclosing what the regulator would reasonably expect to know, matters most for an audit chair, because audit findings are often the first sign of a reportable problem.

Duty of Responsibility. Under section 66A(5) of FSMA the regulator can act against a senior manager if the firm breaches a requirement in their area and they did not take reasonable steps to prevent it. For SMF11 the area is the committee's oversight of internal audit. DEPP 6.2.9-EG recognises that a non-executive's reasonable steps may differ from an executive's, and lists factors such as whether the person sought independent expert opinion where appropriate. The FCA's expectations of a committee chair are in COCON 1 Annex 1.

Reasonable steps in practice

Our article on senior manager reasonable steps sets out the general standard. For an audit committee chair, these records carry the weight.

The overdue actions report is often decisive. A committee that sees the same overdue finding for three meetings and records no response has not taken reasonable steps.

The first 90 days in the role

• Read the handover pack, the last year of committee papers, the current internal audit plan and recent external audit management letters. Enhanced firms must have handover procedures under SYSC 25.9.
• Agree your Statement of Responsibilities, including PR J and PR J-3 where they apply.
• Meet SMF5 privately and confirm the reporting line runs to you.
• Meet the external audit partner without management present.
• Review the terms of reference and annual committee calendar.
• Test the overdue actions tracker: is every finding owned and dated?
• If internal audit is outsourced, review the contract and the provider's independence from the external auditor.
• Meet the risk committee chair to agree how audit findings feed risk oversight.

Applying for approval

Today the firm applies on Form A. At an Enhanced firm the FCA approves; at a dual-regulated firm the PRA approves with the FCA's consent (SUP 10C.9.11G). The firm must first be satisfied the candidate is fit and proper; see our guide to fitness and propriety.

• Criminal records check: no more than 6 months old when the firm applies. Not needed for a move within the firm or group, or where the firm already checked the candidate as a board director (SUP 10C.10.16R).
• Regulatory references: from the current employer and anyone who employed the candidate in the past six years, given within four weeks.
• Competence: financial and audit expertise, a skills gap analysis and an induction plan.
• Interview: possible where questions arise; at dual-regulated firms either regulator or both may interview.
• Timing: three months from a complete application; the FCA has committed to work to two months.

The candidate cannot start a planned appointment before approval. The temporary cover rule covers only a temporary or reasonably unforeseen absence, for up to 12 weeks, or until the regulator decides if the firm applies within those 12 weeks. Acting without approval exposes the person to action under section 63A of FSMA.

What CP26/37 would change for SMF11

CP26/37 proposes that SMF5, SMF10, SMF11, SMF12, SMF13, SMF14 and SMF15 become notified at dual-regulated and Enhanced firms. SMF11 is on the list.

• At Enhanced solo-regulated firms SMF11 is an FCA function: the firm would notify the FCA through My FCA.
• At dual-regulated firms SMF11 is a PRA function: the PRA's CP14/26 also lists it as notified, so the firm would notify the PRA, with no need to copy the FCA.

The firm would still complete the full fitness and propriety assessment, criminal records and right to work checks, regulatory references and a Statement of Responsibilities before notifying, and the holder of PR A answers for that vetting. Notifications can be made up to three months ahead and take effect on acknowledgement or the start date. The regulators keep a power to require pre-approval in exceptional cases. The Duty of Responsibility and Conduct Rules are unchanged.

On prescribed responsibilities, the FCA would keep only PR A, PR D, PR Z and, for Enhanced firms, PR J-3. PR J-3 is normally allocated to an oversight senior manager, and an Enhanced firm's audit committee chair is a natural holder. PR J would go as an FCA prescribed responsibility. The FCA uses SMF11 as its example: a firm will not need to rewrite SMF11's oversight of internal audit as another responsibility in the Statement of Responsibilities, because it is plain from the role. The PRA's summary of the prescribed responsibilities it proposes to remove does not mention its PR J.

Other changes: Statements of Responsibilities kept current rather than refiled; temporary cover of 18 weeks, with a "reasonable use" test for FCA functions while the PRA keeps its test for PRA functions; and applications accepted until commencement, with notifications for later start dates from one month before. Consultation closes on 22 January 2027; final rules are expected in the first half of 2027, in force around six months later, subject to the Financial Services and Markets Bill. See our CP26/37 article.

Holding SMF11 with other functions

• SMF10, Chair of the Risk Committee: a CRR firm that is not significant may combine the two committees (SYSC 7.1.18AAG), and the chair then holds SMF10 and SMF11. See our SMF10 guide.
• SMF14, Senior Independent Director: a common combination.
• SMF9, Chair of the Governing Body: possible, but an audit chair who also chairs the board is overseeing the internal audit of a board they lead. See our SMF9 guide.
• Executive roles: SYSC 24 Annex 2 treats PR J as hard to justify for executive SMFs such as SMF1 to SMF6, because internal audit must be independent of the people it audits. At large insurers, PRA rules bar a group executive from chairing the audit committee.

How we support SMF11 holders

We prepare audit committee chairs for approval and for notification under the new rules, working from the committee's actual papers. See our Senior Manager training and SM&CR support.

• one-to-one Senior Manager training built on the person's own Statement of Responsibilities
• drafting and review of the Statement of Responsibilities
• the Form A application and fitness and propriety file
• FCA interview preparation
• handover arrangements