SMF5 Head of Internal Audit: Responsibilities, Independence and CP26/37

SMF5, the Head of Internal Audit function, is the senior management function held by the executive who manages a firm's internal audit function and reports on it directly to the board. It applies at Enhanced firms as an FCA function, and at banks and insurers as a PRA function. It is an approved role today; the FCA's CP26/37 and the PRA's CP14/26 propose to make it notified at dual-regulated and Enhanced firms.

What SMF5 covers

The FCA defines the head of internal audit function in SUP 10C.6A, and its guide for solo-regulated firms describes it as the person responsible for managing the internal audit function of a firm and reporting to the governing body on it. The PRA's wording for banks, in rule 3.5 of its Senior Management Functions Part, is responsibility for management of the internal audit function and for reporting directly to the governing body on it.

Internal audit is the third line of defence: the team that checks, independently of management, whether the firm's controls, risk management and governance actually work. SYSC 6.2.1R requires firms within its scope, where appropriate and proportionate, to keep an internal audit function that is separate and independent from the firm's other functions, with an audit plan, recommendations, follow-up of those recommendations and reporting.

Job titles include Chief Internal Auditor, Head of Internal Audit and Group Head of Audit (where the person manages the regulated firm's internal audit).

Example: an Enhanced consumer credit lender appoints a Chief Internal Auditor who leads a team of six and co-sources specialist IT audits from an accounting firm. She needs FCA approval as SMF5, reports to the audit committee chair, and remains accountable for the co-sourced work.

For the full set of roles see our Senior Management Functions guide.

Which firms need an SMF5

SUP 10C Annex 1 lists SMF5 as an FCA function only for Enhanced firms. SYSC 6.2.2G confirms the split: at a PRA-authorised SM&CR firm, managing internal audit is a PRA function (SMF5); at an Enhanced firm, it is an FCA function. The PRA's banking function does not apply to credit unions, and its insurance rules disapply SMF5 for insurance special purpose vehicles (PRA Insurance Senior Management Functions).

A Core firm with an internal audit team does not need its head of audit approved as SMF5.

What the SMF5 holder is personally accountable for

Statement of Responsibilities. This is the document the regulator holds that lists what this person answers for. For SMF5 it records managing internal audit and reporting to the board, the scope of the audit universe and any co-sourced or outsourced work. Our guide to statements of responsibilities covers drafting.

Prescribed responsibilities. These are specific duties the rules require a firm to give to a named senior manager. SMF5 normally holds none. SYSC 24 Annex 2 treats most of them, including PR A, PR D and PR J-3, as hard to justify for SMF5, because an auditor should not own what it audits. The responsibility for internal audit's independence, PR J, belongs to an oversight non-executive, normally the audit committee chair, SMF11 (SYSC 24.3.2G; PRA Allocation of Responsibilities rule 3.2).

Independence. Two rules carry the weight:

• SYSC 6.2.1R: internal audit must be separate and independent from the firm's other functions and activities.
• SYSC 6.2.1BG: firms should make sure that removing or disciplining the head of internal audit cannot undermine that independence. The FCA considers it often appropriate for that decision to need approval by a majority of the board, including a majority of its non-executives.

Reporting line. The definition requires SMF5 to report directly to the governing body. In practice that runs through the audit committee: the SMF11 holder safeguards internal audit's independence and oversees SMF5's performance. Day-to-day administrative reporting to the chief executive is common, but it must not give management control of the audit plan, findings or pay.

Conduct Rules and Duty of Responsibility. The holder must follow the Individual Conduct Rules in COCON 2 and the Senior Manager Conduct Rules SC1 to SC4. SC4, telling the regulator what it would reasonably expect to know, applies directly to serious audit findings. Under section 66A(5) of FSMA, the regulator can act against SMF5 if the firm breaches a requirement within their area, for example a failure the audit plan should have tested, and they did not take reasonable steps.

Reasonable steps in practice

The general standard is in our article on senior manager reasonable steps. For SMF5, the evidence is the audit trail of the audit function itself.

The first 90 days in the role

• Read the internal audit charter, the current plan, the last year of audit committee papers and the overdue actions list.
• Agree your Statement of Responsibilities with the firm and the audit committee chair.
• Meet the audit committee chair privately and confirm the reporting line, private sessions and who sets your objectives and pay.
• Meet the chief risk officer and compliance oversight holder to understand what the second line already covers. See our SMF4 guide.
• Test the overdue actions tracker: are high-rated findings past their date, and who has accepted the risk?
• Review co-source and outsourcing contracts, and the provider's independence from the external auditor.
• Check the plan covers the firm's top risks, then bring any changes to the committee.
• Meet the external audit partner.

Applying for approval

Today the firm applies on Form A. At an Enhanced firm the FCA approves; at a bank or insurer the PRA approves and the FCA must consent. The firm must first be satisfied the candidate is fit and proper under FIT: honesty, integrity and reputation; competence and capability; and financial soundness. See our guide to fitness and propriety.

• Regulatory references: from the current employer and every employer in the past six years (SYSC 22.2.1R), due within four weeks of a request since 24 April 2026.
• Criminal records check: valid for six months; not needed for a move within the firm or group (PS26/6).
• Competence: audit leadership experience in a comparable firm and knowledge of the firm's risks. The FCA does not prescribe a qualification.
• Interview: possible where the FCA or PRA has questions about fitness or the role (How we assess).
• Timing: three months from a complete application under FSMA section 61, with the clock stopped while the regulator waits for information. The FCA has committed to work to two months.

A planned appointment cannot start before approval. The temporary cover rule allows cover for a temporary or reasonably unforeseen absence. For the FCA function, PS26/6 gives the firm 12 weeks to submit an application and the person can act until the FCA decides; at banks and insurers SMF5 follows the PRA's own temporary cover rule. Acting without approval outside that rule exposes the person to action under section 63A of FSMA.

Outsourced internal audit and PR J-3

Many firms outsource or co-source internal audit. The firm cannot outsource accountability. The FCA's rules on outsourced senior management functions in SUP 10C.10 expect an approved senior manager at the firm to hold responsibility for the arrangement where the provider is an unconnected, unauthorised firm, such as an accounting firm.

PR J-3 applies at Enhanced firms that outsource internal audit. Under SYSC 24.2.6R it is responsibility for taking reasonable steps to ensure everyone performing internal audit is independent of the people performing external audit, including supervising the outsourced auditors and managing conflicts between external and internal audit services. It does not apply to a full-scope UK AIFM in relation to managing an AIF. Certain insurers that outsource internal audit have a related FCA responsibility, PR J-2, and PRA-regulated banks have the PRA's PR J1.

What CP26/37 would change for SMF5

CP26/37 proposes that SMF5, SMF10, SMF11, SMF12, SMF13, SMF14 and SMF15 become notified, not approved, at dual-regulated and Enhanced firms.

• At an Enhanced firm, SMF5 is an FCA function: the firm would notify the FCA through My FCA.
• At a bank or insurer, SMF5 is a PRA function. The PRA's CP14/26 also lists SMF5 as notified, so the firm would notify the PRA, with no copy to the FCA and no FCA consent.
• The firm makes the fitness and propriety decision itself after the same checks: regulatory references, criminal records check, right to work and a Statement of Responsibilities. The holder of PR A answers for that vetting.
• Notifications can be made up to three months before the start date and take effect on that date, or on acknowledgement if immediate.
• The Senior Manager Conduct Rules and the Duty of Responsibility apply exactly as to approved senior managers. The regulators may require approval in exceptional cases.

PR J-3 is one of only four FCA prescribed responsibilities CP26/37 keeps: PR A, PR D and PR Z for Core and Enhanced firms, plus PR J-3 for Enhanced firms. An Enhanced firm with outsourced internal audit would still allocate it, not to SMF5, but to an oversight senior manager such as the audit committee chair. PR J would go as an FCA prescribed responsibility, though the FCA says firms need not rewrite SMF11's oversight of internal audit elsewhere.

Firms can keep applying until commencement and notify later start dates from one month before. Consultation closes on 22 January 2027; final rules are expected in the first half of 2027 and would take effect around six months later, subject to the Financial Services and Markets Bill. Core and Limited Scope firms are not affected. See our CP26/37 article.

Holding SMF5 with other functions

• SMF4, Chief Risk, or SMF16, Compliance Oversight: should not be combined. SYSC 6.2.1R requires internal audit to be separate from the functions it audits.
• SMF24, Chief Operations, or any business role: the same problem. An auditor cannot review their own operations.
• Group head of audit roles: workable if the person manages the regulated firm's internal audit and reports to its own board and audit committee.
• SMF11, Chair of the Audit Committee: a different person by design. SMF11 oversees SMF5. See our SMF11 guide.

How we support SMF5 holders

We prepare heads of internal audit for approval and, under the proposed rules, for notification, working from the firm's audit charter, plan and committee papers. See our Senior Manager training and SM&CR support.

• one-to-one Senior Manager training built on the person's own Statement of Responsibilities
• drafting and review of the Statement of Responsibilities
• the Form A application and fitness and propriety file
• FCA interview preparation
• handover arrangements