Internal Control Failures: A Wake-Up Call for Internal Audit and Boards

The Alarming Scale of Internal Control Failures

The Chartered Institute of Internal Auditors (CIIA) has released a sobering report detailing widespread internal control failures within the UK financial services sector. Between 2021 and 2025, 52 out of 97 enforcement actions by the Financial Conduct Authority (FCA) were directly linked to these failures, resulting in fines exceeding £1 billion. This isn't merely a financial issue; it represents a systemic problem that has exposed customers to fraud, compromised data security, and damaged the reputations of firms. The report underscores that these failures often stem from a lack of fundamental control, indicating a critical need for immediate and decisive action from all stakeholders.

Recurring Weaknesses and Internal Audit's Role

The CIIA report identifies five persistent control failures:

• Financial Crime and AML Controls: Deficiencies in customer due diligence, transaction monitoring, and sanctions screening.
• Weak Governance and Oversight: Lack of clear information for boards, unclear risk ownership, and delayed remediation of internal audit findings.
• Ineffective Three Lines Model: Fragmented assurance and poor coordination between risk, compliance, and internal audit.
• Data and Technology Weaknesses: Poor data quality, weak system integration, and ineffective change management.
• Failure to Remediate: Known issues were not effectively corrected, leading to recurring problems.

While internal audit was often present and identified issues, the report questions its effectiveness in driving timely and sustainable action. This highlights a critical need for internal audit to be more assertive, persistent, and focused on outcomes, ensuring that findings are escalated appropriately and remediation efforts are rigorously followed up.

A Call to Action for Boards and the Path Forward

The report emphasizes that boards and audit committees must move beyond viewing internal control as a mere compliance exercise. They are urged to demand high-quality assurance over critical risk areas, particularly financial crime, and ensure the effective operation of the Three Lines Model. Holding management accountable for timely and sustained remediation, and providing internal audit with sufficient authority, independence, and resources are also crucial. Furthermore, the report raises a significant concern about firms operating without an internal audit function, suggesting a potential need for regulatory requirements in this area. For internal audit, the path forward involves focusing on end-to-end assurance, strengthening coordination with second-line functions, leveraging data analytics, conducting rigorous root cause analysis, and consistently escalating high-risk issues. The report serves as a powerful wake-up call, demanding reflection and, more importantly, decisive action from the entire assurance ecosystem.