Board governance for regulated firms

A board effectiveness review is not a survey

The version of this exercise sold to large institutions, an anonymous questionnaire, a benchmarking deck, a set of scores against a peer group is close to useless at the scale most of our clients operate at. With a board of five, anonymity is a fiction and benchmarking is noise.

What is useful is an evidenced assessment of how decisions actually get made. We read the last twelve months of board and committee papers, sit in on a meeting, and interview each director individually. Then we test three things:

• Whether the board sees what it needs to see. Papers that arrive the night before, management information that reports activity rather than outcomes, and risk reports that never contain bad news are the three most common findings.
• Whether challenge happens, and whether it is recorded. A board that agrees with management every time is either exceptionally well run or not functioning. The minutes usually tell you which.
• Whether decisions have owners. The single most frequent gap we find is a decision recorded as "the board discussed and was content", with no named owner and no date for review.

The deliverable is a short report the board can act on, with findings ranked by what would fail first under scrutiny, not a maturity matrix.

Further reading: How Boards Can Improve Decision-Making Quality

Committee structures fail when they are copied from larger firms

A great many smaller firms arrive with a governance map borrowed from an institution twenty times their size: a full audit committee, a separate risk committee, a remuneration committee and a nominations committee, each meeting quarterly, each requiring papers, each staffed by the same four people.

The result is not stronger governance. It is four sets of minutes produced by people with no time to read them, and a board that has delegated its thinking to committees that duplicate one another.

We work on the opposite basis: what is the smallest committee structure that discharges your obligations and gives the board genuine assurance? For many firms that is a single risk and audit committee with a properly drafted terms of reference, a clear escalation route, and one independent voice. For others, particularly those approaching enhanced scope, more structure is genuinely warranted.

What we produce:

• A committee structure proportionate to your permissions, size and risk profile
• Terms of reference that are specific about decision rights, quorum and escalation, rather than restating the rulebook
• An annual board and committee calendar mapped to your regulatory obligations, so reporting deadlines are not discovered late
• A delegation framework that makes clear what management may decide alone

Further reading: What Good Governance Looks Like in a Scaling Business

The 2026 SM&CR changes relaxed the filing, not the accountability

This is the area where we are currently having the most conversations, and where we see the most misreading.

The FCA published PS26/6 in April 2026, and the Phase 1 reforms landed in stages across 24 April, 10 July and 1 September. The direction of travel is deregulatory, and much of it is welcome:

• Firms now have up to six months to notify the regulator of changes to Statements of Responsibilities and Management Responsibilities Maps, rather than reporting them as they occur
• The window for submitting an SMF application widened, and candidates may continue working while an application is determined
• Recertification has been simplified, can be aligned to annual appraisal cycles, and digital confirmation is now acceptable
• Most Directory updates moved from near-immediate to 20 working days, though departures remain at seven

Here is the trap. Every one of those changes reduces the administrative burden of telling the regulator. None of them reduces the obligation to have clear, current, defensible allocation of responsibility. A six-month filing window is flexibility for firms whose maps are already accurate. For a firm whose map was last touched at authorisation, it is six months of additional drift before anyone notices.

We would treat the reforms as an opportunity to do the substantive work properly while the filing pressure is lower:

• Rebuild the responsibilities map so it reflects who actually decides, not who was available when it was drafted
• Review Prescribed Responsibility allocations, including where they may now be split at solo-regulated firms
• Check for the classic gap: a responsibility formally allocated to someone with neither the information nor the authority to discharge it
• Update Conduct Rules training and disciplinary processes for the non-financial misconduct changes that took effect on 1 September

Further reading: FCA PS26/6: What the New Non-Financial Misconduct Rules Mean for Your Board

Fewer firms sit in enhanced scope than did in June

From 10 July 2026 the enhanced-scope thresholds rose by roughly 30 per cent, with inflation reviews signalled:

If your firm sat close to a threshold, you may have moved out of enhanced scope without doing anything. That is worth confirming rather than assuming, because the consequences run further than SM&CR itself. Enhanced-scope status is one of the tests that determines whether the material third party reporting obligations under PS26/2 apply to you from March 2027, so a change here quietly changes your operational resilience and third-party workload too.

Firms crossing a threshold in either direction should document the assessment and have the board note it. It is a five-line minute that answers a question a supervisor is entitled to ask.