The SMF5 Head of Internal Audit Function

SMF5 covers the person responsible for the firm’s internal audit function. It applies to banks, building societies and insurers, and to Enhanced FCA firms, where the firm has an internal audit function within the scope of the regime. Our guide to SMF5 explained covers what the regulators expect, and the rules are in the FCA’s SUP 10C and the PRA Rulebook. The professional standards for internal audit in financial services are set by the Chartered Institute of Internal Auditors, whose Internal Audit Code of Practice is widely used by regulated firms.

The SMF5 holder reports functionally to the chair of the audit committee, who holds SMF11. That relationship is at the heart of the role. The Head of Internal Audit must be able to tell the audit committee things the executive would rather it didn’t hear.

Why SMF5 Searches Are Different

Permanent, Interim and Co-Sourced Arrangements

Permanent

For banks, insurers and larger investment firms, a permanent Head of Internal Audit is the norm. We run a direct, confidential search, focusing on candidates with experience in your sector and of reporting to a regulated audit committee.

Interim

An interim Head of Internal Audit can lead the function through a vacancy, a remediation or a skilled person review, while a permanent search runs. Interim SMF5s still need approval if they perform the function beyond any temporary cover allowance; see the 12-week rule.

Co-sourced and outsourced internal audit

Many smaller firms outsource or co-source internal audit work to an accountancy or consulting firm. That can work well, but accountability for the function still has to sit clearly within the firm’s governance, and the firm should be clear how SMF5 applies to its arrangement. We often recruit an in-house Head of Internal Audit to lead a co-sourced model, combining internal ownership with external specialist resource. Our guide to what you can and can’t outsource covers the principles.

How We Run an SMF5 Search

• Brief with the audit committee chair. We agree the role profile with the SMF11 as well as the executive, so independence is built in from the start.
• Direct, confidential search. We approach heads of audit and senior audit managers at comparable firms, and senior professionals from audit firms with regulated-sector experience.
• Fit and proper pre-assessment. Every candidate is tested against the fit and proper test before reaching your shortlist.
• Shortlist and interview. Adrian Lawrence FCA interviews every shortlisted candidate personally. We test how candidates have handled difficult findings and pushback, using questions from our guide to interviewing an SMF candidate.
• References and application. We start regulatory references early and support the Form A and Statement of Responsibilities.
• Through approval to day one. We plan the start date around the regulator’s timetable and the audit committee calendar.

What We Look For in SMF5 Candidates

Internal Audit and the Wider Senior Manager Team

The Head of Internal Audit works most closely with the Chief Risk Officer (SMF4) and the compliance officer (SMF16): the second and third lines of defence. The responsibilities map should make clear where each line’s responsibilities begin and end. When we recruit an SMF5, we look at how the candidate will work with the people already in those roles, and whether the combined team gives the board the assurance it needs.

Timing and Pay

A permanent SMF5 search typically takes three to five weeks to shortlist, with approval time on top; dual-regulated approvals can take several months. See how long an SMF appointment takes. Pay for Heads of Internal Audit varies with firm size and sector; our salary guide gives current benchmarks. Because the role must stay independent, firms should take care that variable pay does not depend on the performance of the areas the function audits.

Signs Your Internal Audit Function Needs New Leadership

Not every SMF5 search starts with a resignation. Audit committees often come to us because the function isn’t giving them the assurance they need. The warning signs are consistent:

• the audit plan hasn’t changed much in years, while the firm’s risks have;
• findings are repeatedly closed late, or reopened;
• supervisors, external auditors or a skilled person have identified issues internal audit didn’t;
• the audit committee receives long reports but little insight into what matters most;
• the function relies heavily on an external provider without an in-house view of the firm’s risks; or
• regulatory areas such as Consumer Duty, operational resilience or financial crime have little audit coverage.

If several of these apply, the right appointment can change the quality of assurance the board receives within a single audit cycle. Our guide to the audit committee chair’s role sets out what the SMF11 should expect from the function.

Frequently Asked Questions

Which firms need an SMF5?

Banks, building societies, insurers and Enhanced FCA firms with an internal audit function within the scope of the regime. Check the rules for your firm type, particularly if internal audit is outsourced.

Who should the Head of Internal Audit report to?

Functionally to the chair of the audit committee, with an administrative line to an executive, usually the chief executive. The reporting line must protect independence.

Can internal audit be outsourced?

Much of the work can be, but accountability must sit clearly within the firm’s governance. Many firms appoint an in-house head to lead a co-sourced model.

How quickly can you shortlist?

Typically three to five weeks for a permanent role. Interim cover can usually be arranged more quickly.

Do you recruit from audit firms?

Yes. Senior professionals from audit and advisory firms with regulated-sector experience can make strong SMF5 candidates, particularly for firms building or rebuilding the function.