SMF10 and SMF11: The Risk and Audit Committee Chairs Under the SMCR
Of the Senior Manager Functions held by non-executives, SMF10 and SMF11 are the two most often recruited together, and the two most often confused by boards that haven’t run one of these searches before. This guide separates the two, explains which firms need them and what each carries in regulatory accountability, sets out what the regulators expect at approval, and covers what a search should test.
Two Designations, One Refresh Cycle
SMF10 is the Chair of the Risk Committee. SMF11 is the Chair of the Audit Committee. Many regulated boards review both at the same time, because the two committees draw on an overlapping pool: finance-literate, governance-experienced non-executives with regulated firm exposure. One refresh cycle is more efficient than two processes months apart. That only works if the search separates what each role requires rather than treating “committee chair experience” as one interchangeable qualification. Our sister practice NED Capital also covers SMF10 and SMF11 non-executive appointments.
Which Firms Need Them
| Firm type | SMF10 and SMF11 |
|---|---|
| Banks, building societies and PRA-designated investment firms | Apply where the committees exist; larger firms are expected to have separate risk and audit committees |
| Insurers | Apply where the committees exist |
| Enhanced solo-regulated firms | Apply where the firm has the committees |
| Core and Limited Scope firms | Do not apply; committee chairs, if any, are not Senior Managers |
Thresholds for Enhanced status rose from 10 July 2026 under the SMCR reforms, so some firms near the line may no longer need these functions. Others are crossing it as they grow. Our guides to which SMFs apply at which firm tier and becoming an Enhanced firm explain the position.
SMF10: Chair of the Risk Committee
For larger PRA-regulated firms, a separate board risk committee chaired by an independent non-executive is expected. Smaller firms sometimes fold risk oversight into the audit committee, in which case one chair may cover both. Where a separate risk committee exists, its chair has a distinct and demanding brief.
The SMF10’s accountability runs across the risk management framework: challenging the risk appetite statement and the limits beneath it, checking that the business actually operates within appetite rather than simply reporting that it does, overseeing stress testing and scenario analysis, and governing model risk wherever models feed decisions. Increasingly it also covers operational resilience testing and third-party risk.
The CRO relationship is the job
If one relationship decides whether an SMF10 is doing the job properly, it is the relationship with the Chief Risk Officer. The risk committee chair should make sure the CRO is independent of the business lines they oversee, properly resourced and has direct, unfiltered access to the board. Where that independence erodes and nobody notices, the failure sits with the SMF10.
What a strong SMF10 looks like
- Board-level risk governance experience at a comparable regulated firm
- Hands-on understanding of enterprise risk frameworks and stress testing, not passing familiarity
- Risk knowledge matching the firm’s exposures: credit for a lender, insurance risk for an insurer, market and liquidity risk for an investment firm
- The ability to engage with risk professionals as a peer, not only receive their presentations
SMF11: Chair of the Audit Committee
SMF11 covers the integrity of financial reporting, the external audit relationship, internal audit and the internal controls framework. At a regulated firm this goes beyond the audit chair brief at an unregulated company, because regulatory capital and regulatory returns sit alongside the statutory accounts. Many otherwise well-qualified audit chairs have never dealt with them.
Recent and relevant financial experience
The regulators expect the audit committee chair to have recent and relevant financial experience. “Relevant” does the work. A strong CFO from outside financial services may not be relevant to a bank or insurer’s audit committee, however good their accounting background. The test is whether the experience applies to this type of firm’s reporting and capital framework, and whether it is current.
Regulatory capital and reporting
For banks, that means capital and liquidity reporting; for insurers, Solvency II and IFRS 17; for investment firms, the ICARA and IFPR framework. Errors in regulatory capital reporting are a serious enforcement concern for both regulators, and the audit committee’s oversight is a key line of defence.
Internal audit governance
Regulatory expectations of internal audit are more prescriptive than the general governance code: independence, risk-based planning and a direct reporting line to the audit committee. The SMF11 must be satisfied that the head of internal audit is qualified and independent, and should meet them without executives present. At firms where it applies, the head of internal audit holds SMF5; see our SMF5 recruitment page.
What a strong SMF11 looks like
- A professional accountancy qualification applied in a current, relevant context: ACA, FCA, ACCA, CIMA or equivalent
- Prior audit committee experience at a comparable regulated firm
- Familiarity with the firm’s regulatory reporting framework
- Experience managing both the external auditor and internal audit oversight in financial services
Former audit partners with financial services clients, former CFOs of regulated firms and experienced financial services audit chairs make the strongest shortlists. Our SMF2 recruitment network is a useful source of candidates with this background.
Prescribed Responsibilities
Both chairs usually carry Prescribed Responsibilities. The audit committee chair typically holds responsibility for safeguarding the independence and overseeing the performance of internal audit. The risk committee chair typically holds responsibility for safeguarding the independence and overseeing the performance of the risk function. Their Statements of Responsibilities should say so clearly. See Prescribed Responsibilities explained.
Approval
Both functions need regulatory approval through a Form A before the person takes up the role. For dual-regulated firms, the PRA leads and the FCA consents. The application must show, with evidence, that the candidate is fit and proper: honest, competent and financially sound, and with the time the role needs. For non-executives with several boards, the time commitment draws particular attention; see NED time commitment. Interviews are common at larger firms. Where a candidate has anything that needs explaining, deal with it before submission. Our guide to what goes wrong in Form A submissions covers the pitfalls.
Fees
Indicative annual fees, combining the base non-executive fee and the committee chair supplement, are below. They reflect the accountability of the designation as much as the time.
| Firm type | Typical combined fee range |
|---|---|
| Major banks and insurers | £115,000 to £175,000 |
| Mid-tier regulated firms | £70,000 to £110,000 |
| Smaller Enhanced firms | £45,000 to £85,000 |
Our SMF and compliance salary guide covers pay across other Senior Manager roles.
Scenario: A specialist lender has just become an Enhanced firm and needs both an audit and a risk committee chair. The board’s long-list is built from strong general NEDs, most from listed companies outside financial services. We run one search for both roles but test them separately: the audit chair candidates on regulatory capital and internal audit oversight, the risk chair candidates on credit risk appetite and the CRO relationship. The board appoints a former bank finance director as SMF11 and a former lending CRO as SMF10. Both are approved without competence questions.
What a Search Should Test
Run the two roles as one process if it suits the timetable, but brief and test them separately. Use case questions drawn from the firm’s real issues: a reported breach of risk appetite, a disagreement with the external auditor, a qualified internal audit report. Check independence carefully, including past relationships with the executives. And check the candidate’s other commitments against the time the role needs. We run these searches through our chair and committee chair recruitment service, often as part of a multi-SMF board build.
Committee Chair Recruitment
Independent chairs for regulated boards. Every committee chair search is overseen by Adrian Lawrence FCA
Board Roles
Chairs and committee chairs.
→ Chair and committee chairs → Multi-SMF team buildSMF9 explained →
Other Committee Chairs
Remuneration and nominations.
→ SMF12 explained → SMF13 explainedSMF14 explained →
Control Functions
The executives they oversee.
→ Chief Risk Officer (SMF4) → Head of internal audit (SMF5)SMF5 explained →
Board Tools
For nomination committees.
→ Board skills matrix template → Governance reviewNon-executives at FCA firms →
Every committee chair search is overseen by Adrian Lawrence FCA
Frequently Asked Questions
What is the difference between SMF10 and SMF11?
SMF10 chairs the risk committee and oversees the risk framework and the CRO. SMF11 chairs the audit committee and oversees financial reporting, external audit, internal audit and controls.
Can one person hold both?
At smaller firms where the committees are combined, one chair may cover both. Where there are separate committees, they are normally different people.
Do Core firms need an SMF10 or SMF11?
No. They apply to Enhanced and dual-regulated firms with the relevant committees.
Does an SMF11 need an accountancy qualification?
The regulators expect recent and relevant financial experience. In practice most SMF11s hold a professional accountancy qualification.
Do the chairs need FCA approval?
Yes. Both need approval through a Form A before taking up the role, with the PRA leading for dual-regulated firms.
About the Author
Adrian Lawrence FCA is the founder of SMF Capital. He is a Chartered Accountant and Fellow of the ICAEW, holds a practising certificate in his own name, and is a former listed-company Finance Director with a BSc from Queen Mary College, University of London. He founded FD Capital in 2018 and has since built a network of five specialist recruitment practices. He oversees every SMF Capital search. View Adrian’s ICAEW profile.
Appointing a Risk or Audit Committee Chair?
Tell us about your board and committees. We’ll come back with a realistic plan the same working day.
Adrian Lawrence FCA is the founder of SMF Capital and a Fellow of the Institute of Chartered Accountants in England and Wales and holds an ICAEW practising certificate in his own name. He holds a BSc from Queen Mary College, University of London, and has over 25 years of experience working with boards, investors and business owners across the UK. He founded SMF Capital to help FCA and PRA-regulated firms appoint the Senior Managers the regulators expect, with the fit and proper assessment built into every search, and personally leads every Senior Manager Function search.