SMF5 Explained: What the FCA Expects From a Head of Internal Audit

Which Firms Need an SMF5

Enhanced thresholds rose from 10 July 2026, so check your tier; see which SMFs apply at which firm tier. Firms that outsource or co-source internal audit should take advice on how SMF5 applies to their arrangement, because accountability for the function stays with the firm.

Why Internal Audit Gets Its Own SMF

If internal audit’s findings can be softened, delayed or reprioritised by whoever it reports to commercially, the third line becomes theatre. Giving the head of the function its own SMF, with a Statement of Responsibilities and the Duty of Responsibility, makes them personally accountable for the function’s independence and quality. It also gives the regulators a named person to speak to about what internal audit has found.

What the Role Involves

• A risk-based audit plan: covering the firm’s key processes, controls and governance, prioritised by risk, not convenience, and approved by the audit committee
• Delivering the plan: with enough people and expertise to cover the firm’s actual risks, including technology, cyber, data, operational resilience, Consumer Duty and financial crime
• Independent findings: reporting what the work found, including the uncomfortable parts
• Escalation: taking serious issues to the audit committee rather than letting them be settled quietly with management
• Tracking remediation: checking that management actually fixes issues, and reporting overdue actions
• Quality: running the function to recognised standards, such as the Chartered IIA’s Internal Audit Code of Practice and the IIA’s Global Internal Audit Standards, with periodic external quality assessment

Professional guidance is available from the Chartered Institute of Internal Auditors.

The Reporting Line Is the Test

As with the Chief Risk Officer, the structural feature that most affects credibility is the reporting line. Internal audit should report primarily to the chair of the audit committee, the SMF11, with an administrative line to the CEO. A function that reports mainly to the CFO or COO, with a nominal dotted line to the committee, is a governance weakness regulators will probe, however capable the SMF5 is. The audit committee chair usually holds the Prescribed Responsibility for safeguarding internal audit’s independence and overseeing its performance, and should set the head of internal audit’s objectives and influence their pay.

Resourcing and Scope

A credible function needs unrestricted access to any part of the business, enough people and specialist skills to cover the risk profile, and a mandate that includes technology and operational risk as well as financial controls. Many firms co-source specialist audits, such as IT or actuarial, from external providers. That is sensible, provided the SMF5 directs the work and owns the conclusions. An SMF5 without the resources to deliver is set up to fail. Boards should settle the budget before recruiting, not expect a strong candidate to work around a shortfall.

Working With the Audit Committee

The SMF5 and the audit committee chair need a relationship built on challenge in both directions. A strong chair pushes the head of internal audit on scope, methodology and independence. A strong head of internal audit brings findings the business doesn’t want to hear, and expects the committee to back the escalation. They should meet privately, without executives, at least before each committee meeting. Boards recruiting both roles around the same time should think about how the two people will work together, not only whether each meets the bar.

What a Strong SMF5 Candidate Looks Like

• Experience leading internal audit at a comparable regulated firm, including delivering an uncomfortable finding and seeing it through to remediation
• A professional qualification in active use, such as CMIIA, ACA, ACCA or CIMA
• Technical range across financial, operational, technology and conduct risk
• Knowledge of the firm’s sector: prudential and capital issues for banks, Solvency II for insurers, client assets and Consumer Duty for investment and wealth firms
• Enough personal standing to make independence real: the confidence to hold a position with the CEO and the credibility to be backed by the board

Strong candidates often come from in-house internal audit leadership at peer firms, from audit firms’ financial services risk assurance practices, or from senior second-line roles with an audit background.

Interim Cover and First Appointments

When a head of internal audit leaves unexpectedly, the audit plan can’t simply pause. An interim SMF5 can cover the gap under the 12-week rule; since April 2026 the firm has 12 weeks to submit the application for the permanent replacement, and the covering person can continue until it is decided. Interim heads of internal audit are usually experienced audit leaders between permanent roles or former audit firm directors, and day rates are broadly in line with interim SMF4 and SMF24 rates.

Firms appointing their first in-house head of internal audit, often after crossing into Enhanced status, should expect the first year to be spent building: agreeing an audit charter, setting the risk-based plan, deciding what to co-source and establishing the committee reporting cycle. Candidates who have built a function before are worth a premium for this kind of role. See becoming an Enhanced firm.

Approval

SMF5 needs approval through a Form A before the person starts, with a Statement of Responsibilities. For dual-regulated firms the PRA leads. Regulators look at independence, competence and whether the function is resourced to match the firm’s risk. Interviews are more common at larger firms. See what goes wrong in Form A submissions and approval interviews.

Pay

Typical base salaries are £100,000 to £170,000 at smaller firms, £160,000 to £270,000 at mid-size firms and £250,000 to £400,000 at larger firms. Variable pay should reward the quality of the function’s work, not the financial results of the areas it audits. Our salary guide has the wider picture.

The Wider Picture

SMF5 completes the three lines of defence alongside the risk function (SMF4) and compliance (SMF16). A board reviewing its governance often looks at all three together, asking the same question of each: is it independent and resourced enough to do its job, or does it exist mainly to satisfy a checklist? Our governance review helps boards answer that, and our SMF5 recruitment service runs searches for permanent and interim heads of internal audit.

Frequently Asked Questions

Which firms need an SMF5?

Banks, insurers, PRA-designated investment firms and Enhanced solo-regulated firms with an internal audit function.

Who should the head of internal audit report to?

Primarily to the chair of the audit committee, with an administrative line to the CEO.

Can internal audit be outsourced?

It can be outsourced or co-sourced, but accountability stays with the firm. Take advice on how SMF5 applies to your arrangement.

What qualifications should an SMF5 have?

Usually a professional audit or accountancy qualification, such as CMIIA, ACA or ACCA, plus experience leading internal audit in a comparable regulated firm.

What does an SMF5 earn?

Roughly £100,000 to £170,000 at smaller firms, rising to £250,000 to £400,000 at larger firms, before bonus.