An FCA supervisory visit is an interaction in which the Financial Conduct Authority reviews aspects of a regulated firm’s activities, governance, controls, risk management, or regulatory compliance as part of its supervisory work. The review may involve meetings with senior management and control functions, requests for documents and evidence, discussions about identified risks, and examination of how the firm’s policies and controls operate in practice.
For FCA-regulated firms, supervisory scrutiny can extend beyond written policies and regulatory submissions. Firms may need to demonstrate that governance arrangements, operational resilience, cyber security, outsourcing, access controls, incident management, and other relevant controls are actively managed and supported by current evidence. Maintaining this information throughout the year can make supervisory engagement more efficient and reduce the need for urgent evidence collection when the FCA requests information.
Why FCA Supervisory Visits Are Important
FCA supervision is intended to assess whether firms continue to meet applicable regulatory expectations and whether weaknesses could create harm to consumers or markets.
A supervisory visit can therefore provide the FCA with a deeper understanding of how a firm operates beyond the information contained in routine regulatory reporting.
For firms, this means that documented policies may not be sufficient on their own.
The organisation may also need to show:
- How responsibilities are assigned
- How important risks are identified
- How controls operate in practice
- How management receives risk information
- How incidents are escalated
- How weaknesses are remediated
- How third-party services are governed
- How operational resilience is tested
- How security controls are monitored
- How evidence is maintained
- How previous findings have been addressed
- How senior management oversees material risks
Supervisory scrutiny may expose differences between documented processes and actual operations.
For example, a policy may state that privileged access is reviewed regularly, but the firm may struggle to produce evidence showing when the most recent review took place, who completed it, what exceptions were identified, and whether corrective actions were completed.
This is why ongoing control management and evidence readiness are important.
A firm that understands its own risks, maintains current evidence, and tracks remediation continuously is generally better positioned to respond to regulatory questions than one that begins preparing only after receiving a request.
How an FCA Supervisory Visit Works
There is no single format that every supervisory interaction must follow. The FCA’s approach can vary depending on the firm, its business model, the risks identified, and the purpose of the supervisory work.
A typical preparation and review process may involve:
- The FCA identifies the areas or risks it wishes to examine.
- The firm receives requests for information, documents, or meetings.
- Relevant senior managers and control owners are identified.
- Policies, risk assessments, reports, and supporting evidence are reviewed.
- The FCA discusses governance and control arrangements with the firm.
- Specific risks, incidents, or weaknesses may be explored in greater detail.
- The firm may be asked to provide additional evidence.
- Findings or concerns may be communicated.
- The firm may need to define corrective actions.
- Remediation progress may be monitored or revisited.
Depending on the subject, the FCA may want to understand both how a control is designed and how it actually operates.
For example, if the focus includes technology risk, the firm may be able to provide a written cyber security policy. However, supervisors may also want evidence such as vulnerability reports, access review records, incident logs, backup tests, risk registers, management reporting, or remediation records.
The same principle applies to operational resilience.
A firm may have identified Important Business Services and documented impact tolerances, but stronger evidence may come from dependency mapping, scenario testing, identified vulnerabilities, remediation activity, and senior management review.
Supervisory readiness therefore depends on the connection between policy, control operation, evidence, and oversight.
IT and Security Evidence for an FCA Supervisory Visit
Technology and cyber security increasingly support important regulated services, making IT evidence an important part of wider governance and resilience.
The exact evidence required will depend on the subject under review, but firms may need to demonstrate how key technology risks are identified and controlled.
Governance Evidence
Governance evidence may include:
- IT and cyber security policies
- Risk committee reports
- Technology risk registers
- Control ownership records
- Management review minutes
- Risk acceptance decisions
- Escalation records
- Security objectives and reporting
This evidence helps demonstrate that important technology risks are visible to the appropriate decision-makers.
Access Management Evidence
Access control evidence may include:
- User access reviews
- Privileged account inventories
- Joiner-mover-leaver records
- Multi-Factor Authentication coverage
- Access approval records
- Exceptions and remediation
The objective is to show that access is actively governed rather than simply configured once.
Vulnerability and Patch Management Evidence
Relevant records may include:
- Vulnerability scan results
- Patch compliance reports
- Critical vulnerability tracking
- Remediation tickets
- Approved exceptions
- Risk acceptance records
Reports should demonstrate not only that vulnerabilities are detected but also that significant findings are managed appropriately.
Backup and Recovery Evidence
Firms may maintain:
- Backup success reports
- Recovery testing records
- Disaster recovery plans
- Recovery Time Objectives
- Test findings
- Remediation actions
Successful backups alone may provide limited assurance if restoration has never been tested.
Incident Management Evidence
Useful evidence may include:
- Incident response procedures
- Incident logs
- Escalation records
- Post-incident reviews
- Regulatory notification assessments
- Lessons learned
- Remediation activity
This shows whether the organisation can identify, respond to, and learn from technology incidents.
Third-Party Risk Evidence
Where important services depend on external providers, evidence may include:
- Supplier inventories
- Risk assessments
- Security questionnaires
- Assurance reports
- Contracts
- Service reviews
- Incident records
- Exit plans
Together, these records can help demonstrate that technology and supplier risks are being actively governed.
Common FCA Supervisory Visit Readiness Gaps
One of the most common readiness problems is assuming that good intentions or documented policies will be enough to demonstrate effective control.
A policy may accurately describe what should happen, while actual evidence shows that the process is inconsistent.
Common readiness gaps can include:
- Policies that have not been reviewed recently
- Risk registers that do not reflect current technology
- Missing evidence of control performance
- Access reviews completed inconsistently
- Unresolved critical vulnerabilities
- Recovery arrangements that have not been tested
- Open remediation actions without clear deadlines
- Supplier assessments that are outdated
- Limited visibility of important subcontractors
- Operational resilience maps that no longer reflect reality
- Incident records without documented lessons learned
- Inconsistent management reporting
- Control owners who cannot clearly explain their responsibilities
- Evidence stored across disconnected systems
- Security activity performed but not documented
Another common problem is last-minute preparation.
When evidence is assembled only after a regulatory request arrives, teams may discover missing records, inconsistent documentation, or unresolved weaknesses that could have been addressed earlier.
This can also create unnecessary pressure across IT, compliance, risk, and senior management.
A stronger approach is to treat supervisory readiness as part of everyday governance.
Policies should remain current, controls should be tested, evidence should be maintained, and weaknesses should be tracked through to verified remediation.
Best Practices for FCA Supervisory Visit Readiness
Firms should prepare for supervisory scrutiny by maintaining effective governance and evidence continuously rather than creating a separate compliance exercise immediately before a visit.
Best practices include:
- Maintaining clear ownership of important controls
- Keeping policies aligned with actual operations
- Maintaining current risk registers
- Mapping controls to relevant risks
- Collecting evidence throughout the year
- Reviewing access and privileged accounts regularly
- Tracking vulnerability remediation
- Testing backup and recovery arrangements
- Maintaining current incident records
- Monitoring critical suppliers
- Keeping operational resilience documentation current
- Testing severe but plausible disruption scenarios
- Tracking remediation to verified completion
- Maintaining evidence of management oversight
- Reviewing significant technology changes
- Conducting internal readiness reviews
- Testing whether requested evidence can be retrieved quickly
Firms should also consider whether the evidence tells a coherent story.
For example, a risk register may identify ransomware as a significant risk. Policies may describe preventive controls, while vulnerability reports, endpoint monitoring, backup testing, and incident exercises provide evidence that those controls operate.
If testing identifies a weakness, the remediation record should show how the issue was addressed and whether the improvement was verified.
This creates a traceable chain between risk, control, evidence, finding, and remediation.
Internal readiness reviews can help identify gaps before external scrutiny.
These reviews may examine whether control owners can explain their responsibilities, whether evidence is current, whether important risks are visible to management, and whether previous findings have genuinely been closed.
The purpose should not be to create a temporary appearance of compliance. It should be to ensure that the firm’s documented control environment matches how the organisation actually operates.
Conclusion: Why FCA Supervisory Visit Readiness Matters
An FCA supervisory visit can involve detailed scrutiny of how a regulated firm identifies risk, maintains controls, exercises governance, and responds to weaknesses. For technology and cyber security, this means firms may need to demonstrate much more than the existence of policies. They should be able to provide current evidence showing how important controls work in practice.
Continuous readiness makes this process more manageable. When risk registers, control evidence, testing records, supplier assessments, incident information, and remediation activity are maintained as part of normal operations, firms can respond more confidently to regulatory questions and identify weaknesses before they become larger issues.
Supervisory readiness should therefore be viewed as an outcome of effective day-to-day governance rather than a short-term preparation exercise. Firms that continuously monitor controls, maintain evidence, involve senior management, and verify remediation are better positioned to demonstrate that their risk and control environment remains effective as the organisation changes.