What banks, insurers and FCA-regulated firms should ask when choosing audit technology.

Financial services audit teams buy software under more scrutiny than most. The tool has to suit a regulated firm, stand up to questions from the board and the regulator, and work for people who already have a full audit programme to deliver. This guide covers three decisions that UK banks, insurers and other FCA-regulated firms face: how to compare tools fairly, what insurers need that others may not, and what the FCA's rules mean for a buying decision.

How should you run an internal audit software comparison for UK financial services?

An internal audit software comparison for UK financial services should score every tool against the same written criteria, drawn from your own regulatory duties, audit methodology and operating model. Run the same scripted scenarios with each vendor, so the comparison rests on evidence from your own work and not on demonstrations.

Most comparisons go wrong at the start. A team collects vendor feature lists, which are written to look alike, and then scores impressions. A better method begins with a short document describing how your audit function works today, where time is lost and what the regulator, the board and your external auditor expect to see. Every criterion should trace back to that document.

A neutral checklist for any shortlist covers the following:

• Fit with your regulatory context, including how the tool supports the standards and rules you audit against.
• An evidence trail that shows who did what and when, without manual reconstruction.
• Consistency of method across auditors, teams and locations.
• Access controls that match your segregation of duties and information security rules.
• Whether pricing is transparent and whether it limits audits, users or modules as you grow.
• Implementation effort, data migration and the support you can expect after go-live.
• Vendor stability and references from firms of similar size and regulatory standing.

Weight the criteria before you see any demonstration, then ask each vendor to work through the same two or three real scenarios from your own audits. Include a reference call with a firm in your own sector. Ideagen's internal audit page, for example, says the platform maps audit activities to several standards at once, including SOX, ESG and ISO frameworks, and that there are no audit limits and no hidden module fees. Those are the kinds of claims to test against your criteria, whichever vendor makes them.

What should an internal audit management platform for UK insurance companies cover?

An internal audit management platform for UK insurance companies should handle the breadth of an insurer's activities, from underwriting and claims to reserving, outsourcing and finance, within one consistent method. It should let a small team audit many specialist areas while keeping its evidence and findings in one place.

Insurers differ from many other audit clients in the range of specialist subject matter an audit function must cover. A single year's plan can reach underwriting controls, claims handling, reinsurance arrangements, actuarial processes and financial reporting. Few auditors are expert in all of them, so the platform has to carry the structure. Consistent audit programmes and working papers let a generalist team produce work that reads the same across very different subjects.

Insurers also rely heavily on third parties, such as brokers, managing agents and outsourced service providers, so audits often cross organisational boundaries. Ask how the platform handles evidence from outside the firm and how it limits who can see sensitive claims or customer data. Group structures add another layer. If your firm has several regulated entities, check that the tool lets each one be audited separately and reported on together.

A practical test is to take one recent audit in a specialist area, such as a claims handling review, and rebuild it in the platform during the evaluation. Watch how long it takes to set up the programme, attach evidence and record a finding. If a specialist audit needs heavy workarounds in the trial, it will need them every year.

What should internal audit software for FCA compliance UK firms do?

Internal audit software for FCA compliance in the UK cannot make a firm compliant. It supports the audit function the FCA expects by holding the audit plan, the evidence from work done and a record of recommendations and their follow-up, so the firm can show what its internal audit examined and what it concluded.

SYSC 6.2 in the FCA Handbook sets out the rule. Where appropriate and proportionate, given the nature, scale and complexity of the business, a firm must establish and maintain an internal audit function that is separate and independent from its other functions. That function has four responsibilities: to establish, implement and maintain an audit plan to examine and evaluate the adequacy and effectiveness of the firm's systems, internal control mechanisms and arrangements; to issue recommendations from that work; to verify compliance with those recommendations; and to report on internal audit matters.

The rule applies directly to some firm types, such as common platform firms and management companies. The Handbook says other firms should take account of it as if it were guidance. For senior managers and certification regime firms, the guidance also covers independence. It says the removal or disciplinary sanction of the head of internal audit should not undermine the function's independence. For a PRA-authorised person, the Handbook says internal audit is a PRA controlled function (SMF5), and for an enhanced scope firm it is an FCA controlled function (SMF5).

For a buyer, three questions follow. Can the tool show the four responsibilities in action, with a plan, evidence, recommendations and verification? Does it support the separation the rule describes, so audit work stays independent of the functions it examines? And can your team produce the record quickly when a regulator or senior manager asks? Be sceptical of any product described as FCA compliant. The rule applies to your firm, and the tool is one input to how you meet it.

Making the decision

Start with how your own function works, write the criteria from it and test every vendor against the same scenarios. For a view of how one platform approaches the audit lifecycle, see Ideagen's internal audit software.