A consumer credit compliance audit should test whether the firm's regulatory framework works in the business that exists today. It should not be a generic checklist confirming that policies have been reviewed and staff have completed training.
There is no universal FCA rule requiring every consumer credit firm to commission the same external annual compliance audit. The appropriate assurance framework depends on the firm's activities, scale, risk and governance. A lender needs deeper review of creditworthiness, affordability and financial difficulty than a simple credit broker, while a principal firm needs a substantive SUP 12 workstream for its AR population.
The FCA's 2026 Consumer Finance Regulatory Priorities gives firms a clear starting point. The regulator is focused on access to credit that meets consumer needs, support for customers struggling with debt and complaints and redress, alongside data-driven supervision, AR oversight, Consumer Duty and regulatory reform. A useful audit should therefore test the controls and evidence behind those themes rather than repeat a historic audit plan.
Begin with permissions, business model and customer journey
The audit should first establish what regulated activities the firm performs and how customers move through the business. Consumer credit firms can include lenders, credit brokers, debt purchasers, debt collectors, debt advisers, hire firms and other models with very different conduct risks.
Permissions should match actual activity. A firm that has changed products, added a new distribution model or expanded the role of an AR should confirm that its regulatory perimeter and FCA permissions still reflect the business.
The customer journey then helps define the audit scope. For a lender, this can include promotion, application, creditworthiness, agreement, servicing, financial difficulty, complaints and closure. For a broker, the focus may be promotion, customer explanation, lender panel, fees, referral and complaints.
The audit should also consider recent business change. Rapid growth, acquisition, new technology, new ARs, BNPL exposure or a material increase in collections activity can change the risk enough to justify additional testing.
A documented risk-based scope is more defensible than auditing every Handbook chapter equally.
Consumer Duty should be tested through actual customer outcomes
The audit should assess whether the firm's Consumer Duty framework identifies and responds to poor outcomes. Policies, target-market documents and board reports are evidence, but they are not the outcome themselves.
For products and services, the reviewer should consider whether the product or service continues to meet the needs of the intended market and whether distribution remains appropriate. For price and value, the audit should test the evidence supporting fees, interest and other charges rather than accept competitor benchmarking as the conclusion.
Consumer understanding should be tested through real communications and journeys. The FCA's 2026 work emphasises design, testing and monitoring, which means the audit can consider customer research, complaints, call or chat evidence and digital journey behaviour.
Consumer support is particularly important in financial difficulty. The audit should examine whether customers can obtain help, whether the firm uses appropriate forbearance and whether vulnerable customers receive support that reflects their needs.
The governing-body assessment should then be tested against the underlying evidence. A positive board conclusion is weak assurance if the firm cannot identify any customer group receiving poorer outcomes.
Creditworthiness and affordability need evidence behind the model
For lenders, CONC 5.2A is a core audit area. The firm must undertake a reasonable creditworthiness assessment before entering into a regulated credit agreement or significantly increasing credit, and must have proper regard to the outcome when considering affordability risk.
The audit should examine the information used, model logic, data sources and proportionality. The assessment should reflect factors such as the amount, duration, repayments, total cost, APR and adverse consequences of failure, together with known indicators of financial difficulty and vulnerability where relevant.
Automated decisioning needs governance. The reviewer should understand which inputs drive the decision, where overrides are permitted and whether outcomes show materially different performance in one customer group.
For credit brokers, the audit should distinguish lender responsibility from broker conduct. CONC 5.4 requires brokers to pay due regard to customer needs and circumstances when providing explanations, advice or recommendations and to consider factors that may make a product unsuitable.
The audit should therefore test the firm's actual role rather than apply a lender affordability checklist to every credit business.
Financial promotions should use the current CONC 3 rules
CONC 3 remains the current detailed sourcebook for consumer credit financial promotions and communications within its scope. The FCA consulted in 2026 on simplification, but firms should not apply those proposals as final rules until the regulatory process is complete.
The audit should test live promotions across websites, social media, affiliates, lead generators, dealers and ARs where relevant. A folder of approved templates provides limited assurance if the live customer journey has drifted.
The clear, fair and not misleading standard should be considered in context. Promotions should not imply that credit is available regardless of the customer's financial circumstances, and specific rules can apply to particular products and credit-broking promotions.
Consumer Duty adds an understanding lens. The audit should assess whether important cost and service information appears at the right point in the journey and whether design choices create a misleading overall impression.
Where third parties generate leads, the firm should understand the communications used before the customer arrives.
Financial difficulty and collections should be tested at case level
The FCA's 2026 Consumer Finance priorities makes support for customers struggling with debt a headline sector issue. CONC 7 requires firms to treat customers in or approaching arrears or default with forbearance and due consideration, taking account of individual circumstances.
A desk-based policy review is therefore not enough. The audit should sample real customer cases and examine contact, income and expenditure assessment where used, forbearance options, communications, debt advice signposting and treatment of vulnerability.
The reviewer should consider whether the support offered was affordable and sustainable rather than merely whether an arrangement was created. Repeat broken arrangements can indicate that the process is not reflecting the customer's circumstances.
Collections incentives should also be understood. Targets based mainly on cash collected can create conduct risk if staff feel pressure to seek payments customers cannot reasonably afford.
Where the firm outsources collections, the audit should test the regulated firm's oversight and customer outcomes rather than rely only on service-level reports.
Complaints should connect with root cause and wider remediation
DISP is another core audit area because complaints can reveal failures elsewhere in the customer journey. The review should test whether staff recognise complaints, whether investigations are competent and impartial and whether final outcomes are supported by evidence.
Root-cause analysis is especially important. The firm should identify recurring or systemic issues and consider whether customers who did not complain may also have been affected.
The audit should compare complaints with other data. A spike in financial-difficulty complaints alongside high payment-plan failure can indicate one underlying support problem, while complaints concentrated in one AR can expose a distribution issue.
Redress calculations should be reproducible and governed where material. FOS outcomes should also feed learning rather than remain isolated cases.
Complaint reporting should reconcile with the underlying register and current DISP requirements.
AR oversight should be reviewed as a separate principal-firm risk
Where the firm is a principal, the audit should include SUP 12. The principal is responsible for relevant regulated activity carried on by the AR and needs sufficient resources and controls to oversee the relationship.
The review should examine onboarding, scope, risk ratings, live monitoring, Consumer Duty outcomes, financial promotions, complaints, annual AR reviews and the governing-body self-assessment.
The FCA's Consumer Finance priorities specifically highlights AR growth and data-driven targeting of higher-risk principals. That makes weak AR data particularly significant.
A high-risk AR should receive a different monitoring response from a low-risk AR. If every AR receives the same file sample and annual questionnaire regardless of evidence, the framework may not be genuinely risk based.
Termination and remediation should also be tested because the principal remains responsible for historic activity within the appointment.
Regulatory reporting should be traced to source data
Consumer credit reporting is increasingly part of supervision. CCR009 and Product Sales Data can give the FCA granular information about firms, agreements and customer performance.
The audit should confirm which returns apply, whether deadlines are controlled and whether material fields can be traced to reliable source data. In-scope ancillary credit firms should understand CCR009, while relevant lenders should understand PSD008, PSD009 and any PSD008a or PSD006 obligations.
AR data should be considered where the reporting rules require consolidated information. The principal should know whether network data is complete and consistent.
The reviewer should examine reconciliations, manual adjustments, definitions and previous FCA data-quality queries. A return can be submitted on time and still be unreliable.
Regulatory reporting should also connect with internal MI. If the FCA can see an outlier that management has never considered, the firm's own monitoring may be too weak.
Sampling should target the cases most likely to reveal harm
A consumer credit audit should combine broad assurance with risk-targeted testing. Random samples can provide baseline information, but higher-risk cases often reveal more about whether controls work.
Depending on the business, the sample can include declined or overridden lending decisions, customers in financial difficulty, vulnerable customers, high fees, complaints, repeated borrowing, AR business and unusual promotion channels.
The methodology should explain what the sample can and cannot prove. A targeted sample should not be presented as a statistical measure of the whole population.
The audit should also distinguish control design from operating effectiveness. A well-written collections policy can be poorly executed, while a consistently performed control can still address the wrong risk.
The conclusion should make those distinctions visible so remediation is directed at the actual weakness.
Findings should prioritise regulatory significance and customer impact
Not every observation deserves the same rating. Management needs to understand which findings create material customer harm, regulatory breach or systemic exposure and which are lower-level improvements.
Root cause should be established before the action is finalised. Repeated file errors can indicate a system or incentive problem that training will not fix.
Where the finding may affect customers outside the sample, the firm should assess the wider population and whether remediation or redress is required.
Closure should require evidence. A new policy or completed training session proves that an action occurred, not that the underlying outcome changed. Material findings should be retested where appropriate.
The board should then receive a clear view of significant issues, overdue actions and emerging trends rather than a long list of equal-weight observations.
What should a 2026 consumer credit audit achieve?
The audit should give management an independent, evidence-based view of whether the firm's current business meets the regulatory framework and delivers appropriate customer outcomes.
The strongest audit is not the one with the longest checklist. It is the one that tests the controls most capable of creating harm, identifies root causes and produces remediation that changes the way the business operates.
In 2026, that means keeping Consumer Duty, responsible lending, financial difficulty, complaints, AR oversight and data quality close to the centre of the programme while tailoring the exact scope to the firm's actual permissions and products.
How Regulatory Counsel can support
Regulatory Counsel supports lenders, credit brokers and principal firms with consumer credit compliance audits, thematic reviews and remediation.
We can review the full framework or focus on Consumer Duty, CONC 5, CONC 7, promotions, complaints, AR oversight or regulatory reporting.
Speak to Regulatory Counsel to discuss a consumer credit compliance audit.
Frequently Asked Questions
There is no universal FCA rule requiring every consumer credit firm to commission the same external annual audit. The firm's assurance framework should be proportionate to its activities, risks and governance.
The scope depends on the business but can include Consumer Duty, CONC 5 creditworthiness, CONC 7 financial difficulty, promotions, complaints, AR oversight, regulatory reporting and governance.
Where customer-level evidence is relevant, file sampling is important. The sample should reflect risk and include higher-risk or exception cases where appropriate.
The FCA consulted on simplification of CONC 3 during 2026. Firms should continue to apply the current rules until final changes take effect.
Yes. We can review one specific area or provide a wider independent assessment of the firm's consumer credit compliance framework.