Posted: 26 May 2020 9 min. read

COVID-19 – Retail Conduct Considerations for Internal Audit


The COVID-19 pandemic is causing widespread concern and economic hardship for consumers, businesses and communities across the globe. The UK government has set in place social-distancing measures aimed at preventing the spread of COVID-19 and the pandemic has already had a significant impact on the UK and the global economy. Due to the ever-changing risk landscape shaped by COVID-19, it is imperative at this time that Internal Audit (IA) continue to consider  the retail conduct risks that are emerging as a result.

Within this blog, we have summarised some of the key retail conduct considerations that IA teams should consider when determining how to plan and shape its response to COVID-19.  

Key Conduct Issues

The Financial Conduct Authority (FCA) has reacted quickly to the current crisis issuing a number of temporary and targeted measures lenders should consider in order to support customers that may be experiencing financial difficulty. The FCA’s COVID-19 guidance is clear in that it expects lenders to make use of any flexibility within its rules to support customers, bearing in mind customers’ individual circumstances, and that it welcomes lenders taking initiatives that go beyond usual business practices. Lenders are, however, expected to notify the FCA of any initiatives that go beyond usual business practice to allow it to “consider the impacts and offer support as appropriate”.

The expectation is that lenders take reasonable steps to ensure they are prepared to meet the current and evolving challenges which COVID-19 could pose to customers, staff and the business.  To manage the likely increase in customer contact, organisations are leveraging staff from other teams and departments. To quickly mobilise and empower staff to make appropriate decisions at all stages, they will need to ensure their approach, policies and procedures are clear.

We have outlined some of the key areas that IA functions should be considering as the retail conduct risk profile of organisations evolves in response to the pandemic: 


Conduct Issue

Key Challenges

Internal Audit Response


These are challenging times, which will undoubtedly lead to an increase in the number of vulnerable consumers (VCs).  As individuals are isolated from family and loved ones and/or are experiencing financial difficulties it will be critical that lenders respond effectively.  

No single customer situation will be the same and organisations may need to provide further training to front line agents on how to identify, further question, and understand the customer’s vulnerability and how this may impact the individual’s financial literacy, awareness and ability to repay a debt, before addressing with suitable forbearance or support, where possible.

Lenders will need to be flexible in their approach to forbearance, particularly for VCs. Oversight of this will be key and consideration should be given to any enhancements that may be required to the policies, processes and controls that are in place such as system flags, mandate structures and appropriate management information (MI).

The following are key areas which IA functions should consider:


  • Has the VC policy been reviewed in light of COVID-19?
  • Has the impact of an increased volume of VCs been considered to ensure adequate resources are in place to meet customer contact demands, and that quality Assurance (QA) will be sufficiently resourced and targeted on the right areas?
  • Does VC MI provide adequate visibility of the number and categories of VCs, and whether this is COVID-19 related? Has VC MI been updated to ensure it is capturing changes to the conduct risk profile and impacts due to COVID-19?

Financial difficulty &


Due to COVID-19, increased volumes of individuals throughout the UK will be affected by job losses, contract adjustments or furloughing resulting in wage reduction. As customers experience a significant change in circumstances, the need to identify signs of financial difficulty is greater than ever and the ability of firms to interact proactively with these customers will be critical to the way in which customer’s financial difficulties are identified and managed. 

Customer cohorts should be analysed in a way that enables contact and collections strategies to be adapted to the specific conduct risks posed by COVID-19, ensuring appropriate customer outcomes throughout.

The impact of the pandemic on customers’ circumstances is likely to be felt throughout the medium to longer term. lenders may need to consider what changes are required to implement new and/or enhanced processes to support customers during this period, such as adapting income and expenditure processes and forbearance measures. 

Additional guidance may also be required as agents have more complex conversations with customers, and the controls in place to update policies and implement waivers, where standard practices may not apply, will need to be robust.



As part of the assurance IA provides, some of the areas to consider include:


  • If pre-arrears triggers have been identified and considered in light of COVID-19, is MI in place to support how these are monitored and tracked?
  • How is information on temporary measures such as payment holidays and freezes being captured? Are any preparations being made for the possible extension of these arrangements?
  • Is analysis on customer cohorts taking place in order to determine effective customer contact and/or collections strategies when payment holiday/freezes comes to an end?
  • Is there robust governance and oversight in place regarding how key decisions are being made in relation to customer cohort analysis and segmentation?   
  • Are plans in place to help manage an increase in arrears taking into account resource capacity and capability?
  • Are forbearance measures clear and is there adequate MI to enable their effectiveness to be determined?
  • What are the arrangements in place to determine if fair customer outcomes are being delivered? Does QA and/or check the checker provide adequate visibility of this?


Effective communication

Effective communication with customers will be critical to ensuring they understand the actions lenders are taking to support them and any implications of this.

In addition, with some contact strategies disrupted as a result of COVID-19, such as access to branches, it will be critical that lenders ensure customers are still able to access the support and services on offer.

This will be equally important where organisations employ third parties such as sales advisors, field agents and/or debt collection agencies to support the customer journey.

Alternative ways of contacting and communicating with customers will need to be explored and plans to implement accelerated. 

Consideration of effective communication will be key to ensuring conduct risks are appropriately managed. In determining what assurance could be provided the following areas should be considered:


  • Is the communication strategy, as it relates to the FCA’s temporary measures, documented and clear? Has it considered the key operational and conduct risks that could arise, such as where customers hold multiple products and/or an increase in complaints? Is there appropriate oversight?
  • If digital programmes are being accelerated, are there appropriate oversight and governance? Does the programme take into account the needs of VCs and/or the organisations’ target market?
  • If the use of online portals and forms are increasing, have the risks been appropriately considered and controls put in place? 
  • If aspects of the customer journey rely on face-to-face contact, are plans being put in place to adapt these communication strategies in light of COVID-19?
  • In order to adapt strategies quickly, pro-actively monitor and identify customers’ circumstances, lenders may increase their use of analytics; is there appropriate assurance in place in regards to their control framework?

In light of the challenges presented by COVID-19 and the FCA’s ongoing response to this, IA will need to be increasingly flexible in its approach to providing assurance. Critically, it will need to continually adapt to the risks organisations are facing and to provide assurance across evolving processes within lenders.

Planning Priorities 2020 for Internal Audit in Financial Services

Sign up for the latest updates

Key contacts

Lyndsey Fallon

Lyndsey Fallon


Lyndsey is a Partner in our Regional Financial Services Practice and leads the Conduct Risk and Regulatory Team. With over 16 years specialist experience in risk, regulation and internal audit. Lyndsey has extensive experience of leading a number of risk and regulatory related projects specialising in secured and unsecured lending, collections and recoveries, and debt purchasing.

Sarn Saundh

Sarn Saundh

Associate Director

Sarn is a Fellow Chartered Certified Accountant with more than 19 years’ experience in the delivery of Internal Audit (IA) and risk assurance based services. He is a member of Deloitte’s UK FS IA Leadership Team and has significant experience of operating in senior IA roles which has included being seconded as the interim Chief Audit Executive for a Digital Bank and the Head of Audit for a large European Fund Administrator. He leads the management of large outsourced and co-sourced IA contracts, together with the delivery of IA External Quality Assessment reviews.