Most remediation programmes are governed carefully at the start and loosely at the end. The plan gets board attention, the workstreams get owners, the milestones get tracked — and then, as the last actions close, the energy drains out. The steering group stands down, the contractors roll off, and the programme is declared complete on the basis that everything on the plan was delivered. But delivery is not the same as effectiveness, and it is effectiveness the FCA asks about.
The FCA's own guidance makes the point in the redress context: FG26/2 treats monitoring the effectiveness of the scheme, and ensuring it operates successfully, as part of the lifecycle rather than an afterthought. The same logic applies to any remediation. A control that has been redesigned isn't proven until it has operated for a period, under real volumes, and been tested by someone who didn't build it. And closure is precisely the moment firms are asked to stand behind it — in the management response to a skilled person report, in a senior manager attestation, or in answering whether the requirement on your permission can now come off.
"Actions closed" is not an outcome. Report closure to the board on effectiveness.
What separates a clean close from a fragile one is usually defined at the beginning. Exit criteria written at the start — what evidence, at what threshold, verified by whom — turn closure into a test rather than a judgement call. Independent validation matters too, because the team that delivered the fix is not well placed to confirm it worked. So does a period of post-implementation operation with monitoring in place, so that you are evidencing sustained effectiveness rather than a successful go-live. And the handover into business as usual is where good programmes quietly fail: a control with no permanent owner, no place in the compliance monitoring plan and no MI attached will decay, and the finding will return.
There is a documentation dimension as well. When the FCA revisits an issue — and under a supervision-led approach it increasingly does — the question is not "did you do the work" but "show me". A closure pack that sets out the root cause, what changed, the evidence that the change works, who verified it and how it will be monitored answers that in one go. Assembling it while the programme is live, with the people and the evidence still available, costs a fraction of reconstructing it a year later.
What firms should do
- Define exit criteria at the start: the evidence required, the standard it must meet, and who signs it off.
- Get independent validation — someone who didn't deliver the fix should test whether it works.
- Run a post-implementation monitoring period, so you're evidencing sustained effectiveness rather than go-live.
- Hand each control into business as usual with a named owner, a place in the compliance monitoring plan, and MI that would reveal it failing.
- Build the closure pack while the programme is live: cause, change, evidence, verification, ongoing monitoring.
- Report closure to the board on effectiveness, not completion. "Actions closed" is not an outcome.
Sources: FCA FG26/2, Finalised Guidance on identifying and rectifying harm (16 March 2026); FCA Handbook SUP 5.4 (skilled person reviews) and SYSC; FCA supervision-led approach, including use of attestations and requirements (2026).