Our Consumer Duty board report is due next month. How do we evidence good outcomes for vulnerable customers?

Start four weeks out and work backwards from what the board has to approve. Under PRIN 2A.8 the board must review and approve, at least once a year, an assessment of whether the firm is delivering good outcomes for retail customers, and the FCA expects that assessment to show how customers with characteristics of vulnerability fare against everyone else. Four weeks before: pull MI for each of the four outcomes (products and services, price and value, consumer understanding, consumer support) and split every measure by vulnerability status and by the FG21/1 drivers of health, life events, resilience and capability. Two weeks before: compare the groups, and for every gap record the cause, the action, an owner and a date. The week of the meeting: write the conclusion first, then the evidence, then the limits of the data. The day before: check that every claim traces to a source. The board will ask how you know, not what your policy says.

The countdown

Each phase ends with something you can check. If a phase slips, cut scope rather than skipping the check: a smaller report that can be traced to data survives board challenge better than a complete one that cannot.

Four weeks before — pull the data

  • Confirm what the board is approving. The annual assessment under PRIN 2A.8: whether the firm is delivering good outcomes, what it found through monitoring, what action it has taken or plans, and whether its strategy is consistent with the Duty. Write those four headings down now; everything else hangs off them.
  • Pull MI for each outcome. Products and services: target-market reviews and distribution checks. Price and value: fair value assessment results and any differences by customer group. Consumer understanding: communications testing and comprehension results. Consumer support: contact resolution, repeat contacts, time to resolve, and how easy it is to complain, switch or cancel.
  • Split every measure by vulnerability. Vulnerable versus other customers, and where the data allows, by the four FG21/1 drivers: health, life events, resilience and capability. The monitoring rules in PRIN 2A.9 ask firms to identify whether groups of customers, including those with characteristics of vulnerability, get worse outcomes. A measure you cannot split is a finding in its own right; list it.
  • Record coverage. For each channel, what proportion of interactions was assessed for vulnerability at all. If the answer is a QA sample, write down the sample size and how it was selected.
  • Check: a spreadsheet with one row per measure, four outcome columns, and a vulnerable/other split or a stated reason it is missing.

Two weeks before — compare and explain

  • Compare the groups. Complaint uphold rates, Financial Ombudsman referrals, arrears and forbearance outcomes, first-contact resolution, repeat contacts and product switching, vulnerable against other customers.
  • Explain every gap. For each difference: the likely cause, what you did or will do, one named owner and a date. A gap with no action is the item a board or the FCA will pick up first.
  • Close last year’s loop. List every action from the previous board report, whether it was completed, and whether the measure it targeted actually moved.
  • Separate complete evidence from sampled evidence. Mark each figure as full-population or sample, with the sample size. Boards should see the difference, not discover it.
  • Brief the board’s Consumer Duty champion on the draft findings, so the challenge arrives now rather than in the meeting.
  • Check: every gap in the spreadsheet has a cause, an action, an owner and a date.

The week of the meeting — write it

  • Conclusion first. One paragraph: are we delivering good outcomes, including for customers with characteristics of vulnerability? Yes, partly, or not yet, and where.
  • Then evidence by outcome, each with its vulnerable/other comparison, then the action plan, then the limits of the data. Stating the limits is what makes the rest credible.
  • Test it against the FCA’s published findings. The FCA has published good and poor practice from its reviews of firms’ board reports and of how firms treat vulnerable customers. Reports that described activity rather than outcomes, or that did not analyse outcomes for different customer groups, were a recurring weakness. Read the current versions on fca.org.uk and check your draft against them.
  • Check: the first page answers the question the board is being asked to approve.

The day before — trace every claim

  • Trace each figure to a source system and extraction date. If a number cannot be traced, take it out or label it as an estimate.
  • Confirm the resolution. The paper should state clearly what the board is asked to approve and what it is asked to note.
  • Prepare for the minutes. The board’s challenge and the answers given are part of the evidence of governance. Have someone ready to record them.
  • Check: you can answer each question in the next section without leaving the room.

What the board will challenge

  • “How do we know?” Which data, from which system, covering what share of customers.
  • “What is our coverage?” What proportion of calls, chats and meetings was assessed for vulnerability at all.
  • “Why is this group doing worse?” For each gap: the cause, and what changes because of it.
  • “What changed since last year?” Actions completed, and whether the outcome moved.
  • “What don’t we know?” The measures you cannot split by vulnerability, and the plan to fix that before next year.

The coverage question is where most reports are weakest. A QA team reviewing a small sample of calls can say how the sampled customers were treated; it cannot say how many vulnerable customers went unidentified in the rest. Measuring every interaction is what turns “our sample showed no issues” into a population figure. That is the problem EchoDepth is built for, and the difference between sampling and full coverage is set out separately. For the MI structure itself, see what evidence outcomes monitoring needs.

Sources: FCA Handbook PRIN 2A (the Consumer Duty), including PRIN 2A.8 (board report) and PRIN 2A.9 (monitoring); FCA FG22/5, Final non-Handbook Guidance for firms on the Consumer Duty; FCA FG21/1, Guidance for firms on the fair treatment of vulnerable customers. This page is a practical guide, not legal advice; check the current Handbook text before relying on it.

Article 22 UK GDPR — Human Review Required: EchoDepth vulnerability and distress signals are advisory outputs for qualified human review — not automated decisions. All vulnerability classifications, product suitability assessments and escalation decisions must be made by a qualified professional. Privacy policy · Terms