[2025] UKUT 00185 (TCC)

At the end of September 2018, the Bank opened discussions with Deloitte for it to assist the Bank with responding to the requirement in the PSM letter that Mr Arden provide an attestation as to the accuracy of the RWAs and of the regulatory reporting. The scope of the project was set out in Deloitte’s draft engagement letter dated 4 October 2018; this was finalised in the same terms on 16 October 2018:

“We understand that you have initiated the Project in response to some self-identified issues around your systems and controls for the calculation of Credit Risk Weighted Assets (“Credit RWA”) and COREP reporting.

The Project objectives are to review and remediate your current policies, procedures and controls in this area. Initially, this will involve gathering and reviewing current policies and associated documents, and working with your Regulatory Reporting, Credit Risk and other relevant teams to assess your current practice.

The Project will identify any gaps relative to industry standards and regulatory expectations, and seek to close out these gaps with ‘quick win’ remediation where possible.

The Project will then set out a road map/action plan for further strategic remediation where appropriate.”

The detailed specification said that Deloitte would “review” both the Bank’s policies and procedures relating to RWAs and COREP, and also “review known data issues”; and that “through workshops or discussions with the relevant teams” Deloitte would “document an assessment of the quality of each data item”. In reliance on this letter, together with Ms Gillan’s evidence, we find that Deloitte was not engaged to check the underlying data on a loan-by-loan basis or to provide corrected risk-weighted figures. The work was to be conducted in three phases spread over 9-10 weeks in total.