Pre-IPO TerminalUK Listing Rules & IPO Intelligence
← The current edition
FPPP post-mortems3 September 2026

Where the procedures failed, and what would have caught it

A casebook, not a news feed. Each entry takes a case where a regulator, a court or the company itself has said that financial position and prospects procedures fell short, and names the criterion in the pack whose evidence test addresses it.

Archived edition — a finding may have been appealed or overturned since. Read the current one

The takeaway

In all three notices the procedure existed on paper before the problem arrived. What the regulator found missing was any record that someone had run it, at the entity and on the date where it had to run.

  • Test the policy where it must operate — at the subsidiary, not at the holding company that approved it.
  • Keep the evidence a control ran: a date, an owner, a signature. A procedure you cannot show operating is a procedure you do not have.
  • Re-scale the process when the company scales. A manual close that worked at admission is a key-person dependency two years later.

Three cases in which a regulator found that the procedure existed and the record of it operating did not · sources retrieved 3 September 2026

A case earns a place here only where a regulator, a court or the company itself has said the procedures fell short. Two well-known matters were read for this edition and left out on that test, one of them a final notice that states in terms that the regulator made no findings in respect of corporate governance. A case the reader has heard of is not a reason to lower the bar for it.

1. A group policy approved before admission that was never operated inside the subsidiary

On 12 June 2015 the FCA published a final notice imposing a penalty of £4,651,200 on Asia Resource Minerals plc, formerly Bumi plc, a UK-incorporated company admitted to the premium segment of the Official List on 28 June 2011 whose principal asset was an 84.7% holding in an Indonesian-incorporated coal mining company that was itself listed in Jakarta. The Authority found that throughout the period from admission to 19 July 2013 the company "failed to take reasonable steps to establish and maintain adequate procedures, systems and controls to enable it to comply with its obligations", in breach of Listing Principle 2, alongside breaches of LR 8.2.3R, LR 11.1.10R, LR 11.1.11R and DTR 4.1.3R. The notice is unusually specific about the shape of the failure: the company had written and approved a related party transaction policy before it listed, and the Authority's three particulars are that it failed to manage the increased risk of such transactions given its structure and its subsidiary director relationships, failed to establish adequate management oversight and control over the subsidiary in a timely manner, and failed to implement that policy at both company and subsidiary level. A senior individual at the company told the Authority's investigation that the policy was well designed but that there "wasn't much evidence of implementation". The notice sets out the delay: the board and audit committee agreed in December 2011 that company representatives should sit on the subsidiary's board, and the Authority found that this "effectively did not happen until March 2013", fifteen months after it was agreed and twenty-one months after listing. In August 2011 external advisers running the outsourced internal audit function recommended group-wide training and a detailed review and testing of the related-party processes; the audit committee and board adopted those recommendations that month, and the Authority found the training was limited and the review and testing were not put in place until a group head of audit and risk was appointed ten months later. Between December 2011 and May 2013 information requested from the subsidiary was, in the notice's words, "often delayed, incomplete or inaccurate", the 2011 related-party disclosures had to be restated the following year, and the company did not act on that flow of information until after it learned of alleged irregularities in its Indonesian operations. It could not publish its 2012 annual report by the four-month deadline, its shares were suspended from 22 April 2013, and they returned to trading on 22 July 2013 only after the company confirmed, at the Authority's request, that it was now compliant with Listing Principles 2 and 4. The company settled early and received a 30% discount.

What would have caught it: st-5 is not "do you have a related party policy" — it asks for a maintained related-party register plus the documented procedure covering identification, assessment against the threshold, approval and disclosure, and it is one of the criteria that applies per entity. Run at the holding company that drafted the policy it passes; run at the subsidiary where the transactions were actually entered into, it does not, and that gap is the whole finding. fr-1 carries the same discipline into accounting policy: a board-approved group manual, with evidence that it is the manual each perimeter entity actually applies — the second half of that test is the half nobody has. re-9 is the thread the notice calls red flags: a documented route by which external audit and internal audit points are assigned, tracked and reported to the audit committee, with the current status of open points available on demand. Recommendations formally adopted by a board in August 2011 and still unimplemented ten months later are visible in that register or they are visible nowhere. fr-4 is the endpoint — a reporting calendar worked back from the DTR deadlines with each step owned by a named individual and the review gates marked, which is the difference between knowing in February that the subsidiary's balance sheet will not be ready and finding out in April.

Touches st-5, fr-1, re-9, fr-4 — check yours · run the free scan

2. A reporting process that stayed the size it was when the company was smaller

On 21 December 2021 the PRA published a final notice imposing a penalty of £5,376,000 on Metro Bank plc, a London-listed bank, for breaching Fundamental Rules 2 and 6 of the PRA Rulebook between 13 May 2016 and 23 January 2019 — the date on which the bank announced to the market an adjustment of approximately £900 million to its assessment of its risk weighted assets. The findings concern prudential reporting to the PRA rather than the statutory accounts, and they are included here because the failure mode is the one an FPPP review is built to find. On Fundamental Rule 6, the PRA found the bank "failed to organise and control its affairs responsibly and effectively" in three respects. On governance: outside the finance function it "failed to clearly assign the roles and responsibilities" of senior individuals or of executive and board committees for the review, challenge and oversight of the calculation and reporting; senior management "lacked sufficient awareness and understanding" of the firm's own policies on that control framework, which the PRA said limited its ability to assess whether the controls were adequate; the risk function had no formal second-line oversight, leaving "inadequate assurance" as to whether the reporting was accurate or reliable; escalation routes to the executive and the board "lacked formality, were unclear and undocumented"; and the audit committee "provided limited detailed challenge" on management actions from an internal audit that had become overdue. On controls: the PRA found no specific policy formally articulating who was responsible for the calculation, no formally assigned responsibility for analysing new regulations for their effect on reporting, and rule interpretations that were insufficiently documented — where they were written down at all they were "embedded within spreadsheets and working papers" and so not readily accessible, with no adequate process for reviewing, approving or consistently applying them. On investment and data: the calculation process "remained largely manual", which the PRA found heightened operational risk and "created key-person dependencies on a small number of individuals familiar with spreadsheets that were not scalable"; the reporting team's expertise and size did not grow with the firm; front-end systems did not capture all the information needed to classify exposures; and relevant staff received no training on how data should be entered. The PRA recorded a "disproportionate focus on growth, to the detriment of regulatory compliance functions". The firm settled during the discount stage and received a 30% reduction.

What would have caught it: re-3 is the direct test and it is deliberately awkward — an ICFR framework that identifies each key financial reporting control, names a control owner for each, and states how design and operating effectiveness are assessed and on what cycle. "Failed to define, allocate or document clear roles and responsibilities" is that test failing in the regulator's own words. it-8 catches the spreadsheet: a system landscape naming the core financial systems, their data inputs and outputs and every interface between them, flagging which are automated and which are manual. The point of the flag is that a manual step declared on a landscape document is a decision the board has taken; a manual step nobody wrote down is a person. re-5 asks the resourcing question as a document rather than an opinion — an organisation chart from the CFO down to key accounting staff with qualifications shown and vacancies marked — which is what makes "the team did not grow with the company" a fact somebody has to write next to a headcount. ra-7 is the receiving end: minutes that record the committee challenging management on what it was given, not merely receiving it. An overdue remediation action that appears on a committee's papers three times without a question recorded against it fails that test on the third appearance.

Touches re-3, it-8, re-5, ra-7 — check yours · run the free scan

3. An identified risk that never reached the procedure meant to act on it

On 17 October 2017 the FCA published a final notice imposing a penalty of £27,385,400 on Rio Tinto plc for breaching DTR 4.2.4R(1) and DTR 1.3.4R by failing to carry out an impairment test on Mozambican coal assets when publishing its 2012 interim results; the FCA described it in its press release as the largest fine it had then imposed for a breach of rules relating to a company's listing. The notice records that Rio Tinto acquired the assets in August 2011 for US$3.7 billion on a valuation that depended on rapidly establishing production, a significant part of which was the ability to barge coal down the Zambezi to the coast — and that during due diligence the ability to barge was identified as a significant risk to the financial model supporting the acquisition price. Within months it became apparent that only a third of the intended volume could be barged; shortly before the end of 2011 the company learned its barging application would be rejected; and in April 2012 the government rejected it again, the notice says, in terms making clear there was no reasonable prospect of barging forming part of any viable proposal. The Authority sets out the company's own written process alongside those facts: the Rio Tinto Controllers Manual described how impairment triggers were assessed, placed responsibility for identifying indicators on the business units, listed minimum indicators mirroring IAS 36, and stated that where any existed "a formal estimate of the recoverable amount" of the affected assets or cash-generating units "must be prepared". The FCA found that despite indicators of impairment at the half year, Rio Tinto "failed to conduct a formal estimate of the recoverable amount" of assets then carried at US$3.55 billion, that had it done so the value would have been materially below carrying value, and that it therefore failed to take reasonable care that its interim report was accurate. An impairment was announced on 17 January 2013. The company settled at an early stage and received a 30% discount. It is worth being precise about what the Authority did and did not say: the findings are breaches of the disclosure rules, and the notice makes no finding that the manual itself was inadequate. The manual was fine. Nothing shows it ran.

What would have caught it: ra-8 is the criterion this case turns on hardest, and it is the one most often skipped because it looks like paperwork — risks bearing on financial position and prospects marked as such, with each one mapped to the named procedure that addresses it. A transport assumption flagged as a significant risk to the acquisition model at due diligence, and never joined to the impairment-trigger process that would have re-tested the carrying value, is exactly the missing line. ra-6 supplies the movement: every risk carries mitigating actions with a status and a review date, and the test is an operated one, so a register whose review dates all fall in the month it was written fails it. fr-3 is the schedule of key judgements and estimates — for each, the assumption used, the basis for it, and who approved it — with impairment named in the criterion itself; a half-year schedule that has to state the transport assumption and name its approver is difficult to complete while the assumption is publicly known to be dead. fb-4 is the modelling half: downside and upside scenarios run on the declared key drivers with the mechanics visible in the model rather than pasted in as values, so that changing one driver changes an output in front of somebody.

Touches ra-8, ra-6, fr-3, fb-4 — check yours · run the free scan

Sources

It was found in their procedures. Is it open in yours?

Every case above names the criteria it touches. The free scan walks 15 of the 73 across all nine FPPP areas, checks your answers against each other, and tells you where they contradict. It runs entirely in your browser — nothing is sent anywhere, and nothing is stored.

Run the free scan →Read all 73 criteria

Published Thursdays. This is a casebook rather than a news feed: an older case that has not been covered is as welcome as a recent one. Compiled from public regulatory notices, court judgments and companies’ own announcements, and cited to them. It is not legal advice, not investment advice, and not a comment on any company’s prospects or securities.