A real AAA answer, marked line by line

BRIEFING NOTE

To: Rachel Dempsey, Engagement Partner, Quayle & Co
From: James Allott, Audit Manager
Date: 25 April 2025
Subject: Meridian Bank plc — Business Risk Assessment for Audit Planning, Year Ended 31 March 2025

Introduction

This briefing note evaluates the significant business risks facing Meridian Bank plc ahead of our planning meeting on 28 April 2025. As a first-year engagement, we have no prior audit history with Meridian and must rely on publicly available information, the background materials provided, and the draft financial statements to form our planning assumptions. The business risks identified below are those which, in our professional judgement, have the greatest potential to affect Meridian's financial resilience and, consequently, to give rise to material misstatement in the financial statements for the year ended 31 March 2025. Each risk is considered in terms of its commercial substance and its direct relevance to our audit approach.

1. Rapid growth of the unsecured loan book into a deteriorating credit environment

Meridian's unsecured personal loan book has more than doubled, from GBP 310m to GBP 680m, at precisely the point in the cycle when UK household debt stress is rising and 90-day arrears on that book have jumped from 1.9% to 4.8%. The commercial risk is that a materially larger, higher-risk book crystallises significantly greater credit losses than the current provision anticipates; those losses depress net interest income and profit, which in turn erodes the CET1 ratio (already down from 13.4% to 11.2%) and could invite PRA supervisory attention. For planning, this makes the impairment allowance on unsecured lending the single highest-risk estimate in the audit, warranting a specialist review and detailed challenge of the provision.

2. An outdated ECL model in a book that has fundamentally changed

The expected-credit-loss model was last independently validated in September 2022 and has not been updated, even though the book it prices has doubled in size and shifted in risk profile, and the PRA has written to the sector specifically requesting ECL-model reviews. The risk is that the model no longer reflects the current portfolio, causing systematic under-provision — understating losses and overstating both profit and regulatory capital. This compounds risk 1: the provision is not only large and judgemental, it is generated by a mechanism the bank itself has not revalidated. Audit planning should treat the model's assumptions, staging and forward-looking inputs as a focus area, potentially involving our modelling specialists.

3. Management incentive to protect reported ROE

The CEO's bonus is contingent on reported ROE exceeding 9.5%; the draft figure is 9.6%. A margin this thin, tied to a personal financial reward, creates a clear incentive to manage the result — and the most available lever is precisely the judgemental ECL provision discussed above, since a lower provision flatters profit and therefore ROE. This is a significant fraud risk at the planning stage under ISA 240: it directs heightened professional scepticism at management's estimates and at any late adjustments that move the result across the threshold.

4. Capital adequacy pressure

The fall in CET1 from 13.4% to 11.2% is itself a business risk: a bank approaching its regulatory capital floor has less capacity to absorb the very credit losses that risks 1 and 2 make more likely, and a breach would carry serious regulatory and reputational consequences. Planning should consider capital adequacy as a going-concern indicator and assess the interaction between provisioning judgements and the reported capital position.

5. Operational resilience and conduct exposure

Two 14-hour outages and an FCA complaint point to an operational-resilience weakness with a conduct dimension. Beyond the immediate reputational damage and customer attrition risk, an adverse FCA finding could bring remediation costs or penalties. For planning, this raises the possibility of provisions or contingent liabilities requiring evaluation, and informs our understanding of the control environment.

6. Management transparency — withheld portfolio data

Management's failure to provide the requested breakdown of the loan book by credit-score band and origination vintage, described only as "still being prepared," is a business and audit-planning risk in its own right. The bank cannot readily demonstrate portfolio quality to regulators, investors, or auditors, and the reluctance itself is a scepticism flag. We should press for this analysis early and treat continued non-provision as a scope concern.

Conclusion

The dominant risks — the doubled unsecured book, the unrevalidated ECL model, and the management incentive to protect ROE — converge on a single audit pressure point: the credit-loss provision. That estimate should anchor our risk assessment, our materiality considerations, and our allocation of specialist resource, and it should be approached with heightened scepticism given the incentives at play.