By Ian Pollock
Personal finance reporter, BBC News
Supervision of the bank was lax admits the FSA
The Financial Services Authority (FSA), in its own review into the way it supervised the Northern Rock bank, reveals a sorry state of affairs.
A reading of the FSA's 12-page summary report suggests that in many ways, the regulator was asleep on the job.
The first thing to note is that the FSA's own internal auditors have not quite been able to get to the bottom of things.
That is because, in the time leading up to a formal regulatory review of Northern Rock in February 2006, "contrary to standard practice, formal records of key meetings were not prepared."
The auditors note "the apparent ease with which individual members of staff have been able not to comply with established processes (for example recording key meetings, document filing, updating IRM and importing sub-sector issues)."
At that stage in 2006, there was no internal requirement at the FSA for its own bank supervisors to carry out any "developed financial analysis" of the Northern Rock and its strategy.
As the report says, had this been done, this might have revealed that the bank was planning to grow aggressively, with a high reliance on funding from the financial markets rather than traditional savers.
At this stage, the FSA managers decided that Northern Rock should be the subject of a formal regulatory review only every three years, rather than the two-year time scale proposed by the FSA's own supervisory team.
That does not mean that there was no scrutiny at all.
The bank was still subject to what the FSA calls "Close and Continuous (C&C) supervision".
Unfortunately that did not work.
"The supervisory team set out to us an incomplete understanding of C&C," says the auditors' report.
"They did not evidence that they understood that it entailed the regular re-assessment of the firm's business risk profile and control [of] risks as new issues arose."
Light touch regulation
In fact, after February 2006, there was only one set of C&C meetings with the Northern Rock's management, on 30 April 2007.
The auditors do not know what was discussed because "we found agendas for five of those meetings, but there was a typed record for only one part of one of them."
As the bank's business became riskier in 2006 and 2007, the supervisory team did not record any of those risks in the FSA's own database of management information, something that might have triggered further enquiry by more senior staff.
"These findings, taken together, indicate that the supervisory team did not adequately identify and pursue risks arising in the firm as a whole and in relation to its business model and control framework," says the report.
"Our findings also show a level of engagement and oversight by supervisory line management below the standard we would expect for a high-impact firm," it adds.
All this was not just the fault of lower-level staff.
The more senior regulators had a lot on their hands, due to events such as Banco Santander's takeover of the Abbey, takeover bids by both Barclays and RBS for ABN Amro, and the demutualisation of Standard Life.
And the organisation made a blunder over staffing.
For some years the FSA had been cutting its supervisory staff, believing that it needed fewer, but better quality supervisors, and could afford to make efficiency savings.
At the FSA, the department responsible for the oversight of big banks saw its staffing cut by 20 in four years, despite a big increase in workload.
"Our concern is that some of the fundamentals of work on assessing risks in firms (notably some of the core elements related to prudential supervision, such as liquidity) have been squeezed out as a result of prioritisation decisions and resourcing capacity issues," say the auditors.
More staff who know what they are doing is one of the main recommendations of the report, along with yearly reviews of high impact firms, such as big banks, and checks on the supervisors every six months to ensure they are doing their jobs.
The FSA now plans to recruit an extra 100 staff in the coming year to improve its supervision of banks.
The auditors make it clear that the Northern Rock was supervised much less intensively than other big banks, so it was not typical.
A clue about why the apparent lax state of supervision was allowed to develop comes in the part of the report that mentions the Bank of England.
It states that the FSA assumed the Bank of England would always ensure that a bank would not be allowed to run out of cash in a crisis.
That is one assumption that has gone for ever.