Skip to main content
Governance Authority
Category: Compliance Programs

Supervisory Review

Also known as: Supervisory Review and Evaluation Process, SREP, Supervisory Review Process, SRP
Simply put

Supervisory review is the process by which an external prudential regulator, such as a banking supervisor, evaluates whether a regulated institution properly identifies and manages the risks it faces and holds adequate capital against them. It is an oversight function carried out by a supervisory authority, not a routine internal check performed by the institution's own managers. The term is most commonly associated with banking regulation, though the phrase is sometimes used more loosely elsewhere to describe general oversight of financial, operational, or compliance performance.

Formal definition

In the prudential banking context, supervisory review refers to the Supervisory Review and Evaluation Process (SREP), the second pillar of the Basel framework, under which a competent supervisory authority assesses the risks a bank faces and checks that it is equipped to manage those risks and to maintain adequate capital. Under the Basel supervisory review process, bank management retains responsibility for developing an internal capital adequacy assessment and setting appropriate capital targets, while the supervisor independently reviews and evaluates those arrangements; accountability for the supervisory review itself therefore sits with the external prudential authority rather than with the institution's first-line management. In the euro area, this supervision is conducted under the Single Supervisory Mechanism (SSM), and national competent authorities (for example, the Central Bank of Ireland) are required to disclose the general criteria and methodologies used. This entry addresses supervisory review as an external supervisory activity and should not be conflated with internal manager sign-offs or first-line control reviews, which are distinct concepts with different owners and accountability; the precise legal basis, scope, and methodology vary by jurisdiction, sector, and entity type. Educational only; not legal, audit, or compliance advice.

Why it matters

Supervisory review is the mechanism through which prudential regulators satisfy themselves that a regulated institution is not merely compliant on paper but genuinely capable of identifying and managing the risks it runs and holding capital commensurate with those risks. Because it is an external oversight function performed by a competent supervisory authority rather than an internal check performed by the institution's own management, it provides an independent line of sight into a bank's risk profile and capital adequacy. In the Basel framework it forms the second pillar, complementing the minimum capital requirements of the first pillar and the market discipline objectives of the third.

The distinction of ownership matters greatly for accountability. Under the Basel supervisory review process, bank management retains responsibility for developing its internal capital adequacy assessment and setting appropriate capital targets, while the supervisor independently reviews and evaluates those arrangements. Conflating supervisory review with a first-line manager sign-off or a routine internal control review misstates who is accountable: the supervisory review itself sits with the external prudential authority, whereas the internal capital assessment is the institution's own responsibility. Boards and senior management should understand which activity they own and which is being conducted upon them by a supervisor.

In the euro area, this supervision is conducted under the Single Supervisory Mechanism (SSM), which is responsible for the prudential supervision of credit institutions within participating Member States. National competent authorities, such as the Central Bank of Ireland, are required to disclose the general criteria and methodologies used in the process, which supports transparency and consistency in how institutions are assessed. The precise legal basis, scope, and methodology vary by jurisdiction, sector, and entity type, so institutions should confirm the requirements applicable to them.

Who it's relevant to

Boards and senior management of regulated institutions
Boards and executives of banks and other supervised institutions are the subject of supervisory review and need to understand that the assessment is conducted by an external prudential authority. They retain responsibility for developing the internal capital adequacy assessment and setting capital targets, which the supervisor then independently evaluates. They should not treat supervisory review as an internal manager sign-off.
Chief risk officers and risk functions
Risk functions prepare and maintain the internal capital assessment and risk management arrangements that supervisors examine under SREP. Understanding the criteria and methodologies a supervisor applies helps these functions align their own risk identification and capital planning with what will be evaluated externally, while remaining clear that ownership of the supervisory review itself lies with the authority.
Compliance officers and regulatory affairs teams
Those managing the relationship with prudential regulators coordinate the institution's engagement with supervisory review and track applicable disclosure obligations, such as those national competent authorities publish on general criteria and methodologies. They should distinguish this external prudential process from routine internal compliance monitoring.
Internal auditors and assurance providers
Internal audit provides independent assurance over the institution's own risk and capital assessment processes, which sit within the scope of what an external supervisor reviews. Auditors should be careful to classify supervisory review correctly as an external regulatory activity rather than a first-line or internal control, consistent with widely accepted three-lines roles.

Inside Supervisory Review

Supervisory Review (Prudential Sense)
In banking and prudential regulation, supervisory review refers to the process by which external prudential authorities assess an institution's risk management, capital adequacy, and governance. Under the Basel framework this is commonly associated with the second pillar (the supervisory review process), and in the European Union it is operationalized through the Supervisory Review and Evaluation Process (SREP). This activity is performed by the competent supervisor or regulator, not by the institution's own management, and its scope generally covers whether internal capital and risk assessments are adequate relative to the institution's risk profile. Applicability depends on jurisdiction, sector, and entity type.
Internal Supervisory Review (Managerial Sense)
Distinct from the prudential meaning, the term is sometimes used to describe internal oversight in which a more senior person or function reviews the work, decisions, or transactions of others. This is an internal control activity and should not be conflated with an external prudential supervisory review; the accountability, scope, and legal standing differ substantially. Which meaning applies depends entirely on context.
Accountability and Ownership
For prudential supervisory review, accountability sits with the external supervisor conducting the assessment, while the institution remains responsible for its own risk management and for responding to findings. For internal review activities, ownership sits within the relevant management or assurance function. Clarifying which sense is intended is essential before assigning roles or responsibilities.
Relationship to the Three Lines Model
An external prudential supervisory review is a form of external oversight and sits outside the organization's internal three-lines structure; it is not a first-line control. Within the organization, first-line management owns and operates controls, second-line functions provide oversight and challenge, and third-line internal audit provides independent assurance. Mapping any specific review to the correct line requires identifying who performs it and to whom they are accountable.
Outputs and Follow-Up
A prudential supervisory review typically produces an evaluation of the institution and may lead to supervisory expectations or measures, the specifics of which vary by jurisdiction and framework. Internal reviews typically produce findings, corrective actions, or documented sign-offs within the entity's own governance processes. The nature, force, and consequences of the output depend on which type of review is involved.

Common questions

Answers to the questions practitioners most commonly ask about Supervisory Review.

Is supervisory review just a routine first-line management check performed inside the firm?
No, and conflating the two is a common error. In its principal prudential sense, 'Supervisory Review' refers to an external process carried out by a prudential authority, for example, the Supervisory Review and Evaluation Process (SREP) associated with the Basel framework and its implementation in regimes such as CRD IV/the EU Single Supervisory Mechanism. That is an activity of an outside supervisor assessing an institution's risks, governance, and capital adequacy; it is not a first-line management task and does not sit within the firm's own three-lines structure. Routine internal manager reviews of staff or transactions are a separate concept that some organizations also loosely call 'supervisory review.' Where both meanings are in play, identify explicitly which one is intended, because accountability and scope differ fundamentally. Availability and precise form depend on jurisdiction, sector, and entity type.
Can an external supervisory examination be counted as one of a firm's first-line controls?
No. Under the widely referenced three-lines model, first-line controls are owned by the management and operational functions that take on and manage risk day to day. An external supervisory review or examination is conducted by an independent prudential authority sitting outside the firm entirely; it is not a first, second, or third line of the institution and should not be recorded as an internal control. Treating an external examination as a first-line control misstates both accountability and the assurance it provides. A firm's own internal supervisory or monitoring activities may map to the first or second line depending on their design and independence, but the external supervisor's role is distinct. This distinction is conceptual and not legal advice; classification in a specific framework should be confirmed against that framework's own terms.
How should an entry or policy distinguish the external prudential meaning of supervisory review from internal manager reviews?
Generally, the clearest approach is to define the term twice, with an explicit label for each. Reserve 'Supervisory Review' (or SREP) for the external prudential-authority process and describe its owner as the relevant regulator or supervisor. Use a separate term, such as 'management review,' 'first-line monitoring,' or 'internal supervisory control', for routine checks performed by managers within the business. Documenting the owner, the objective, and the assurance level for each avoids the conceptual inconsistency that arises when the two are merged. Which term applies in a given policy depends on the entity's sector and jurisdiction, and firms should align terminology with their applicable regulatory regime.
Who is accountable for responding to the findings of an external supervisory review?
Typically, the institution's board holds ultimate oversight accountability for the firm's response, while management is responsible for implementing remediation and any capital, liquidity, or governance measures the supervisor expects. The board or a designated committee generally oversees the adequacy and timeliness of that response and challenges management where needed. Assurance functions such as internal audit may independently test whether remediation is designed and operating effectively, but they do not own the remediation itself. The precise allocation of duties, and any supervisory expectations attached to findings, vary by jurisdiction and framework and should be confirmed against applicable rules.
How does a supervisory review differ from a firm's own internal audit or risk assessment?
They differ in ownership, independence, and purpose. A supervisory review is performed by an external prudential authority evaluating, among other things, an institution's risk profile, governance, and capital or liquidity adequacy against regulatory expectations. Internal audit is a third-line assurance function within the firm that provides independent assurance to the board on the effectiveness of governance, risk management, and controls. A risk assessment is typically a first- or second-line activity that identifies and evaluates risks the firm faces. These outputs can inform one another, but they are not substitutes: a supervisor's conclusions do not replace internal assurance, and internal work does not discharge external supervisory obligations. The scope of each depends on the applicable framework and the entity's regulatory status.
What should management prepare for and expect during an external supervisory review?
In many prudential regimes, institutions are generally expected to be able to evidence their governance arrangements, risk management processes, internal controls, and their own assessment of capital and liquidity adequacy, and to make relevant documentation and personnel available to the supervisor. Because the review is conducted by an outside authority, management's role is to provide accurate information, respond to information requests, and address any concerns raised, rather than to conduct the review itself. Firms often maintain up-to-date self-assessments and remediation tracking to support this. The specific expectations, frequency, and intensity of supervisory engagement vary by jurisdiction, the framework in force, and the institution's size and risk profile. This is educational information, not legal, audit, or compliance advice.

Common misconceptions

Supervisory review is a first-line management activity.
In the prudential sense used in banking regulation (for example, the Basel supervisory review process and the EU SREP), supervisory review is conducted by external prudential authorities, not by an institution's own first-line management. It is a form of external oversight and does not sit within the organization's internal three-lines structure. A separate, internal use of similar wording exists for managerial review of others' work, but the two should not be conflated because their accountability and scope differ.
The terms 'supervisory review' always mean the same thing regardless of context.
The phrase carries at least two distinct meanings: an external prudential assessment by a regulator, and an internal managerial or assurance review within an entity. These differ in who performs them, who is accountable, their legal standing, and their consequences. Practitioners should confirm which sense is intended before drawing conclusions about roles or obligations.
A supervisory review transfers responsibility for risk management to the reviewer.
Even where an external prudential authority conducts a supervisory review, the institution generally retains responsibility for its own risk management, capital adequacy, and governance. The review evaluates and challenges; it does not assume ownership of the underlying risks or controls.

Best practices

Before applying the term, confirm whether the intended meaning is an external prudential supervisory review (such as the Basel process or the EU SREP) or an internal managerial review, and document that distinction to avoid conflating accountability and scope.
Map any given review to the correct role by identifying who performs it and to whom they are accountable, and avoid classifying an external regulatory assessment as a first-line internal control.
Preserve the distinction that external prudential supervisory reviews sit outside the organization's internal three-lines structure, while first-line ownership, second-line oversight, and third-line assurance remain internal responsibilities.
Confirm the applicable jurisdiction, sector, and entity type before assuming a supervisory review applies, since prudential frameworks and their supervisory processes vary and are not universally mandatory.
Ensure the organization continues to own its risk management and responds appropriately to supervisory findings, rather than treating an external review as a transfer of responsibility.
Treat this entry as educational context only and seek qualified legal, audit, or compliance advice for the specific facts, framework, and jurisdiction at issue.