The Pensions Authority (the Authority) recently published its report on the findings of its supervisory activities for 2025 (the Report).

The message in the Report is that trustees of all schemes should assess their own schemes against the Authority’s expectations (as outlined in the Report) and take action to address any issues. Speaking at a recent industry seminar, the Pensions Regulator, Brendan Kennedy (the Regulator), observed that some trustee boards that engaged in the Authority’s Supervisory Review Process last year had clearly failed to make the same assessment as against the Authority’s 2024 findings.

This year, the forthcoming scheme authorisation regime is an added impetus for trustees to consider the Report carefully. In a foreword to the Report, the Regulator highlighted that there will be a ‘close relationship’ between the Report’s findings and the ‘actions and behaviours’ trustees will need to meet the standards for scheme authorisation.

Speaking at that recent industry seminar, the Regulator indicated that, subject to the necessary legislation being enacted by the middle of 2027, the authorisation process would be completed for master trusts in 2027, followed by defined contribution (DC) schemes in 2028 and defined benefit (DB) schemes in 2029. However, these timelines were given as indicative only.

We have summarised below the key supervisory findings from the Report (and related Authority expectations) relevant to trustees of occupational pension schemes.

1. Governance

Expectations of the Authority: Trustee meeting records should provide a clear and accurate account of discussions, decisions made and agreed follow-up actions. Board meetings and their corresponding minutes should demonstrate adherence to established policies, while trustee boards should be able to evidence broad participation and engagement in the scheme’s governance.

Key Findings

• Poor governance practices were observed, particularly a failure to document decisions and follow-up actions.
• Trustee boards were not always sufficiently resourced.
• No evidence that relevant policies were being considered or followed.

2. Risk Management

Expectations of the Authority: Own Risk Assessments (ORAs) should be a core component of decision-making and fully integrated into governance processes. Risks should be clearly identified and assessed, with appropriate and actionable mitigation measures in place, supported by ongoing monitoring and timely follow-up to ensure effective risk management.

Key Findings:

• Failure to recognise key risks or define appropriate actions within
• Limited consideration of external risks, no separate assessment of different member classes.
• Weak follow-up of identified risks.

3. Outsourcing and Administration

Expectations of the Authority: Trustees should actively oversee administrators through robust service-level agreements (SLAs) and key performance indicators. Formal arrangements should also be established to monitor performance, escalate concerns where necessary, and implement replacement or exit strategies when required to ensure effective administration and oversight.

Key Findings:

• Inadequate oversight of administrators and service providers.
• Weak or missing SLAs, poor performance monitoring and insufficient escalation procedures.

4. Investment Governance

Expectations of the Authority: Trustees should establish clear, measurable investment objectives that address both risk and return. Statements of Investment Policy Principles (SIPPs) and Statements of Investment Governance (SIGs) should comprehensively document the investment strategy, governance arrangements, and all member investment options, with investment performance monitored and assessed against the documented objectives.

Key Findings:

• SIPPs and SIGs did not always contain sufficient detail on all scheme funds, including legacy arrangements.
• Trustees had not consistently established measurable risk and return objectives, and investment reviews were sometimes incomplete or failed to assess performance against those objectives.

5. Operational Resilience, IT and Cyber Risk

Expectations of the Authority: Trustees must conduct appropriate due diligence on their service providers’ cybersecurity arrangements and ensure they receive timely, proactive notification of any cybersecurity incidents. Trustees should also establish, clearly define, and enforce data and reporting requirements to support effective oversight and risk management.

Key Findings:

• Overreliance on administrators to manage cyber risk and ensure Digital Operational Resilience Act (DORA) compliance.
• Cyber risks were not always adequately reflected in risk management frameworks.
• Weaknesses in data governance and reporting arrangements were identified.

6. Internal Audit Key Function Holder (IAKFH)

Expectations of the Authority: The Authority expects firms providing IAKFH services to engage with trustee boards to ensure that the depth and scope of the internal audit programme is proportionate to the size, nature, scale and complexity of the scheme.

Key Findings:

• Inadequate use of IAKFH.
• Failure to act on audit findings or ensure the quality of audit outputs.

7. Conflicts of Interest

Expectations of the Authority: Conflicts must be properly identified and documented, actively managed, and considered in decision-making.

Key Findings:

• Conflicts not properly identified, disclosed, or managed.
• Inadequate identification or disclosure by trustees of their interests or relationships.
• Investment or administration critical reviews are prepared by the relevant service provider.

Overall Takeaways

A central message emerging from the Report is that the Authority expects trustees to demonstrate (by documenting) active oversight of all aspects of scheme governance. In many cases, the Authority’s concerns related less to the absence of policies and procedures and more to a lack of evidence that these were being effectively implemented, monitored and challenged by trustee boards. It will be important for trustee minutes to provide a clear record of matters considered, decisions taken, the rationale for those decisions and any follow-up actions, as these records are likely to be a key source of evidence that governance processes are operating effectively.

The Report also suggests that, while the Authority has used this review to communicate its expectations and highlight areas for improvement, trustee boards should not assume that shortcomings identified at this stage will continue to be viewed leniently. As governance expectations become more established and the regulatory framework continues to mature, trustees can expect a diminishing tolerance for failures to demonstrate effective governance in practice.

A policy and legislative proposal for a new regime of authorisation of Irish pension schemes is still in development (initial draft legislation is awaited). The Regulator has, however, indicated that the expectations communicated in the Report will be closely related to the expected standards for authorisation. So, it is an opportune time for trustee boards and their advisers to consider these findings as an initial step towards authorisation readiness.

Conclusion

The Report provides valuable insight into the areas of governance that are likely to attract regulatory scrutiny through the Authority’s Supervisory Review Process, particularly the extent to which trustees can demonstrate active oversight, adherence to established policies, effective risk management and robust governance documentation. Trustee boards that take proactive steps now to strengthen both their governance practices and the evidence supporting them are likely to be better positioned to respond to supervisory engagement and to navigate the transition to authorisation successfully.

Contributed by: Stephanie O’Gorman & Jane Barrett