From 1 September 2026, a Senior Manager's Conduct Rule 2 duty — "acting with due skill, care and diligence" — explicitly covers whether staff feel able to raise concerns and whether the firm acts on what gets raised. The regulatory lens that used to point at risk and controls now points at culture, and the evidence Senior Managers can produce is what decides whether they are personally liable.
For Heads of Employee Relations, Chief People Officers and People Directors in FCA-authorised firms, this is the clearest regulatory anchor the speak-up remit has had since SYSC 18 was written in 2016. The anchor comes with a corollary: the FCA will ask firms to show the working. This post is about the five pieces of evidence that have to exist, and the three places People functions are already finding gaps.
Why speak-up is now a Conduct Rule 2 obligation
Policy Statement PS25/23, published on 12 December 2025, finalises the FCA's approach to non-financial misconduct. The guidance makes two moves at once.
The first is scope. A new rule — COCON 1.1.7FR — brings serious bullying, harassment and violence inside the Code of Conduct for every FSMA Part 4A authorised firm. The second is the lens. The amendments to COCON spell out that Conduct Rule 2 reaches into the culture of the areas Senior Managers lead, including whether staff can safely raise concerns and whether the firm identifies and addresses misconduct when they do.
That second move is the one People leaders should read closely. Culture is now a Conduct Rule 2 responsibility, not a Conduct Rule 1 or Senior Managers' Statement of Responsibilities question. A Senior Manager who could not demonstrate that staff had somewhere to go, that the signals were monitored and that action followed, is a Senior Manager who is harder to defend.
For the full regulatory picture, see our pillar guide: the FCA non-financial misconduct rules.
What "due skill, care and diligence" actually means for culture
Conduct Rule 2 has always been a documentary test. The FCA's enforcement history is littered with cases where Senior Managers were sanctioned because they could not produce the evidence they had exercised due skill, care and diligence. PS25/23 brings culture into the same test.
The practical implication is that People leaders own evidence a Senior Manager will one day lean on. Five areas of evidence stand up:
- Reporting channels that reach the person who can act. At least one named internal route, with an anonymous alternative where reporters cannot be named. Channel copy that treats speaking up as expected rather than exceptional. The audit trail of who raised what, when, and where it went.
- Training targeted at managers. Regular, scenario-based sessions on identifying, responding to and escalating non-financial misconduct. Completion records for every manager with Conduct Rule 2 responsibilities. Content refreshed as PS25/23 guidance is interpreted in enforcement.
- Investigation framework fit for the full range. A documented process for bullying, harassment, sexual misconduct and violence. Independence from the line where the allegation touches the line. A pathway for inconclusive outcomes — a known weak point when regulatory references are needed later.
- Monitoring that surfaces patterns. Speak-up signals at team and business-unit level, not just firm-wide averages. Quarterly review that reaches Senior Managers and sits in the minutes. Correlation checks against exits, pulse surveys and grievance filings.
- Closed-loop action. Every substantiated case tied to an owner, a deadline and a verified closure. Learning fed back into training, policy and the channel copy itself. A board-ready narrative an inspector can follow.
None of this is radical. Mature People functions are already running most of it. What is new is that the regulator will now examine it under the Conduct Rules, not under the firm's own employee-handbook obligations.
Where People functions are finding gaps in the first readiness audits
From the readiness work we have seen across our customer base and the published commentary from the law firms running the first PS25/23 impact assessments, three gaps recur:
Gap 1: unit-level signal, not firm-level averages
Most firms monitor speak-up volume at firm or division level. The FCA's guidance implies something tighter. Serious misconduct tends to cluster. A unit with no reports in two years is as useful a signal as a unit with ten. People functions are being asked to produce speak-up trend data at team and business-unit level, with narrative on what the pattern means. Firm-wide averages hide exactly what the regulator will want to see.
Gap 2: inconclusive investigations
The FCA explicitly declined to prescribe how firms should handle inconclusive investigations, calling it an area requiring careful judgement. Guidance tends to go quiet where the risk is highest. Firms that have not thought about what their investigation framework does with an inconclusive case — the regulatory reference language, the Senior Manager's documentary standard, the fairness owed to the person who was reported — are the firms most exposed when a dispute reaches enforcement.
Gap 3: a Conduct Rule 2 defence that is Senior Manager-level, not firm-level
A firm-level narrative of "we have a speak-up channel and we investigate concerns" is not a Conduct Rule 2 defence. The rule attaches to individuals, so the evidence has to attach to individuals too. The practical shift is from one firm-wide file to Senior-Manager-level evidence packs, each covering the channels in their area, the training reaching their managers, the signals they monitored and the action they took on substantiated cases.
What to action between now and September 2026
Eleven months out, the work for a People leader is less about building new infrastructure and more about re-pointing what already exists so the evidence lands at Senior Manager level.
- Agree with Compliance which Senior Managers hold NFM responsibility in their Statements of Responsibilities, and what each one's area looks like for channel coverage, training reach and investigation volume.
- Reconstruct the past 12 months of speak-up data at the unit level each Senior Manager owns, so the baseline exists before the clock starts.
- Audit the investigation framework against the full range of serious NFM — bullying, harassment, sexual misconduct, violence — with specific attention to inconclusive-outcome handling and regulatory reference language.
- Refresh the training content on the Equality Act dignity-and-environment test, since PS25/23 anchors the FCA's threshold there.
- Build a one-click evidence pack per Senior Manager area, so a Conduct Rule 2 request can be answered in a day rather than a quarter.
If any of the five pieces of evidence feels thin, that is where to spend the eleven months. The firms that get this right do not treat September 2026 as a milestone. They treat it as the date by which the ongoing operating model has to be running.
How Safe Workplace fits
Safe Workplace's CalmER platform handles the operational side of the Conduct Rule 2 evidence base — named and anonymous reporting channels with routing and SLA clocks, investigation workflows tied back to policy and training, closed-loop action tracking, and team-level culture signals that Senior Managers can defend themselves with. If your firm is between now and September 2026 and the five evidence areas above are not already producing a one-click pack per Senior Manager, we would be happy to show you what that looks like. Book a demo.