Audit at a Regulated Firm: The CASS Audit and Beyond

Audit at a regulated firm involves more than the ordinary financial statement audit that any company undergoes. A regulated firm is subject to the same statutory audit of its financial statements as other companies, but it may also be subject to additional, regulatory-specific audits — most notably, where the firm holds client money, the CASS audit, a specific audit of the firm’s compliance with the client money rules. For a finance professional in a regulated firm, understanding the audit landscape — the financial statement audit and the additional regulatory audits such as the CASS audit — and the finance function’s role in them is part of understanding the regulated environment. This guide explains audit at a regulated firm, with particular attention to the CASS audit, for a finance professional in the regulated sector.

This guide is written for finance professionals in regulated firms who want to understand the audit landscape, including the CASS audit. It covers the financial statement audit at a regulated firm, the additional regulatory audits, what the CASS audit is and what it examines, the finance function’s role in these audits, and how to prepare for them. It builds on the general audit guidance elsewhere in this Knowledge Centre, with a focus on the additional regulatory audits that a regulated firm faces. The aim is the understanding a finance professional needs to grasp the audit landscape at a regulated firm and their role in it, particularly the CASS audit where the firm holds client money. For the specific requirements, the FCA’s rules and the firm’s compliance function and auditors are the references.

The Financial Statement Audit at a Regulated Firm

A regulated firm is subject to the ordinary statutory audit of its financial statements, the same as other companies of its size, and this is the familiar audit that a finance professional will recognise. The financial statement audit examines the firm’s financial statements to form an opinion on whether they give a true and fair view, in the same way as for any company, and the finance function’s role in it — preparing for it, providing the auditor with the evidence and explanations, managing the process — is the same as at any business. The general audit preparation and audit relationship disciplines, covered elsewhere in this Knowledge Centre, apply to the financial statement audit at a regulated firm as they do anywhere.

What is worth noting is that the financial statement audit at a regulated firm takes place in the context of the regulatory environment, and the firm’s regulatory position — its regulatory capital, its regulatory reporting, its compliance — may be relevant to the audit in ways it is not for an unregulated business. The auditor may consider the firm’s regulatory position as part of the audit, and the regulatory matters may feature in the audit in a way they would not for an ordinary company. But fundamentally, the financial statement audit at a regulated firm is the familiar audit, and a finance professional’s existing audit capability applies to it. Understanding that the financial statement audit at a regulated firm is the ordinary audit, in a regulatory context, clarifies that this part of the audit landscape is familiar, and it distinguishes the financial statement audit from the additional regulatory audits that a regulated firm may also face. The financial statement audit is familiar territory; the regulatory audits are the additional dimension.

The Additional Regulatory Audits

Beyond the financial statement audit, a regulated firm may be subject to additional, regulatory-specific audits, and a finance professional should understand that the audit landscape at a regulated firm can be broader than at an unregulated business. These additional audits examine the firm’s compliance with specific regulatory requirements, providing assurance to the regulator on matters of regulatory compliance beyond the financial statements. The most prominent of these, for firms that hold client money, is the CASS audit, which examines the firm’s compliance with the client money rules, but there may be other regulatory audits or assurance requirements depending on the firm and its activities.

These additional regulatory audits reflect the regulator’s need for assurance on the firm’s compliance with specific, important regulatory requirements — assurance that goes beyond what the financial statement audit provides, focusing on the specific regulatory compliance rather than the financial statements. For a finance professional, this means the audit landscape at a regulated firm can include these additional regulatory audits, in which finance may have a role, particularly where the audit concerns matters like client money that finance is involved in. Understanding that a regulated firm may face additional regulatory audits beyond the financial statement audit — and which apply to the particular firm — is part of understanding the audit landscape at a regulated firm. The additional regulatory audits are a distinctive feature of the regulated environment, and the CASS audit is the most prominent for firms that hold client money, which is why it warrants particular attention.

What the CASS Audit Is and What It Examines

The CASS audit is a specific audit of a firm’s compliance with the client money and client asset rules, required for firms that hold client money or assets, and it is one of the most important regulatory audits a firm faces. The CASS audit examines whether the firm has complied with the CASS rules — whether it has properly protected the client money and assets, maintained the required segregation, performed the reconciliations, and met the other CASS requirements — and provides assurance on the firm’s client money compliance. The CASS audit results in a report on the firm’s CASS compliance, which is provided to the regulator, giving the regulator assurance on this critical area.

The CASS audit is taken very seriously, reflecting the seriousness of client money protection, and it examines the firm’s CASS compliance rigorously, looking at whether the firm has genuinely complied with the client money rules in practice. It examines the firm’s client money arrangements, its segregation, its reconciliations, its handling of client money, and its compliance with the CASS requirements, to form a view on whether the firm has properly protected the client money. Because client money protection is so important, the CASS audit is a significant and rigorous examination, and its findings matter greatly — a CASS audit that identifies breaches or weaknesses is a serious matter. For a finance professional in a firm that holds client money, the CASS audit is an important event, particularly given the finance function’s involvement in client money, and understanding what it is and examines — the firm’s compliance with the client money rules, rigorously examined, reported to the regulator — is part of understanding the regulated audit landscape. The CASS audit is the rigorous examination of the firm’s client money compliance, and it reflects the seriousness of protecting client money.

The Finance Function’s Role

The finance function often has a significant role in the CASS audit, particularly given its involvement in client money, and a finance professional in a firm that holds client money should understand this role. Because finance is often central to the accounting and reconciliation of client money, the CASS audit will examine work that finance performs — the client money accounting, the reconciliations, the controls — and finance will be involved in supporting the CASS audit, providing the auditor with the evidence and explanations concerning the client money work. This makes the CASS audit an event that finance is involved in and must prepare for, particularly where finance performs the client money accounting and reconciliation that the audit examines.

The finance function’s role in the CASS audit involves supporting the audit in the areas finance is responsible for — providing the evidence of the client money accounting and reconciliation, explaining the work, demonstrating the compliance — much as finance supports the financial statement audit in its areas. Given the seriousness of the CASS audit and the finance function’s involvement in client money, finance must ensure its client money work is sound and well-evidenced, so that it withstands the CASS audit’s rigorous examination. A finance professional involved in client money should understand their role in the CASS audit and ensure their client money work is performed and documented to withstand it. Understanding the finance function’s role in the CASS audit — supporting the audit in the client money areas finance is responsible for, ensuring the client money work is sound and well-evidenced — is part of understanding the client money work of finance in a regulated firm, and it underscores the importance of performing that work well, because it will be examined by the CASS audit. The finance function’s client money work is examined by the CASS audit, and finance must ensure it withstands that examination.

How to Prepare for the Regulated Audits

Preparing for the audits at a regulated firm, including the CASS audit, follows the general principles of audit preparation, applied to the regulatory audits and their specific requirements. For the financial statement audit, the general audit preparation applies — sound records, assembled evidence, documented judgements — as at any business. For the CASS audit and other regulatory audits, the preparation focuses on the specific regulatory compliance the audit examines — ensuring, for the CASS audit, that the client money work is sound, the reconciliations performed correctly, the segregation maintained, the compliance demonstrable, and the evidence assembled. The finance function prepares for the CASS audit by ensuring its client money work is performed correctly throughout the period and well-evidenced, so that it withstands the audit’s examination.

The key to preparing for the CASS audit, as for any audit, is that the underlying work must be sound throughout the period, not just at audit time — the client money must be properly protected and accounted for continuously, the reconciliations performed correctly and on time, the compliance maintained — because the CASS audit examines the firm’s compliance over the period, and sound compliance cannot be manufactured at audit time. A finance professional involved in client money prepares for the CASS audit by performing the client money work correctly and rigorously throughout, keeping it well-evidenced, so that the audit confirms compliance rather than exposing weaknesses. Preparing for the regulated audits is therefore largely about performing the underlying regulatory work — the client money work for the CASS audit — soundly and continuously, and keeping it well-evidenced, so that the audit finds sound compliance. Understanding how to prepare for the regulated audits — sound underlying work throughout the period, well-evidenced, for the specific compliance the audit examines — completes the understanding of audit at a regulated firm. The finance professionals who perform their regulatory work soundly and prepare well for the regulated audits, including the CASS audit, are genuinely valued, because these audits are serious and finance’s work is central to them. This builds on the general audit preparation covered in our guide on audit preparation, applied to the regulated environment, and a finance professional should work from the actual CASS rules and the firm’s procedures for the client money requirements.

What a Clean CASS Audit Signals

It is worth understanding what the outcome of the CASS audit signals, because it explains why the audit matters so much to a firm that holds client money. A clean CASS audit — one that finds the firm has complied with the client money rules — provides assurance to the regulator that the firm is properly protecting client money, which supports the firm’s standing with the regulator and confirms that this critical area is sound. Conversely, a CASS audit that identifies breaches or weaknesses is a serious matter, signalling to the regulator that the firm’s client money protection has fallen short, which can attract significant regulatory attention and action given the seriousness of client money.

This means the CASS audit outcome matters greatly to a firm that holds client money, and the finance function’s client money work — which the audit examines — directly affects that outcome. Sound client money work, performed correctly and rigorously throughout the period, supports a clean CASS audit; poor client money work risks an adverse one. For a finance professional involved in client money, this underscores the importance of performing the client money work to the standard the CASS audit requires, because the audit’s examination of that work contributes to an outcome that matters greatly to the firm. Understanding what a clean CASS audit signals — assurance to the regulator, sound client money protection, good standing — and what an adverse one signals underscores why the client money work must be sound and why the CASS audit is taken so seriously. The finance function’s client money work contributes directly to the CASS audit outcome, and performing it well is part of supporting a clean audit, which matters greatly to a firm that holds client money.