Skip to main content

CASS Audits

CASS Audits: From Regulatory Obligation to Assurance Opportunity

CASS audits are not just a regulatory requirement — they’re a critical opportunity to evaluate, challenge, and strengthen the way your firm handles client money and assets. Under SUP 3, certain FCA-regulated firms are required to obtain an annual external reasonable assurance report on their compliance with the Client Assets Sourcebook (CASS).

But many firms view CASS audits as a tick-box burden. At CMAC, we help transform the process into a powerful tool for governance, control improvement, and strategic credibility.

📘 What Is a CASS Audit?

A CASS audit is an independent assessment of a firm's compliance with the CASS rules — primarily CASS 6 (client assets) and CASS 7 (client money). This results in an assurance opinion delivered by a CASS-competent auditor and submitted to the FCA.

💡 Key Requirement: If your firm holds or controls client money or custody assets, an external CASS audit is usually mandatory.

🔗 SUP 3 – FCA Handbook on Auditors →

✅ When Is a CASS Audit Required?

Firms typically require a CASS audit if they:

  • Hold or control client money or custody assets

  • Are subject to the full scope of CASS 6 or 7

  • Are investment firms, platforms, brokers, or SIPP operators

🛑 Exempt firms or those under limited permission (e.g. insurance brokers under CASS 5) may not need a CASS audit but should still consider internal reviews for assurance.

📄 [Audit Applicability Decision Flowchart →] (Download link)

📅 Audit Scope & Timing

  • Annual audits must be performed by an FCA-registered auditor

  • The report is due within 4 months of the firm’s year-end

  • The audit provides reasonable assurance, meaning it evaluates whether the firm complied in all material respects

🔍 Topics often reviewed include:

  • Client money reconciliations

  • Acknowledgement letters

  • Segregation and trust arrangements

  • Mandate registers

  • Governance, oversight, and CASS RP

📝 [Download Sample CASS Audit Checklist →] (Download link)

⚙️ Best Practice for CASS Audit Readiness

1. Prepare Early

  • Establish an annual audit plan and timeline

  • Engage stakeholders across Finance, Ops, Risk, and Legal

  • Conduct a mock audit or gap analysis in advance

📋 [Mock CASS Audit Template →] (Download link)

2. Documentation & Evidence

  • Ensure all CASS documentation is up to date, including:

    • Policies and procedures

    • Breach logs and RCA files

    • Training records and committee minutes

🗂️ [CASS Document Register Template →] (Download link)

3. Audit Etiquette

  • Know the difference between ‘reasonable assurance’ and ‘limited assurance’

  • Anticipate challenge — and prepare well-evidenced responses

  • Treat findings as feedback, not failure

🎓 [Guide to Working with Auditors →] (Internal article)

🚨 Common CASS Audit Findings

  • Late or missing daily reconciliations

  • Inaccurate client money calculations

  • Breaches not properly recorded or reported

  • Incomplete CASS RP or failure to test retrieval

  • Weak oversight over third parties (e.g. custodians, banks)

📊 [Top 10 CASS Audit Findings (2024 Snapshot) →] (Download link)

❓ CASS Audit FAQ

Q: Can I use the same firm for statutory and CASS audits?
Q: How detailed should breach logs be?
Q: What if I disagree with the auditor’s opinion?

💬 [View Full CASS Audit FAQ →] (Internal page)
📣 [Ask the Community or Share Your Experience →] (Forum link)

🧷 Essential Resources & Guidance

📚 [Access CMAC’s CASS Audit Toolkit →] (Internal toolkit hub)

🌐 Collaborate & Share

How does your firm manage audit readiness? Are you using internal audit, compliance monitoring, or assurance mapping? Join CMAC to share, learn, and strengthen industry practice.

🔐 [Join the CMAC Community →]
💌 [Subscribe for CASS Audit Alerts →]