I understand no one looks forward to their CASS audit being carried out. What’s to like about someone diving into your systems and controls and checking everything has gone to plan? The tight deadlines don’t help either!
The best you can do is to try and make it as painless as possible by being well prepared, the following is a CASS auditor’s suggestions on steps to ensure a smooth process.
Before the CASS Audit
1. Document the CASS environment
This should include a detailed CASS rule mapping, setting out the rules that are in scope (detailing the control that provides a safeguard against the risk) and out of scope (with an explanation of why).
2. Review Policies and Procedures
Demonstrating annual review (and tracking of changes) will reduce the questions auditors ask.
3. Evidence internal or third-party reviews
A CASS auditor is not a substitute for an FCA compliance consultant. Whether internal or external, being able to provide your auditor with report(s) showing in year checks have been conducted will be beneficial.
4. Provide the deliverables
Your auditor should be providing a list of what they need in advance, if they aren’t, challenge them, and then provide everything promptly so they can confirm they have all they need.
During the CASS Audit:
1. Have staff available
A lot of what the auditor asks will involve tracing transactions through your systems and understanding detail of your documentation. Having clear responsibilities within your team to assist the auditors promptly will smooth this process. Would anything be easier via screen-share, or could you prepare any samples in advance?
2. Respond promptly
Auditors are busy too, and whilst they will accommodate delays, if you can’t provide what they have requested to the timetable they will have staffing pressures, delaying completion.
After the CASS audit
Review recommendations
Alongside the CASS report itself, auditors should be providing you with a management report, consider recommendations on both and record any changes made as a result so these can be reported back before the next audit.
Conclusion
A smooth audit process, like anything, will come down to planning. Your auditor should be getting in touch with you prior to the period-end to agree a plan and timetable, but reach out to them if not, make sure you are getting what you need.
The CASS audit is a year-end process, but compliance is a year-round requirement. Whilst preparing for your CASS audit well can reduce the pain points, it is important that staff are well trained, understand their responsibilities and can ensure that all requirements of your FCA permissions are being met.
If you have any queries, please do get in touch with us via the contact form below.
Contact Our Experts
