How to arrange an external CASS audit

To arrange an external CASS audit, you must appoint a qualified independent auditor to review your processes and ensure you are handling client money and assets according to the Financial Conduct Authority (FCA) rules. If your firm holds client funds above the 'small firm' threshold, this audit results in a formal report that must be submitted to the FCA annually to prove your systems and controls are robust enough to protect your customers.

Understanding your CASS size

Before you hire an auditor, you need to know where you sit within the CASS (Client Assets Sourcebook) categories. The FCA classifies firms based on the amount of client money or assets they hold:

• CASS Small: Generally holds less than £1 million in client money or less than £10 million in assets. These firms usually do not require an external audit unless the FCA specifically requests one.
• CASS Medium: Holds between £1 million and £1 billion in client money.
• CASS Large: Holds over £1 billion in client money.

If you fall into the Medium or Large categories, an external CASS audit is mandatory. It is your responsibility to monitor these thresholds monthly; if you cross the line into a higher category, the requirement for an audit kicks in.

How to find and appoint the right auditor

Not every accounting firm is qualified to perform a CASS audit. This is a highly specialised area of financial regulation. You should look for a firm with a dedicated 'Regulatory Assurance' or 'CASS' team. When interviewing potential auditors, ask the following:

• Do you have experience with firms of our specific size and business model?
• Are you familiar with the latest FCA 'Client Assets' policy statements?
• Can you provide a 'Reasonable Assurance' report (the standard requirement for most firms holding client money)?

What the auditor will look for

The auditor isn't just looking at your bank balance; they are looking at your processes. They will typically want to see evidence of:

• Segregation: Proof that client money is strictly separated from your firm’s own operating cash.
• Reconciliations: Evidence that you perform internal and external reconciliations daily or weekly to ensure your records match the bank's records.
• Acknowledgement Letters: Formal letters from your banks confirming they have no right to 'set off' client money against your firm's debts.
• Governance: Records of who is responsible for CASS within your company and how often the board reviews CASS risks.

Submitting the report

Once the audit is complete, the auditor will issue a report. If they find issues, these are called 'breaches.' You must submit this report to the FCA via the Connect portal. Even if your report is 'clean,' it must be submitted within four months of the end of your audit period. If there are breaches, you will need to explain to the FCA what you have done to fix them.

Tip: Start your search for an auditor at least three to four months before your financial year-end. Specialist CASS auditors are in high demand, and leaving it too late can result in rushed work or missed submission deadlines, which the FCA treats very seriously.