It’s been a month since the Financial Reporting Council (FRC) released its interim guidance for the upcoming CASS 15 safeguarding audits. With the implementation date for the new rules on 7th May is nearly upon us, I felt it would be helpful to note a few considerations from the guidance.
While the FRC document is technically for auditors, I believe it is vital for firms that safeguard monies covered by CASS 15 understand the expectations their auditors have of them.
Here are my thoughts on what I’ve been hearing and the key areas that you, as a safeguarding firm, need to be thinking about for CASS 15 implementation and the coming audit.
Interim vs Assurance Standard
The first thing to note is that this is not the final assurance standard. It is ‘Interim Guidance’ intended to aid transition to a formal standard to be introduced in H1 2027 after consultation. It will eventually be an appendix to the existing CASS assurance standard.
What this tells me is that, yes, this is NOT a full CASS 6/7 style requirement yet, but the key word is YET. We are going to get there and need to plan accordingly. The challenge will be the potential for inconsistency across the market, some auditors are planning to stick closely to what the guidance says, but some will go all in with this being a full CASS audit.
One quick point, as the interim guidance says in note 9, I’m going to refer to these as audits, we all know they aren’t audits, but that’s how they are known.
Controls, IT Systems and Audit Expectations Under CASS 15
A key area that is coming up in conversations is the focus on controls. Because most firms in the sector rely heavily on automated systems, the FRC is clear that we have to test the IT General Controls (ITGCs) as well as the wider controls that have been put in place to address the requirements of the rules.
From a general controls point of view, I’ll want to see a detailed rules mapping document. This should consider every rule. Some won’t be applicable and this can be noted and, importantly, justified. For the rules that apply the document should detail (or refer to) the control(s) in place that address the risk.
For the ITGCs, you should be ready for your auditor to ask detailed questions about:
- User Access: Who has the power to change bank details or move funds
- Change Management: How do you test and approve updates to your core platform
- IT Operations: How do you ensure the data being fed into your daily reconciliations is accurate
Personally, the inclusion of ITGCs in the interim guidance is good to see. In a digital-first sector, you can’t have confidence in the safeguarding numbers if you don’t have confidence in the systems producing them. Though this may not be something firms have documented in the past to this extent, we will now be asking about them so it is important to be ready.
I would want to understand and test these controls before we get to the period end date on the report. I’ll want to see how the systems work and be able to trace the money flow, then we can streamline the detailed testing after the period end.
Managing Breaches and Reporting Periods
You need a breaches register that is robust and detailed. If you have a 1p shortfall, it needs to be recorded. The FCA expects to see breaches, especially in the first year. What they will be looking for is how you identified them and what you did to fix the root cause. It should also include the CASS rule number that has been breached, the amount of time the breach lasted for and the numeric value of the breach, if applicable.
Navigating the Hybrid Reporting Period
Since many firms have financial years that straddle the May go-live date, the FRC has confirmed that we can use a hybrid opinion.
A lot of safeguarding reports under the legacy safeguarding regime were not carried out by statutory auditors, I believe there will be many cases where statutory auditors do not have experience conducting legacy audits and therefore won’t be able to provide hybrid reports.
As such I think having separate safeguarding audits conducted will be a popular choice. Especially given that it could extend the time until a report under the new rules is due, potentially until November 2027. Remember that the safeguarding audit does not need to be at the same time as a financial audit or at a time that it has been done in the past.
The dates matter.
- An assurance report, whether that be under the legacy safeguarding regime, for periods until 7th May 2026 or under the supplementary regime from that date onwards, cannot be more than 53 weeks after the previous period end.
- If you get an audit to a date before the 7th May this can be under the legacy regime – it doesn’t need to be completed by a statutory auditor and it could be for a period of less than 53 weeks.
- If the period end date straddles the 7th May, a hybrid report could be prepared.
- If the period start date is 7th May onwards, it will be under the supplementary regime, BUT:
- If the audit is completed and the report signed before the dedicated performance standard is annexed to the CASS Assurance Standard (expected H1 2027), then the interim guidance will apply.
- The moment the standard is annexed, the interim guidance no longer applies and the audit must follow the annex.
Hopefully you can see from this that it is possible to have a final audit under the legacy regime and then the next audit could be under the full annexed standard, the interim guidance may never apply.
A Final Note
The FRC has granted a one-off extension, allowing six months (rather than four) to submit the first report. While that provides some breathing room, I expect auditor capacity to be a big bottleneck.
Firms should hopefully have systems that comply with the rules ready to go now, though I expect there are many that aren’t fully ready. In a lot of cases your compliance consultants will have been helping you with the gap analysis, rule mapping documents etc and you should have some clarity on the controls that are in place and how the CASS 15 rules will be complied with.
Consider talking to auditors early and having some interim work carried out. Anything identified by the auditor will need to be included on the report, but if controls and processes have been updated to minimise the chance of reoccurrence, this will look more positive.
I’d be very happy to work with firms on their safeguarding audits, please get in touch with our FInancial Services Team if you’d like to discuss how we could help.
Contact Our Experts
