What happened?
There is no doubt that we are now entering a period of consolidation for CASS. There are no significant regulatory changes in the pipeline, and while we are unlikely to see any falling off in CASS audit standards, it does not look as if there will be any additional burden either.
Despite this, firms must keep their eye on the ball. The recent failure of Beaufort Securities had a significant and public impact on investor confidence in the CASS rules and the level of protection they afford. This highlighted how quickly the hard work of CASS firms can be undone in the eyes of investors.
There is also now a chance for firms to ‘clean up around the edges’; mandates (covered in CASS 8) are an area we see as likely to be subject to further scrutiny as auditors look for new issues to make recommendations on now that CASS toolkits are operational.
CASS audit: Consolidation needs to reduce burden on time and resources
Greater consistency in audit scope, costs, and approach would make life easier for firms. In a recent industry survey, 58% of firms said that the CASS audit was one of their biggest challenges, half said it was one of their biggest costs, and 78% agreed or strongly agreed that auditors should be able to apply materiality on breaches in annual CASS audits.
All firms have now been audited at least once under the new FRC Assurance Standard. There are some concerns about differences in approach and interpretation between firms of auditors, and many firms would like to see some level of materiality applied in CASS audits.
Industry research shows that auditors are still relying heavily on firms’ documentation and that the CASS audit retains a strong controls focus. The documentation requested by auditors now seems fairly consistent with requests for the following being common for CASS audits: CASS rules and controls mapping and process maps, procedure and policy documents, CASS governance terms of reference and CASS MI.
The growth in software tools is driven by CASS Large firms. Some firms are using a software tool to store CASS controls while others are using an Excel CASS matrix for this purpose.
The number of key CASS controls is related to a firm’s CASS footprint as one would expect; however, there is a wider than expected distribution of the number of key controls firms are recording. On average, firms record three key controls per CASS risk identified but there is a significant distribution which is likely to be an interesting benchmark. Most firms have fewer than two key controls per CASS risk identified but nearly 1 in 5 has five or more.
Good governance is a key aspect of CASS compliance and with the implementation date of 9th December 2019 confirmed for the Senior Managers and Certification Regime for solo-regulated firms, it will be an especially hot topic for some. With a little over a year to go, this regime is set to reinforce CASS oversight requirements and set expectations for consistent governance standards for the industry.
There appears to be a greater consensus evolving around the frequency and trending period for CASS MI. Monitoring CASS MI on a regular basis is essential to enable firms to prevent and/or anticipate breaches and the CASS oversight head will need to heavily rely on this practice in order to fulfil their duty of responsibility effectively.
With a few Medium/Large CASS firms indicating that they only review their MI on a monthly basis, this might not live up to the regulator’s expectations for SMCR. The same observation applies to MI trending analysis, which firms will need to introduce on a more regular basis in order to support a forward-looking management framework for CASS activities.
Many firms will have invested in IT solutions for their CASS-related processes this year. Top of the list for investment are reconciliation processes, with many firms having chosen to strengthen their controls by investing in systemic reconciliation tools or software solutions that support a CASS toolkit.
The use of unbreakable term deposits
Some firms are making use of unbreakable term deposits for holding client money and some firms are able in this way to greatly improve the return on client money held.
Key points to note are:
Returning unclaimed client money and assets
It is understood that many firms continue to hold unclaimed client money and/or unclaimed client assets. However, a significant proportion of firms have been able to remove these balances and hence reduce the compliance burden of maintaining them.
The UK’s EU withdrawal
We are not aware of any direct CASS impact; however, there may be business changes, such as legal entity restructuring which CASS teams need to plan for, especially where regulatory permissions, i.e. CASS scope, are concerned.
How can Thistle help you?
Thistle will continue to keep this area under review and will issue further updates where necessary.
We do offer a CASS gap analysis that you can use to track your controls and compliance with the rules and provide to your CASS auditors at the time of the annual audit. We have a suite of template documents that you can tailor and use to record your client money and custody assets processes and, where required, we can undertake a detailed internal audit by a CASS specialist to ensure that you are fully prepared for the CASS audit. Along with this, we offer a number of compliance services and support solutions.
Please contact us if you need assistance in relation to any of these issues.