Firms holding client money or safe custody assets need effective processes for identifying, assessing and addressing CASS breaches. Failure to reconcile, delay in making up the shortfall, or use of an account without the proper acknowledgment letter can reveal shortcomings in these procedures.
Sometimes, the breach itself is not the issue for the auditor. The real issue is the breach that goes unreported, unexplained, and unaddressed. A properly kept breach register demonstrates that you have control over identifying your breaches and dealing with them.
Why the Register Matters at Audit Time
Relevant firms within the scope of client assets reporting requirements set out in SUP 3.10 of the FCA handbook should receive an annual client assets report from their auditors. These include firms holding client money under CASS 7 or safe custody assets under CASS 6, subject to the appropriate rules and exceptions. The auditor should submit the report to the FCA within four months of the end of the reporting period.
The auditor should determine all CASS rules under which there have been any breaches, or state in which there has never been any breach of a particular rule has been identified. All breaches identified by the auditor, disclosed by the firm or by any third party in the course of the review should be included in the breaches schedule. An identified breach within the scope of the client assets report should not be omitted from the breaches schedule simply because it appears minor. Separately, the auditor considers the significance, context, duration, recurrence and aggregate effect of breaches when determining the appropriate opinion.
This is why your register is so important. It gives the auditor an excellent starting point for his breaches schedule. Any breaches identified by the auditor but not included in your register can indicate problems with your internal monitoring and reporting system.
What to Record for Every Breach
An entry like “late reconciliation, correction made” will not be enough to conduct an efficient audit test. Each entry should contain details that would enable an outsider who had nothing to do with the case to know what happened and why it happened.
| Field | What to capture | Why auditors care |
|---|---|---|
| Rule reference | The specific CASS rule, e.g. CASS 7.15.29R | The breaches schedule is arranged according to rule |
| Date identified and date occurred | Both dates, plus duration | Illustrate how fast you identified the problem |
| Description | What happened, the amounts involved and the accounts affected | Helps determine the seriousness of the problem |
| Clients affected | Number of clients, or a note confirming none were affected | Helps identify the risk to clients |
| Root cause | Human error, system change, third party failure or design gap | Differentiates one-time problems from system problems |
| Frequency | One-off or repeated, with links to related entries | Continuous breaches may impact the audit report |
| Remediation | Immediate fix and lasting control change | The auditors test whether the correction worked |
| Notification | Whether the FCA was told, when, and under which rule | Shows if the notifiable breaches were corrected properly |
| Owner and sign off | Who investigated and who reviewed the entry | Helps demonstrate CASS compliance |
An out-of-date breaches register is one of the audit findings that Price Bailey mentions. In practice, there might be several shortcomings, which could be represented by a lack of references to rules, data on breach occurrence, information about reoccurrence of the breaches or information about breach resolution carried out by the company.
Look Back as Well as Forward
When a breach is found, determine the period when the weakness has been existing. Control failures found in March can also have been happening in February. The period when the weakness has been in place should be recorded and not just the date the breach was found.
Which Breaches Must Be Notified to the FCA
Reporting the breach and the notification to the FCA are two distinct obligations. The firm has to inform the FCA in writing without delay under CASS 7.15.33R in certain cases. Among those are materially false or out-of-date record-keeping of client money, inability to perform necessary reconciliations, certain shortcomings connected with the shortfalls, excesses or reconciliation discrepancies. Safe custody assets have their own reporting obligation according to CASS 6.6.57R. The exact obligation will depend on the situation mentioned in the rule.
Apart from that, SUP 15.3.11R imposes an obligation for firms to notify the FCA about serious breaches of relevant rules and other conditions. In determining whether the breach is serious, the firm should take into account financial losses, frequency of the breach occurrence, consequences for the systems and controls and delay in reporting.
You should not think that reporting will be possible only after the completion of the investigation. If the reporting obligation arises, the firm has to meet the deadline regardless of the progress of the investigation.
What Auditors Will Test
The auditors are not content with just reading through the register. They will cross-check it against the supporting records and evidence to ascertain that any breaches have been detected, recorded and acted upon. Areas for testing include:
- Completeness: Auditors test for completeness by comparing the differences noted during reconciliations, the shortfall transfers and system logs against the breach register to determine if there are any missing breaches.
- Reconciliation period: Auditors test if the requirement to reconcile the internal client monies each day under CASS 7.15.15R is being complied with. In addition, external reconciliations need to be performed as frequently as possible but not later than one month after the previous reconciliation under CASS 7.15.22R.
- Shortfall Funding: Auditors test if any investigations have been carried out and whether the shortfall was deposited in the client bank account or excess withdrawn by end of business on the day of the reconciliation under CASS 7.15.29R.
- Acknowledgement letters: The auditor verifies that the firm has obtained the required acknowledgement letters for its client bank accounts and whether they satisfy the relevant CASS requirements.
- Notification decisions: The auditor verifies that breaches that require notification have been notified to the FCA and that the firm has recorded its justification when it determined that notification is not required.
- Remediation: The auditor verifies that the remedial actions undertaken by the firm in the last year have been successful. It can include follow-up testing of previously discovered weaknesses.
How Breaches Affect the Opinion
| Outcome | Typical trigger |
|---|---|
| Unmodified | No matters requiring qualification |
| Qualified (“except for”) | Isolated breaches where the system generally worked |
| Adverse | Systemic or pervasive weaknesses |
| Unable to form an opinion | Insufficient evidence for a requirement |
These classifications are based on the Client Assets Reporting system described by Safeheld. The ultimate decision rests with the auditor.
Common Breaches That Often Go Unrecorded
The following issues can be missed by firms if they are maintaining their own register of breaches:
- Letters of acknowledgement which do not match the prescribed wording or template.
- Client money held with a payment service provider if the arrangement does not satisfy the criteria of an eligible client bank account.
- Inappropriate or delayed transfer after reconciliation.
- Segregation arrangements that are sensible but not supported by an appropriate policy where such a policy is required under the relevant rules.
- Bank due diligence that has not been properly documented.
This list is similar to that covered in the CASS audit guidance and findings. Whether or not an issue amounts to a breach will depend upon the facts and the relevant FCA rules.
Why Choose Reflex Accounting for Your CASS Audit?
The breach register can only be useful if it captures the breaches highlighted in the audit. Reflex Accounting’s CASS audit service verifies if your breach register matches your records and audit results. Our service is designed for FCA-regulated firms that either hold or control client money and safe custody assets. Each audit is customised based on your FCA permissions, services offered, CASS categorisation, and the way you hold client assets.
