Preparing for your first CASS 15 audit can feel daunting, particularly as firms move from previous safeguarding audit requirements to a more detailed review of compliance, controls and governance.
In this article, our specialists explain what payment services and e-money firms should expect, the most common areas of focus, and the practical steps that can help ensure a smoother audit process.
What has changed under CASS 15?
As we’ve discussed in previous articles, your first CASS 15 audit may vary significantly from your previous safeguarding audits, carried out under the Payment Services and Electronic Money Regulations. Your CASS 15 auditor will have a far greater focus on compliance with the underlying rules and internal control environment than you may have experienced previously. This will include areas such as Information Technology and your resolution pack, which previously may not have been covered.
Management should also remember that there is no concept of materiality when it comes to breaches that will be included within the CASS report, and firms should ensure that all breaches, no matter how small, are included within their breach log.
Why preparation is critical for a successful CASS 15 audit
As we learnt from the introduction of previous CASS regimes, the key to a successful audit is being prepared for the process and understanding what information you should be expected to produce. The first step for this is to ensure an early meeting is arranged with your auditor to discuss and understand the approach to be taken, the information that will be needed and when this is required to be provided, and the timetable for reporting and finalising the audit.
Given that some of the items being requested will differ from previous years, it is vital that management obtain the auditor’s request list as early as possible to ensure that the requests are fully understood and can be allocated to the relevant members of the CASS team to ensure that the items are provided in line with required timescales, as a failure to do this can lead to delays later in the audit process. It will also enable to the auditor to identify any potential breaches earlier in the process, enabling management more time to put in place mitigation actions.
Management will also need to ensure that they receive the draft report from the auditors with sufficient time to enable management comments to be drafted, and reviewed where appropriate, and challenge any breaches that are not understood. Whilst the deadline for filing the first CASS report with the FCA is 6 months after the period end, these reviews can often take longer than expected in the first year and therefore it is key that the timetable is agreed early.
Information technology will receive greater scrutiny
As we have commented on in previous articles, given the reliance on IT by payment services firms, management should expect a greater focus on Information Technology General Controls (ITGCs), with auditors now being required to gain an understanding of the firm’s overall IT environment, including any controls that link to CASS processes. Any areas where controls are weak or deemed to be ineffective are likely to lead to breaches being recorded.
The aim of the IT work, which will focus primarily on the areas of change management, user access and general IT operations, is to place reliance on the data used within client platforms used for recording relevant funds, given that this will likely form the source data for internal and external client money reconciliations.
This will also include any automated controls, such as where reconciliations are produced by a third party or internal system and firms should ensure that both these and any manual controls are fully documented and understood ahead of the audit.
Documentation is more important than ever
For some internal controls and procedures, there may be little change following the introduction of the CASS 15 rules, however the interim guidance to auditors issued by the FCA, which governs these audits, places a far greater emphasis on documentation these procedures.
Management should ensure that for each of the CASS 15 rules, a document is maintained setting out the controls in place to ensure compliance with each rule and ensure that each control is fully documented, for example in a separate CASS manual or within procedural documentation. This will allow firms to demonstrate to their auditor that there are controls in place and reduce time required at the planning stage when walkthroughs are carried out and the auditor is gaining an understanding of the business model.
Firms are also reminded that the CASS rules require a resolution pack to be maintained, setting out the information required for a liquidator or administrator in the event of the failure of the firm. Management should view this as a key document and ensure it is updated on a regular basis.
Understanding the new CASS 15 reporting requirements
The FRC interim guidance to auditors sets out the required format of the CASS 15 report and management should ensure that they are familiar with this ahead of the audit taking place. The format of the report requires both firm and auditor identified breaches to be included in full with the report including a dedicated section for management to provide their comments on how the breach arose, how it has been rectified and any remedial action put in place.
Management are also reminded that where a period straddles the implementation date of CASS 15, 7 May 2026, the report will include two opinions, covering the previous safeguarding regime up to 7 May and the CASS 15 rules post this date.
In respect of the period post 7 May, the report will also provide two separate opinions, one on the firm’s compliance with the CASS 15 rules during the period, and the second being on compliance with these rules as at the period end date, with any breaches open at the year-end contributing to the period end date opinion.
Should no breaches be identified, by either the firm or the auditor, an unmodified opinion will be given. Where one or more breaches are identified that are not considered to be systemic in nature, a qualified opinion will be given and where one or more breaches which are considered to be systemic in nature, then the opinion will be adverse. Regardless of the opinion, all reports are required to be filed with the FCA.
Key takeaways for your first CASS 15 audit
Preparing for your first CASS audit requires more than a last-minute review of safeguarding arrangements, but early communication with your auditor is key to ensure management have a clear understanding of the process and what to expect throughout. This early planning will lead to fewer issues being raised later in the audit and fewer surprises during the process. As regulatory scrutiny of safeguarding continues to increase, firms that invest time in audit readiness will be better placed to demonstrate robust governance and effective compliance with the CASS 15 rules.
At PKF we are currently helping a number of firms prepare for their first CASS 15 audit.
If your organisation is preparing for its first CASS 15 audit, our specialists can help you assess your readiness, identify potential gaps and navigate the requirements with confidence. Contact our payment services team to discuss how we can support your CASS 15 compliance journey.
