Preparing documents for a CASS audit is easier when the evidence explains how the business actually operates. A folder containing current policies and a few bank statements may leave important questions unanswered, particularly where arrangements changed during the reporting period or records are held by an outsourced provider.
This article focuses on organising and checking evidence for an agreed CASS engagement. It does not decide whether your firm needs an audit or replace the auditor’s specific information request. For the wider regulatory context, assurance types and reporting process, read our CASS audit guide.
The aim is to make records traceable, complete for their intended purpose and available to the people reviewing them. Good preparation also helps management identify gaps early, rather than discovering during fieldwork that a former system can no longer produce the information needed.
Begin with the entity and reporting period
Put a short description of the regulated entity at the front of the evidence file. Identify its activities, permissions and relevant operating arrangements, together with changes during the period. Explain which services are performed internally and which rely on another group company or an external provider.
For investment firms within its scope, CASS 1A.2 sets out firm classification requirements. Retain the firm’s classification assessment and the supporting information where applicable. The preparatory task is to make the basis for management’s position understandable, including any circumstances that changed during the year.
Agree dates before collecting records. An evidence pack built around the financial year may be unsuitable if the client assets reporting period is different. Label folders and exports consistently so that neither management nor the auditor has to infer which period a document covers.
Connect policies with the procedures staff follow
Provide the policies and process descriptions relevant to the agreed scope, including the versions effective during the reporting period. Where a procedure changed, retain the previous version and explain when the replacement took effect. A current manual cannot establish how a control operated several months earlier.
Include enough context to connect a written procedure with its actual output. For example, if the policy requires a review, identify the record showing that review and the person responsible. A name typed into a template may need supporting information to explain when the work was completed.
Before submission, ask a colleague to follow one process using the documents provided. If they cannot identify the system, source records or expected output, improve the explanation. This internal exercise is preparation for the audit and should not be presented as independent assurance over the control.
Organise reconciliations so the calculation can be followed
For firms applying CASS 7, the standard methods of internal client money reconciliation provide relevant rules for calculating the client money requirement and resource. The evidence should make the method used by the firm clear and show where the calculation inputs originated.
Keep completed reconciliations alongside the source extracts, supporting workings and records of review. Explain reconciling items in ordinary language, including when they arose and what happened next. A note saying that an item is a timing difference is less informative than an explanation identifying the transaction and subsequent clearance.
As an illustrative check, select a date and trace a balance from the underlying client records to the reconciliation. Preserve the files used at that time. A new export produced today may contain later adjustments and should be identified accordingly. Ask the auditor which periods and populations are required rather than choosing only the most straightforward examples.
Build a reliable account and agreement inventory
Create an inventory of the bank accounts and relevant counterparties used during the reporting period. Include accounts that were closed, renamed or inactive, and explain their status. This gives the auditor a starting point for discussing completeness and identifying the supporting records needed.
For client money accounts within CASS 7, keep relevant acknowledgement letters with the account information. Identify which accounts each letter covers and retain associated correspondence where it explains changes. Similar-looking account names can cause confusion, so include clear identifiers in the working inventory.
Do not assume that a letter stored in a bank folder remains relevant to every account opened later. Review the coverage against the actual arrangements and raise uncertainties early. Where a document is unavailable, record the steps taken to locate it and discuss the issue with the appropriate internal owner before the audit request becomes overdue.
Include custody records and mandate information where relevant
A firm with custody assets should organise evidence around its custody arrangements, including records of client holdings and relevant custodian information. CASS 6.6 addresses custody records, accounts and reconciliations. Make clear how the evidence relates to the legal entity and the clients within scope.
Mandates need separate attention where applicable. CASS 8.3 covers records and internal controls for mandates. Identify the relevant authorities and the records explaining who can exercise them. A firm should not omit this area merely because no client assets appear on its own balance sheet.
Where a holding or authority ended during the period, retain the history needed to explain its operation and termination. For complex structures, a short narrative connecting the client, regulated firm and third party can make the supporting agreements easier to understand without replacing the agreements themselves.
Preserve governance and provider oversight evidence
Make available the governance records relevant to client asset oversight, together with the information considered at those meetings. A meeting date alone does not explain what management reviewed or whether concerns received a response. Link significant decisions to the papers or correspondence that supported them.
For outsourced activities, identify the agreements and practical monitoring records. These might include service reports, questions raised with the provider and evidence of how an incident was resolved. Arrange access to provider-held records early, especially where a contract or internal approval is needed before information can be released.
Ask the provider to confirm what historical information remains accessible. If its systems changed during the period, understand whether old reports can be reproduced and how their accuracy can be explained. Avoid relying on a general statement that the provider is compliant when the audit request concerns a particular process or event.
Keep incident records and resolution pack information accessible
Supply the record of known incidents and potential breaches relevant to the engagement, including matters already investigated or corrected. Preserve the original chronology and link each item to supporting correspondence or calculations. Management should be able to explain what was known at the time and how its assessment developed.
Where applicable, CASS 10 establishes resolution pack requirements, including retrieval arrangements. An audit evidence folder and a resolution pack serve different purposes, even if they refer to some of the same documents. Maintain the resolution pack as required rather than rebuilding it only when the auditor asks.
Try retrieving a small selection of referenced records through the documented access route. Record broken links, obsolete contact details and access restrictions. Resolve those problems with the responsible owner and retain the results of the exercise as part of the firm’s own preparation.
Use a clear request log and secure exchange process
Agree how information will be exchanged and limit access to those who need it. Client information deserves careful handling throughout preparation, including where staff copy files into temporary working folders. Use the firm’s approved arrangements and discuss any audit request that appears to require a different transfer method.
A request log should identify the item, owner, due date and current status. Link the response to the exact file provided. When a document is updated, explain what changed instead of silently replacing the earlier version. This helps everyone work from the same evidence and reduces repeated requests.
If a record is missing, distinguish between information that was never created and information that cannot now be retrieved. Explain the circumstances promptly. Alternative evidence may be available, but the auditor must assess whether it is sufficient for the engagement. Management should avoid presenting a retrospective reconstruction as a record produced at the original time.
Check exported data before sharing it. Confirm that the date range, entity and account filters match the request, and explain how totals connect to the underlying system. Retain the extraction settings or instructions where needed to reproduce the file. A spreadsheet with no description of its origin can create avoidable questions even when its figures are correct. If an export combines several sources, identify the joining method and any records excluded, so the auditor can understand the population presented.
Arrange an initial discussion with Millet Audit
The strongest evidence file is one that a reviewer can navigate and understand without repeated explanations from its creator. Agree the scope, organise the historical records and make ownership of outstanding requests clear. Preparation should make the existing evidence easier to assess while leaving a transparent record of limitations.
At Millet Audit, our CASS assurance services provide an independent assessment tailored to the engagement. Speak to our team about your reporting period and operating arrangements so that document requests, access needs and responsibilities can be discussed before fieldwork starts.