A CASS audit finding needs a response that explains what happened and shows how management will address it. The challenge is often turning an identified problem into a change that works consistently, with clear ownership and evidence that the action has been completed.
This article focuses on management’s response to findings, including investigation, corrective action and follow-up. It complements our CASS audit guide, which explains the wider engagement, reporting process and regulatory context. The examples below illustrate ways to organise a response; they are not a substitute for assessing the rules and circumstances relevant to an individual firm.
Start by reading the finding carefully. Establish which process, period and legal entity it concerns before assigning an action. A response written too quickly can address the visible symptom while leaving the underlying weakness in place.
Understand the finding before drafting a response
Separate the facts identified from the auditor’s assessment and any recommendation. Check the dates, records and transactions referenced. If management believes something is inaccurate, provide the relevant evidence and a clear explanation promptly. Factual clarification is most useful while the draft is being discussed.
The FRC Client Asset Assurance Standard provides the framework for the assurance engagement and reporting. The auditor determines the conclusion independently. Management’s response should explain its position without assuming that agreement to a corrective action determines the audit opinion.
For an illustrative example, a finding about missing review evidence requires more than confirmation that a manager usually checks the work. Establish whether the review occurred, what record exists and whether the same evidence gap affects other dates. This distinguishes a documentation issue from a control that did not operate.
Assess the extent and immediate client asset risk
Identify whether the issue affects one event or a wider population. Consider the relevant accounts, clients and systems, then determine what further investigation is needed. Keep a record of how the review population was selected and the limitations of the information available.
Where an issue may expose client assets to continuing risk, management should assess immediate protective action while the investigation proceeds. The appropriate response depends on the applicable rules and facts. Avoid assuming that every discrepancy can be left until the next scheduled committee meeting.
Consider regulatory notification requirements at the same time. SUP 15.3 contains general notification provisions, and relevant CASS chapters may impose additional duties. The annual audit report does not replace a notification required earlier. Document the assessment, the decision maker and any communication with the FCA rather than relying on an undocumented judgement.
Find the cause behind the immediate error
An investigation should explain how the problem arose and why existing controls did not prevent or identify it sooner. Human error may describe the final action, but it rarely explains the whole process. Consider whether unclear instructions, unavailable information, unsuitable system settings or ineffective review contributed.
The FCA’s wholesale banking supervision observations highlight issues including unclear reconciliation break explanations, omitted zero-balance accounts and weaknesses in change oversight. These observations provide useful questions to consider where relevant, although they should not be treated as findings about every sector or individual firm.
For example, if an inactive account was omitted from a working file, establish how the population was generated. A manually maintained list may have been copied forward without comparison to banking records. Adding the missing account corrects that instance; changing how the population is checked addresses the reason it was missed.
Match corrective action to the cause
Describe the immediate correction separately from the longer-term change. The correction may resolve a specific balance, record or access problem. The longer-term action should reduce the likelihood of the same failure recurring and make any future exception easier to detect.
In the account inventory example, management might introduce a comparison with an independently obtained account listing and document how differences are resolved. The action should specify who performs the comparison, when it happens and what evidence remains. The exact design needs to fit the firm’s systems and relevant requirements.
Avoid actions that depend entirely on reminders to staff. Training can help where understanding is the cause, but it may not address a report that excludes an account automatically. Check that the proposed response changes the relevant process and does not simply add a statement to a policy manual.
Write management comments that can be checked
SUP 3.11 sets out expectations for management’s explanations of breaches and remedial action when considering the draft client assets report. It also requires the final report to be reported to the governing body. A useful response should be understandable to someone who was not involved in the original incident.
Explain the circumstances, the work completed and the action still outstanding. Identify the responsible owner and intended completion date. If the impact assessment is unfinished, say so and describe how it will be completed. Avoid claiming that no clients were affected unless the investigation supports that statement.
For example, management might explain that an account was added to the reconciliation population on a stated date, that the historical review covers the full period of omission, and that a new completeness check will be tested before closure. Clearly label planned actions so they cannot be mistaken for completed work.
Keep historical reporting separate from remediation
Correcting a problem does not change the fact that it existed during the reporting period. SUP 3.10 requires identification of individual rules breached within the reporting framework. Management should discuss the facts and evidence with the auditor without assuming that remediation removes an identified historical breach.
Maintain the original incident record and add subsequent developments. Record when the issue was identified, what action was taken and which evidence supports completion. This chronology helps explain how the position changed and avoids contradictory accounts appearing in the incident log, committee papers and audit response.
If a finding remains open when the report is completed, give an accurate statement of progress and outstanding dependencies. An honest target date with a clear interim arrangement is more useful for oversight than an optimistic claim that the matter has been resolved when implementation is still incomplete.
Decide what evidence will demonstrate completion
Define the evidence required for closure when agreeing the action. A revised procedure may demonstrate that management has changed the instructions, but further evidence may be needed to establish that staff are following them. Consider who should review that evidence and whether they have sufficient independence from the work performed.
An illustrative follow-up might examine completed checks over an appropriate period, including an exception and evidence of its resolution. The selection should reflect the control’s frequency and risk. One successful example immediately after training may provide limited information about whether the change is sustainable.
If implementation relies on a software update or provider change, retain the testing results and outstanding limitations. Record any further work needed after release. Closing an action should mean that the agreed response is supported by evidence, rather than simply that a project task has been marked complete.
Use governing body reporting to challenge progress
Provide management with a concise view of open actions, overdue dates and unresolved dependencies. Explain which matters require a decision, additional resources or acceptance of a continuing risk. Repeatedly moving a deadline without explaining the consequence makes it difficult for the governing body to exercise effective oversight.
Where an action involves an outsourced provider, retain the firm’s own follow-up record. A supplier’s assurance that the matter is resolved should be considered alongside the evidence needed to understand the change. Identify who will escalate delays if the provider cannot deliver the agreed response.
Look across findings for related causes. Several issues involving manual file preparation might indicate a broader data problem. Addressing each separately may leave that common weakness untouched. Management can use the action review to decide whether a wider change is needed, while preserving clear ownership of each individual finding.
Set a review date for actions that depend on external decisions. If delivery slips, explain the reason and reconsider whether the interim arrangements remain adequate. An overdue action should stay visible until the agreed closure conditions are met. Where new evidence changes management’s original understanding, update the assessment and explain the change to the relevant decision makers. This keeps the response connected to the developing facts and helps prevent an outdated action plan continuing simply because it was approved earlier.
Discuss CASS assurance with Millet Audit
A well-managed response explains the finding, addresses immediate risk and connects corrective action with evidence. It also gives directors a reliable account of what remains unresolved. Keep the original history available and review whether completed changes continue to operate as intended.
Millet Audit provides independent CASS assurance services for regulated firms. Management remains responsible for designing and operating its controls, while the assurance engagement provides independent assessment and clear reporting. Contact Millet Audit to discuss your firm’s reporting requirements, existing arrangements and the scope of an appropriate engagement.