The safeguarding audit

Safeguarding institutions in scope of CASS 15 must appoint independent auditors to examine their systems and controls and confirm compliance with the CASS requirements that apply to them. There is an exemption: firms holding less than £100,000 of relevant funds for a period of at least 53 weeks do not need an audit. Firms holding more than that amount must appoint an auditor.

The audit is governed by SUP 3A, which sets out how auditors should carry out the audit, what report they should issue and when it goes to the FCA. Where there are audit findings, the auditor issues a report and submits it to the FCA. Audit reports for periods ending by 13 May 2027 can be submitted within six months of completing the audit.

Preparing for the auditors

Preparation largely comes down to being able to evidence compliance. Firms should:

• map and validate safeguarding flows;
• have documentation to evidence compliance readily accessible;
• provide documentation supporting each requirement, and any other information the auditors request; and
• make sure individuals performing impacting functions are aware of auditor expectations.

What the FRC's interim guidance signals

The FRC published interim guidance to support safeguarding audits. It applies during the transition period, from 7 May 2026 until final standards are issued in spring 2027, and sets out expectations in five areas:

• a move to a CASS-style audit approach with a control-based focus;
• more focus on third-party and outsourcing arrangements, including third-party administrators;
• robust assessment of IT-dependent safeguarding processes and controls, covering design, implementation and operating effectiveness;
• identification and documentation of safeguarding risks, mapped to mitigating controls; and
• safeguarding reporting in line with SUP 3A Annex 1, with all breaches reported regardless of materiality.

Safeguarding audit is increasingly focused on how controls work in practice. Firms that map their safeguarding risks to documented controls and retain evidence of how those controls operate will be better prepared to demonstrate compliance.