Audits
Regardless of whether firms use a TPA or manage their CASS processes internally, the cost of audits is still a pain point for many.
Not only do 40% of CASS firms say that audits are their highest cost, but almost nine in 10 saw an increase in audit costs over the past 12 months, with the average cost increase being around 23%. For large CASS firms, audit costs rose by around 14%; for CASS medium and small firms, costs rose by almost 30%.
Rising costs are likely because audits have been underpriced for some time. The increased focus on technology, which is naturally more expensive, could also be a factor.
Despite rising costs, firms should note that the findings of CASS audits continue to drop significantly. This is to be expected as the regulation has been around for some time.
Technology
Firms investing in CASS-related technology is tapering off: not only are fewer firms investing, but those prepared to invest are now spending less, relative to the last few years. Investments in reconciliation tools, workflow solutions and Robotic Process Automation (RPA) are down on previous years.
Widespread market disruption across 2020 and 2021 is a possible explanation for this. It is equally likely that initial spikes in spending on CASS toolkits is naturally declining as the regulation is now more mature.
Technology is also a more prominent part of the audit process than ever before. Some 39% of firms received feedback from auditors on improvements required to their CASS control environment. This is especially true for larger firms.
Firms are most consistently challenged by their auditor on the following:
- Access controls to CASS technology (23%)
- Use of automation for CASS processes (23%)
- Quality of oversight for CASS technology change controls (15%)
Software solutions
Software solutions for CASS toolkits continue to be a popular choice in response to the FR&C assurance standard and auditor expectations.
More than 50% of CASS firms now use a software tool to manage their CASS toolkit, compared to less than 10% in 2017. By contrast, less than 40% continue to manage these processes via Microsoft Excel, which is down from almost 70% in 2017.
We can expect this trend to continue in the coming years as more firms leave spreadsheets behind in favour of a single, centralised control framework for their CASS processes. As software tools become more popular, time will tell whether auditors and regulators heighten their expectations of CASS firms.
CASS culture
The FCA continues to emphasise how central a positive culture is to CASS compliance, especially in key areas like the escalation process.
Reassuringly, CASS firms score highly on culture metrics: 100% of CASS large firms were positive in their response to questions about culture, while small and medium CASS firms now outperform their larger counterparts when it comes to CASS training.
What action do CASS firms need to take?
Firms will be more than aware that the FCA has stepped up the frequency of Dear CEO letters in the last 12 months. But simply reading these letter is not enough: the FCA expects firms to take action on these letters and be able to explain this action to regulators.
Looking ahead, CASS firms should be able to communicate to the FCA how they incorporated the recommendations from these letters into their daily processes.