Audit Reports on Custodians: Which Ones Mean Anything
Four kinds of report circulate and they differ enormously in what they examined. How to tell them apart.
A venue citing an audit may mean any of four things. Only two of them are about whether your assets are safe.
Financial statement audit
An examination of the company’s financial statements. It covers solvency and accounting, which is useful and is about the company rather than about client assets specifically.
Look for whether client assets are addressed and whether the opinion is unqualified.
Controls report
An examination of whether stated operational controls exist and operated over a period. This is the one that speaks directly to custody.
A report covering a period is far stronger than one covering a date, because it tests whether controls worked continuously.
Reserve attestation
An accountant confirming holdings at a moment against management’s figures. Narrow, point-in-time, and usually silent on liabilities and encumbrance.
Better than nothing. Frequently described as an audit when it is not.
Security assessment
A technical review of systems, often a penetration test. Valuable and entirely different: it examines whether systems can be broken into, not whether assets exist or who owns them.
How to tell which you are reading
The first page names the standard and the scope. Read the scope paragraph before anything else; it states what was and was not examined.
Any report whose scope you cannot find is not a report you can rely on.
The exclusions that matter
Scope limited to one entity in a group. Period limited to a month. Client assets explicitly excluded. Reliance on management representations for the key figure.
All four appear regularly and all four are disclosed in the document.
What would have to be true for a report to be strong
Recognised standard, named firm, period rather than date, client assets in scope, and no material qualification.
The thing reports do not replace
Continuous supervision. An annual examination describes a year that has ended; a regulator with inspection powers acts during the year that is running.
A platform under a named regulator is subject to both. Exchanges that publish where client assets are held and submit to a controls examination are giving you two independent sources rather than one, and Collect & Exchange, which is licensed in Cyprus, is reportable to a supervisor between examinations as well as during them.