The Cayman Islands Monetary Authority (CIMA) has published updated rules governing which audit firms can sign off the accounts of regulated financial services businesses.
The ‘Regulatory policy: Approval of an auditor for a regulated entity’ was published this month and will take effect on 1 January 2027.
It applies to entities that are required under Cayman financial services laws to appoint a CIMA-approved auditor.
Under the policy, only audit firms with a physical presence in the Cayman Islands will continue to be approved.
The regulator defines physical presence as maintaining local premises together with human, technological and intellectual resources that are appropriate for the size and nature of the firm’s operations.
Audit work may still be performed partly outside Cayman. However, audit reports for regulated entities must be signed by the approved auditor after confirming that applicable accounting and auditing standards have been met.
Firms seeking approval must be registered as public practice firms with the Cayman Islands Institute of Professional Accountants (CIIPA) and remain in good standing.
They are also expected to comply with international ethical and independence standards, including those issued by the International Ethics Standards Board for Accountants.
The policy highlights several risks that could compromise auditor independence. These include self-interest, self-review, advocacy, familiarity and intimidation threats.
When assessing applications, CIMA said it will consider a firm’s professional education standards, staffing levels, quality assurance reviews and industry expertise.
Other important considerations
The regulator also set experience requirements for engagement partners signing audit reports.
Those individuals must be licensed practising members of CIIPA and are generally expected to have at least five years of management-level experience auditing financial institutions within the sectors they audit.
The policy also expands on circumstances where auditors must report concerns directly to the regulator.
These include situations where a regulated entity may be unable to meet its obligations, may be operating in a fraudulent or criminal manner, or may not be complying with applicable laws or licence conditions.
Audit firms must also notify CIMA within 21 days of any material change affecting information submitted as part of their approval.
The same deadline applies to significant matters that could adversely affect audits of regulated entities.
The authority also clarified that existing approved auditors will not be required to undergo a new approval process when the policy takes effect.
Those firms can continue operating under their current approvals provided they continue to meet the policy’s ongoing requirements relating to education, ethics and other standards.
