What an independent AML audit actually tests

[PLACEHOLDER — awaiting review] This article is general commentary written as seed content. Review it for accuracy and house style, and have it signed off before publication. It is not legal or regulatory advice.

Most entities preparing for an independent AML audit for the first time expect a document review. They assemble the manual, the risk assessment and the training log, and reasonably assume that a complete set of documents means a clean report.

Documents are the starting point, not the test.

Design versus operation

An audit asks two distinct questions, and they fail independently of one another.

The first is whether the framework is adequately designed — whether the policies address the risks this particular entity is actually exposed to. A manual that carefully describes controls for products the entity does not offer, while saying nothing about the one delivery channel it relies on, is well-written and inadequate at the same time.

The second is whether the framework operates effectively — whether what the manual describes is what actually happens. This is tested by sampling: pulling client files and checking them against the standard the entity set for itself.

The second question is where findings cluster.

Where practice drifts from paper

A few patterns recur often enough to be worth anticipating:

• The risk rating that never changes. Every client is rated medium. When a rating methodology produces no variation, it is not being applied — it is being recorded.
• Enhanced due diligence that is triggered but not performed. The file correctly identifies a PEP connection, and then contains exactly the same documentation as a standard-risk file.
• Source of wealth conflated with source of funds. A wire from a named bank account evidences where money came from, not how it was accumulated.
• Periodic review dates that have passed. Often by years, and usually because nobody owns the tickler.
• Screening at onboarding only. Sanctions lists change. A client screened once at onboarding in 2021 has been unscreened since.
• Training records without content. An attendance list proves people were in a room. It does not evidence what they were taught.

Prior findings matter most

If there is one thing an auditor looks at hardest, it is the previous audit’s findings. An unremediated finding that reappears is materially worse than a new one: it establishes that the entity identified a deficiency, recorded it, and did not act. That is a governance failure on top of a control failure, and it reads very differently to a regulator.

Preparing usefully

The most useful preparation is not tidying documents. It is pulling ten client files at random and checking them yourself against your own manual. Whatever you find, the auditor will find as well — and finding it first means you get to present a remediation plan rather than receive one.