Audits

Why independence matters

An audit is only worth what its independence is worth. The review has to be carried out by someone who did not design or operate the controls being tested, which is precisely why it surfaces what an internal review does not.

We do not review our own work. Clients deserve an objective view of whether their frameworks and controls are working as intended, and an audit that tells you what an inspection would find, while there is still time to act on it, is the only kind worth commissioning.

Independent AML Audits

Independent reviews of AML, CFT, CPF and sanctions frameworks, controls and regulatory compliance. Testing is risk based and covers both halves of the question, which fail independently of one another:

• Design. Whether the documented framework addresses the risks this entity is actually exposed to, rather than the risks a template assumed.
• Operation. Sample testing of client files against the standard the organization set for itself. This is where documented practice and actual practice most often part company.
• Risk assessment. Whether it is current, evidenced, and genuinely driving the controls applied.
• Screening. Sanctions and PEP screening coverage, frequency, and what happens to an alert once raised.
• Escalation. Whether internal reporting works, and whether there is evidence that it does.
• Training. Coverage, currency, and records.
• Prior findings. Whether previous issues were actually closed, or simply carried forward.

Fund structures bring their own questions: reliance on administrators and other service providers, the split of responsibility between the fund and its delegates, and evidence of oversight of work that has been outsourced but remains the entity’s responsibility.

Other Regulatory Audits

Independent reviews of governance, compliance, internal controls and other regulatory or operational areas, scoped to the organization’s requirements and risk profile. Scope is agreed at the outset rather than assumed, because what is useful to test differs considerably between a fund, a company manager and a DNFBP.

What you get

Findings rated by risk, each with the deficiency, its consequence, and a recommended action with an owner and a timeframe. Written plainly enough to take straight to a board.

Where findings need closing, that work continues under regulatory advisory rather than under the audit, so the independence of the review is preserved.