Independent Testing

The idea is that the people who run a control should not be the only ones who judge it. The tester examines the whole financial crime programme: policies, risk assessment, customer checks, monitoring, reporting, training and record keeping. It may be done by internal audit, by a separate unit that is free of day-to-day duties, or by an outside firm. What counts is independence, adequate skill and a direct line to senior management or the board. The review samples files and alerts, reperforms control steps and checks whether earlier findings were closed. It usually runs on a risk-based cycle, with weaker areas seen more often. Many AML rules in the US, UK and elsewhere expect this step explicitly. Findings feed remediation plans. Without it, confidence in a firm's controls rests on the word of the people who run them.

A payments company asks its internal audit team to review its AML programme. Auditors pull 60 high-risk customer files and find that ten lack documented source-of-funds checks. They also find that a monitoring rule was switched off during a system upgrade and never restored. The report goes to the audit committee, and management agrees a dated plan to fix both.