The Care Home's Cash Deposits and the Supervisor's Visit
You are the MLRO for a small accountancy practice that also provides bookkeeping to 30 care homes. One client, Elmwood Care, receives most of its income from a local authority, but its bank statements show £4,000–£6,000 per month in cash deposits, in round amounts, made at three different branches. The client says this is 'residents' contributions'. The practice's own policy says cash income above £3,000 per month requires enhanced monitoring. You have not reviewed Elmwood for 18 months. A supervisor has now written to say it will conduct a routine visit in four weeks and has asked for your firm's client risk assessments and evidence of ongoing monitoring. The partner who manages Elmwood says the file is 'fine, we've had them for years'.
1. Assess Elmwood's risk and identify the gaps the supervisor is likely to find in your firm's own arrangements.
Read the worked answer
Elmwood's risk is not low, and 'we've had them for years' is not a risk assessment. The cash pattern has several features that require explanation: round amounts, which are less consistent with genuine resident contributions than with deposits made to a target figure; multiple branches, which can be a structuring indicator or simply a convenience, but must be asked about; and a monthly volume that exceeds your own policy threshold every month, which means the policy has been breached by inaction rather than by a decision. Resident contributions can legitimately be cash - many residents and families pay in cash - so the pattern is not inherently suspicious, but the explanation must be tested against records: a residents' ledger, receipts issued, and a reconciliation between cash banked and contributions recorded.
The firm-level gaps the supervisor is likely to probe: (1) the client risk assessment for Elmwood appears not to have been reviewed for 18 months, so it may not reflect current risk; (2) the enhanced monitoring required by your own policy has not been applied, which is worse than having no policy, because it shows the policy is not operated; (3) there is no evidence of ongoing monitoring - no file notes, no periodic review, no analysis of the cash pattern; (4) the partner's attitude suggests risk assessments are treated as paperwork rather than as a live judgement. The supervisor will ask not just whether a risk assessment exists but whether it was used to drive monitoring, and whether the firm can show decisions being made and recorded.
2. What should you do in the four weeks before the visit, and how should you handle the partner's resistance?
Read the worked answer
Do not manufacture a paper trail. The supervisor will see the dates, and a risk assessment created the week before a visit, backdated or not, damages credibility far more than an honest gap. What you can legitimately do is remediate now and document that you are doing so.
Sequence: first, complete a fresh risk assessment for Elmwood using the actual evidence - the cash pattern, the source of funds explanation, the residents' ledger, the branch spread. Second, request the supporting records from the client and reconcile cash banked to contributions recorded for the last 12 months. Third, if the reconciliation does not explain the deposits, escalate to a suspicious activity report rather than waiting for the visit. Fourth, review the other 29 care home clients on a risk basis - not all in four days, but with a documented plan and priority order, so the supervisor can see a programme rather than a panic. Fifth, prepare an honest remediation log: what was missing, what has been fixed, what remains outstanding and by when.
On the partner: put the position in writing and keep it factual. The firm's own policy sets a £3,000 threshold; deposits have exceeded it every month for at least 18 months; no enhanced monitoring is evidenced; a supervisor is attending. Frame it as the firm's exposure, not a personal criticism, and ask for a decision in writing - either the partner endorses the remediation plan or records his disagreement. If he instructs you to present the file as complete when it is not, that is a matter you cannot comply with, and you should say so in writing and consider your position. The supervisor's visit is not the risk; the risk is being unable to show that the firm makes and records risk-based judgements.