Scoping a Lean AML Audit at a Cross-Border Payments Fintech
Northgate Payments is a seven-year-old fintech with three products: a domestic peer-to-peer wallet with 1.4 million users, cross-border remittance across 60 corridors, and merchant acquiring for 2,200 small merchants. It is supervised as a money services business and holds no bank charter. Last year's AML audit was performed by a consulting firm and produced six findings; three remain open, including one on agent oversight. You are the new head of internal audit with a budget of 1,100 hours against 1,600 hours last year. Monitoring runs on a vendor platform, and 12 analysts at a contracted service organization in Manila review alerts and draft narratives. Onboarding is largely automated through a third-party identity verification provider. About 38 percent of wallet accounts have had no transaction in 12 months. Management has asked you to lean on the vendor's SOC 2 Type II report and the prior firm's workpapers to fit the budget.
1. How would you build a risk-based scope and allocate 1,100 hours, and what would you explicitly exclude?
Read the worked answer
Scope should follow inherent risk and open findings, not last year's template. Rate the products separately: cross-border remittance across 60 corridors is high risk on jurisdiction, agent, and third-party dimensions; merchant acquiring is high to medium depending on underwriting for shell or prohibited merchants; the domestic wallet is medium risk, but its large dormant population is a mule and fraud indicator, not a reason to exclude it.
Hours might run roughly 35 percent to monitoring and investigations, the largest control volume and the outsourced piece; 25 percent to CDD and onboarding including the automated identity verification; 25 percent to cross-border and merchant onboarding; 10 percent to governance, training, and reporting; 5 percent contingency. The three open findings must be re-tested because remediation is unproven, so they cannot be treated as prior coverage.
Exclusions must be explicit and defensible. Examples include tax reporting, general IT security, and the vendor's internal controls beyond complementary user entity controls. Document the rationale, obtain audit committee approval, and state the residual risk left unscoped. A reduced budget is a constraint to disclose, not a license to cut high-risk coverage silently.
2. Management wants to rely on the service organization's SOC 2 Type II report for alert review. What does that report cover, and what must you still test directly?
Read the worked answer
A SOC 2 Type II gives an opinion on a service organization's controls over criteria such as security, availability, or confidentiality for a period. It does not opine on whether the platform detects money laundering, whether scenario logic is sound, or whether the Manila analysts' dispositions are defensible. Read the report for scope, period covered, exceptions and qualified opinions, carved-out controls, subservice organizations, and complementary user entity controls.
The user entity controls matter most. You must test whether Northgate actually performs each one, for example feeding accurate customer risk ratings, reviewing alerts within service levels, and acting on escalation. Then test what the report cannot cover: sample 50 vendor-generated alerts and re-perform disposition quality; inspect threshold and scenario changes for approval and validation; review the contract and service levels for escalation to Northgate; obtain evidence of analyst competence and training; and confirm that SAR decision rights remain with the bank.
Reliance requires documented evaluation of competence, objectivity, and scope coverage. Where scope is partial, or the alert-review operation is carved out, you test the remainder yourself rather than assuming coverage.
3. Under what conditions may you rely on the prior firm's workpapers, and how do you handle the three open findings within a cut budget?
Read the worked answer
Reliance on another auditor's workpapers is permitted only after evaluating their competence, objectivity, and the sufficiency of the documentation, and only if the relevant processes have not changed materially. Given a new monitoring vendor arrangement and a new head of internal audit, I would use prior workpapers mainly for factual context, such as walkthroughs and contract terms, and re-perform every test that supports a conclusion I intend to sign.
For open findings, verify remediation by testing the redesigned control, not by reading a closure memo. For agent oversight, sample agents onboarded or activated after the remediation date and test approval, due diligence, and ongoing monitoring. If the sample is clean, that evidence can support closure; if not, the finding stays open and consumes hours in the current plan.
Finally, document why the 500-hour reduction is acceptable. It must come from lower-risk areas and from genuinely reduced testing, not from high-risk coverage, and the trade-off should be described in the audit committee materials so the governance body owns the residual risk. If the reduction cannot be justified on risk grounds, the correct answer is to request budget restoration in writing.