CAMS-Audit cheat sheet

A compliant AML/CFT program must include: (1) a designated compliance officer, (2) internal policies and controls, (3) ongoing employee training, (4) independent testing, and (5) customer due diligence (CDD) procedures.

The risk assessment must be dynamic, documented, and updated when new products, services, customer types, geographic exposures, or regulatory changes occur.

Board or senior management approval of the AML/CFT program and risk assessment is a fundamental governance requirement; minutes should reflect deliberation and approval.

The risk assessment should consider inherent risk (customer, product/service, geographic, delivery channel) and control effectiveness to derive residual risk.

The compliance officer must have sufficient authority, independence, and resources; reporting lines should bypass business lines that generate revenue.

Audit should verify that risk assessment methodologies are consistently applied and that risk ratings are supported by data (e.g., transaction volumes, SAR counts, high-risk customer percentages).

Training programs must be role-based, documented, and tested; completion records and content should be reviewed for relevance to actual risks.

Governance audits test whether policies are approved, communicated, and enforced; look for evidence of board oversight, escalation, and accountability.

Risk-based audit planning prioritizes areas with higher residual risk and considers prior audit findings, regulatory changes, and emerging risks.

Audit scope must be clearly defined in an engagement letter or planning memo, including systems, business units, time periods, and regulatory requirements covered.

Materiality thresholds and sampling methodologies should be documented; sample sizes must be sufficient to support conclusions and consider population characteristics.

Audit programs should map testing steps to specific regulatory requirements (e.g., BSA, FATF recommendations, local AML laws) and internal policies.

Walkthroughs and process mapping are used to understand controls and identify key control points before designing tests of effectiveness.

Resource planning must ensure auditors have relevant AML/CFT expertise; use specialists where needed (e.g., sanctions, data analytics).

Audit methodology should include criteria for rating findings (e.g., critical, high, medium, low) based on impact and likelihood.

Coordination with external auditors and regulators should be planned to avoid duplication and ensure complete coverage.

Test of design evaluates whether a control, as designed, can prevent or detect and correct material errors or fraud; test of operating effectiveness evaluates consistent application over time.

Transaction monitoring system tuning and validation should be reviewed: thresholds, scenarios, and alert dispositions must be justified and periodically recalibrated.

Sampling for control testing should consider the frequency of control operation; for daily controls, a sample of 25-40 items may be needed for high assurance.

Alert investigations must be documented, timely, and include disposition rationale; look for evidence of independent review and escalation.

Data analytics can be used to test 100% of a population for specific attributes (e.g., missing KYC fields, unusual transaction patterns).

Segregation of duties should be tested to ensure that the same person cannot initiate and approve transactions or alter customer risk ratings without oversight.

Automated controls require testing of system logic, access controls, and change management; manual workarounds should be identified and assessed.

Findings should be supported by sufficient, reliable evidence; document exceptions and determine root cause and potential impact.

CDD must identify and verify the customer and beneficial owners, understand the nature and purpose of the relationship, and conduct ongoing monitoring.

Beneficial ownership identification requires identifying natural persons who own or control 25% or more (or lower threshold per local law) and the controlling person.

EDD is required for high-risk customers, PEPs, correspondent relationships, and higher-risk geographies; EDD includes source of funds/wealth and senior management approval.

Audit testing should verify that risk ratings are assigned at onboarding, updated based on triggers, and supported by documented rationale.

PEP screening must include domestic and foreign PEPs, their family members, and close associates; screening should occur at onboarding and periodically.

Ongoing monitoring should be risk-based; test that transaction activity is compared to expected activity and that alerts are generated and resolved.

Recordkeeping requirements: CDD records must be retained for at least five years after the relationship ends or the transaction date, per FATF and many jurisdictions.

Audit should sample high-risk and PEP customers to verify EDD documentation, approval, and periodic review.

Suspicious activity reports (SARs) must be filed promptly (e.g., within 30 days of detection, with a 30-day extension if needed) and include complete, accurate, and narrative descriptions.

SAR filing decisions must be documented, including the rationale for filing or not filing; audit should test that alerts are resolved consistently.

Confidentiality: SARs and supporting documentation must be kept confidential; tipping off is prohibited. Audit should test access controls and training.

Recordkeeping for SARs: retain a copy of the SAR and supporting documentation for at least five years from filing date.

Continuing activity reports should be filed for ongoing suspicious activity; audit should verify that they are filed timely and reference prior SARs.

Audit should test that all required fields are completed and that narratives are clear, concise, and include who, what, when, where, and why.

Currency transaction reports (CTRs) and other regulatory reports must be filed accurately and timely; test aggregation and exemption processes.

Record retention for transaction records and CDD must meet regulatory minimums; audit should verify that records are retrievable and legible.

Audit reports must include scope, methodology, findings, risk ratings, root cause, and management responses with target remediation dates.

Findings should be prioritized by risk; critical findings require immediate escalation to the board or audit committee.

Management responses must include a remediation plan with clear ownership, resources, and timelines; audit should track and validate completion.

Validation of remediation includes testing that the control is now operating effectively and that root causes have been addressed.

Regulatory expectations include timely remediation, self-identification and self-reporting of issues, and cooperation with supervisors.

Audit reports should be distributed to appropriate stakeholders (board, audit committee, senior management) and retained for at least five years.

Follow-up audits should verify that prior findings are remediated; repeat findings indicate governance weaknesses.

Quality assurance reviews of the audit function ensure conformance with professional standards and regulatory guidance.