CAMS-Audit common mistakes
CAMS-Audit · Understand the traps and how to avoid them.
When asked to assess an institution's AML/CFT risk assessment, the candidate evaluates only whether a risk assessment document exists and whether it was approved by the board, then concludes the program is adequate, without testing whether the methodology actually captures the institution's products, geographies, customer types, and delivery channels.
Risk assessment questions are often read as governance/documentation questions, and candidates default to a checklist mindset ('is there a policy? is there a board minute?') because that is easier to recall than the analytical linkage between inherent risk, controls, and residual risk. The exam deliberately rewards the auditor's habit of asking whether the assessment is a living, defensible tool rather than a shelf document.
What to do instead
For every risk assessment question, run a four-step test in your head: (1) Does the methodology define and weight inherent risk factors across customers, products/services, channels, and geographies? (2) Are control effectiveness ratings evidence-based or self-asserted? (3) Does residual risk actually drive CDD intensity, monitoring thresholds, and resource allocation? (4) Is the assessment refreshed when the business changes (new products, new markets, M&A)? Answer the question in terms of these linkages, not document existence.
The candidate treats the three lines of defense as a labeling exercise and cannot articulate what the audit function may and may not rely on, so on questions about independence or about auditing the second line's monitoring, the candidate picks the answer that has internal audit performing management's control activities.
Candidates memorize 'first line business, second line compliance, third line audit' but do not internalize the consequence: internal audit must remain independent of the controls it opines on and cannot design, implement, or operate the AML program. Exam items probe this boundary with scenarios where audit is asked to help build the monitoring rules or to own remediation.
What to do instead
Anchor on the principle that internal audit provides independent assurance and cannot own or operate first- or second-line controls. When a scenario has audit 'helping' by designing rules, tuning alerts, or signing off remediation as complete, that is a red flag. Audit may advise and may verify, but the fix and the operation belong to management. Practice stating, for each scenario, who owns the control and what audit's permissible role is.
Given a scenario, the candidate starts listing audit procedures immediately instead of first defining the audit objective, scope boundaries, and the criteria against which conclusions will be drawn, producing answers that are procedurally busy but logically unanchored.
Under time pressure, candidates jump to 'what would you do' because procedures feel concrete and scoreable. But audit planning questions are testing whether the candidate can derive procedures from objectives and risk, and a procedure list without stated criteria cannot be judged against the engagement's purpose.
What to do instead
Before writing procedures, state three things explicitly: the audit objective (what assertion is being tested), the scope (entities, period, systems, and what is excluded), and the criteria (regulation, policy, or standard). Then map each procedure to the objective it evidences. If an answer choice or your written response lacks a stated objective or criteria, treat it as incomplete regardless of how many procedures it lists.
The candidate builds a sample by grabbing a convenient population (for example, the most recent quarter's alerts or a single branch's files) without documenting population completeness, stratification, or how sample size relates to confidence and tolerable error, then defends the sample as 'representative'.
Sampling methodology is where audit rigor is easiest to fake. Candidates know sampling exists but default to judgmental convenience samples because they cannot recall how to reason about population integrity, stratification by risk, and the relationship between sample size and assurance. Items that ask 'what is the most significant weakness in this sampling approach' punish this.
What to do instead
Always interrogate the population before the sample: Is it complete (all branches, all systems, all periods)? Is it reconciled to a source of record? Is it stratified by risk so high-risk items are over-sampled or tested 100%? Then connect sample size to the assurance needed. When reviewing a proposed sample, the most common correct critique is an incomplete or unreconciled population, or a sample that excludes the highest-risk segment.
When asked how to test a transaction monitoring system, the candidate answers only 'review a sample of alerts and confirm they were investigated', omitting testing of rule logic, thresholds, data feeds, model/rule changes, and the disposition of alerts as false positives versus true matches.
Alert-file review is the visible, familiar part of TM testing, so candidates stop there. They underweight the upstream elements-data integrity, scenario coverage, threshold calibration, and change management-which are where the most consequential monitoring failures actually occur and where exam items concentrate.
What to do instead
Structure TM testing in layers: (1) data integrity-are all relevant transactions and customer attributes feeding the system completely and accurately; (2) scenario/rule coverage-do rules map to the institution's risk assessment and typologies; (3) threshold calibration-is there documented rationale and periodic tuning; (4) alert disposition-are investigations timely, documented, and consistently concluded; (5) change management-are rule changes approved, tested, and logged. Answer TM questions by naming which layer is being tested.
The candidate treats 'the control is documented in policy' as evidence the control operates effectively, conflating design effectiveness with operating effectiveness and failing to test whether the control actually functioned over the audit period.
Policy language is concrete and easy to cite, so it feels like evidence. But the distinction between 'designed to work' and 'actually worked' is foundational to controls testing, and exam items routinely present a well-written policy alongside evidence of breakdowns to see whether the candidate separates the two.
What to do instead
For every control, ask two separate questions: Is the design capable of preventing or detecting the risk (design effectiveness)? And did it operate as designed throughout the period (operating effectiveness)? Operating effectiveness requires evidence of performance-system logs, timestamps, reviewer sign-offs, exception reports-not the existence of a procedure. State which of the two you are concluding on before you conclude.
On CDD/EDD questions, the candidate accepts that enhanced due diligence was performed because the file contains additional documents, without assessing whether the EDD actually addressed the specific risk (source of wealth versus source of funds, beneficial ownership penetration, adverse media analysis, senior management approval).
Candidates equate 'more paperwork' with 'enhanced.' But EDD is defined by the depth and relevance of understanding, not volume. Items present thick files that miss the decisive element-for example, source of funds documented but source of wealth unexplained for a PEP-and reward candidates who spot the gap.
What to do instead
For each high-risk relationship, test the file against a fixed EDD checklist: Is beneficial ownership established to natural persons and verified? Is source of wealth explained and corroborated separately from source of funds? Is adverse media searched and analyzed, not just attached? Is the risk rating justified and periodically refreshed? Is senior management approval documented and dated? If any element is present as a document but not as analysis, treat EDD as deficient.
The candidate evaluates suspicious activity reporting only for timeliness and filing volume, and does not test the quality of the narrative, the adequacy of the investigation that preceded the decision not to file, or whether the decision-making was documented and independently reviewable.
Timeliness and counts are measurable and easy to audit, so candidates gravitate to them. But the substantive risk in SAR/STR programs is under-reporting driven by poor investigations and thin narratives, and exam items test whether the candidate knows that a timely but unsupported filing or a documented-but-unreasoned no-file decision is a control failure.
What to do instead
Test SAR/STR processes on four dimensions: (1) detection-to-decision timeliness against the regulatory clock; (2) investigation quality-were all alerts and linked activity reviewed; (3) narrative sufficiency-does it tell a complete story a reader could act on without the underlying file; (4) no-file decisions-are they documented with rationale and subject to a second-level review? Also test recordkeeping retention and confidentiality controls. Answer SAR questions by naming which dimension is at issue.
When writing or evaluating an audit finding, the candidate describes the observation but omits the criteria, the risk/impact, the root cause, and a management-actionable recommendation, producing findings that management can dispute or ignore.
Candidates focus on 'what we saw' because that is the evidence they gathered. The discipline of structuring a finding-condition, criteria, cause, effect/risk, recommendation-is learned through practice and is frequently tested because weak findings are a leading cause of ineffective remediation.
What to do instead
Write every finding in a fixed five-part structure: Condition (what is), Criteria (what should be, citing regulation/policy/standard), Cause (why it happened-root cause, not blame), Effect (the risk or exposure if uncorrected), and Recommendation (specific, owned, and verifiable). If your finding cannot name a criterion and a root cause, it is an observation, not a finding-say so and explain the difference.
On remediation questions, the candidate accepts management's assertion that an issue is 'closed' based on a remediation memo or a target date being met, without independently validating that the fix addressed the root cause and is operating sustainably.
Closure is administratively satisfying and candidates want to conclude the loop. But the exam tests whether the candidate knows that validation of remediation is itself an audit activity requiring evidence, and that repeat findings usually trace to closures validated on assertion rather than testing.
What to do instead
Treat remediation validation as a mini-audit: confirm the action taken addresses the stated root cause (not just the symptom), test that the new or revised control operates over a sufficient period, check for recurrence of the original condition, and require evidence rather than attestation. Distinguish 'management has remediated' from 'internal audit has validated remediation.' Where a regulator is involved, also confirm commitments, timelines, and reporting obligations were met.