CAMS-Audit flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Five pillars of AML program

A compliant AML/CFT program includes a designated compliance officer, internal policies and controls, ongoing training, independent testing, and customer due diligence procedures.

Risk assessment update triggers

The AML/CFT risk assessment must be updated when new products, services, customer types, geographic exposures, or regulatory changes occur, and at least annually.

Residual risk formula

Residual risk is derived by assessing inherent risk (customer, product, geographic, channel) and then evaluating the effectiveness of controls that mitigate that risk.

Compliance officer independence

The AML compliance officer must have sufficient authority, independence, and resources, and should not report to business lines that generate revenue.

Board approval of program

Board or senior management must approve the AML/CFT program and risk assessment; minutes should reflect deliberation and approval.

Risk-based audit planning

Audit planning prioritizes areas with higher residual risk, considering prior findings, regulatory changes, and emerging risks.

Audit scope definition

The audit scope must be documented in an engagement letter or planning memo, specifying systems, business units, time periods, and regulatory requirements covered.

Sampling methodology documentation

Materiality thresholds and sampling methods must be documented; sample sizes should be sufficient to support conclusions and consider population characteristics.

Audit program mapping

Audit programs should map testing steps to specific regulatory requirements (e.g., BSA, FATF recommendations, local AML laws) and internal policies.

Walkthrough purpose

Walkthroughs and process mapping help auditors understand controls and identify key control points before designing tests of effectiveness.

Finding rating criteria

Audit methodology should include criteria for rating findings (e.g., critical, high, medium, low) based on impact and likelihood.

Test of design

Test of design evaluates whether a control, as designed, can prevent or detect and correct material errors or fraud.

Test of operating effectiveness

Test of operating effectiveness evaluates whether a control operated consistently and effectively over the audit period.

Transaction monitoring tuning

Transaction monitoring system thresholds, scenarios, and alert dispositions must be justified and periodically recalibrated to ensure effectiveness.

Control testing sample size

For daily controls, a sample of 25-40 items may be needed for high assurance; sample sizes should consider control frequency and population characteristics.

Data analytics in audit

Data analytics can test 100% of a population for specific attributes, such as missing KYC fields or unusual transaction patterns.

Segregation of duties test

Audit should test that the same person cannot initiate and approve transactions or alter customer risk ratings without oversight.

Automated control testing

Automated controls require testing of system logic, access controls, and change management; manual workarounds should be identified and assessed.

CDD core requirements

CDD must identify and verify the customer and beneficial owners, understand the nature and purpose of the relationship, and conduct ongoing monitoring.

Beneficial ownership threshold

Beneficial ownership identification requires identifying natural persons who own or control 25% or more (or lower threshold per local law) and the controlling person.

EDD triggers

EDD is required for high-risk customers, PEPs, correspondent relationships, and higher-risk geographies; EDD includes source of funds/wealth and senior management approval.

PEP screening scope

PEP screening must include domestic and foreign PEPs, their family members, and close associates; screening should occur at onboarding and periodically.

CDD record retention

CDD records must be retained for at least five years after the relationship ends or the transaction date, per FATF and many jurisdictions.

Ongoing monitoring expectation

Ongoing monitoring should be risk-based; test that transaction activity is compared to expected activity and that alerts are generated and resolved.

SAR filing deadline

Suspicious activity reports must be filed promptly, typically within 30 days of detection, with a possible 30-day extension if needed.

SAR confidentiality

SARs and supporting documentation must be kept confidential; tipping off is prohibited. Audit should test access controls and training.

SAR record retention

Retain a copy of the SAR and supporting documentation for at least five years from the filing date.

Continuing activity reports

Continuing activity reports should be filed for ongoing suspicious activity; audit should verify that they are filed timely and reference prior SARs.

CTR accuracy testing

Currency transaction reports (CTRs) and other regulatory reports must be filed accurately and timely; test aggregation and exemption processes.

Audit report contents

Audit reports must include scope, methodology, findings, risk ratings, root cause, and management responses with target remediation dates.

Remediation validation

Validation of remediation includes testing that the control is now operating effectively and that root causes have been addressed.

Regulatory self-reporting

Regulatory expectations include timely remediation, self-identification and self-reporting of issues, and cooperation with supervisors.