CAMS-Audit key terms

A structured evaluation of how likely and how severely an institution could be used for money laundering or terrorist financing, considering its products, customers, channels, geographies, and control strength. Results drive policy, resourcing, and monitoring thresholds.

The level of money laundering or terrorist financing exposure that exists before any controls are applied. Auditors use it to judge whether control design is proportionate to the exposure it is meant to address.

The exposure that remains after existing controls are applied. Comparing it with the institution's risk appetite shows whether gaps need remediation or whether the risk assessment itself is overstated or understated.

A formal declaration of how much AML/CFT risk the institution is willing to accept in pursuit of its business goals, including thresholds and escalation triggers. Auditors test whether actual risk levels and decisions stay within it.

A governance structure in which business units own risk (first line), compliance and risk functions oversee it (second line), and internal audit provides independent assurance (third line). Independence of the audit function depends on this separation.

The designated person responsible for administering the AML/CFT program, including policy, training, monitoring oversight, and suspicious activity decisions. Auditors assess whether the role has sufficient authority, resources, and access to senior management and the board.

The periodic flow of AML/CFT information to directors, covering risk levels, control failures, suspicious activity trends, and remediation status. Audit tests whether reports are accurate, timely, and specific enough to support oversight decisions.

A measure of whether staff understand and apply AML/CFT obligations, not merely whether they completed a course. Evidence includes role-specific content, testing results, and observed behavior during transaction or onboarding reviews.

The tone, structure, and accountability that surround AML/CFT controls, including integrity, governance, and management commitment. Weak environments cause otherwise well-designed controls to operate unreliably.

The complete inventory of auditable entities, processes, and systems within scope of the audit function. It is used to allocate coverage and confirm that high-risk AML/CFT areas are not omitted from the plan.

An annual or multi-year schedule that prioritizes audit work according to assessed risk, regulatory change, and prior findings. It should be approved by the audit committee and revisited when risks shift.

The stated boundaries of an engagement, identifying which entities, processes, systems, time periods, and locations are included and excluded. Clear scope prevents gaps and later disputes over coverage.

A precise statement of what the engagement intends to conclude, such as whether transaction monitoring alerts are investigated within policy timelines. Objectives determine the evidence needed and the tests performed.

The documented set of procedures, tests, and evidence requirements that will be executed to meet the audit objective. It links each risk to a specific test and is reviewed before fieldwork begins.

A step-by-step tracing of a single transaction or process from start to finish, used to confirm understanding of how work is actually performed. It often reveals informal practices that differ from written procedure.

A written description of how a process flows, including systems, handoffs, approvals, and controls. It is validated during walkthroughs and forms the basis for designing tests of controls.

Selecting a subset of transactions, customers, or files to draw conclusions about a population. AML audits require documented rationale, adequate size, and coverage of higher-risk items so results can be defended.

The possibility that conclusions drawn from a sample differ from what testing the entire population would show. Auditors manage it through sample size, selection method, and cautious interpretation of exceptions.

Assurance that the data set from which a sample is drawn contains every relevant item, with nothing removed or missing. Incomplete populations, such as filtered alert queues, can silently invalidate audit results.

The threshold at which a finding or error becomes significant enough to affect decisions, reporting, or regulatory standing. In AML audits it is often qualitative, since small value transactions can signal serious control failure.

Examining evidence to determine whether a control operated as designed throughout the period. It combines design assessment with testing of operation, often through reperformance or inspection of records.

An assessment of whether a control, as documented and built, would prevent or detect the risk it targets if used properly. A control can be well operated but still ineffective because its design is inadequate.

Evidence that a control actually functioned consistently over the review period, performed by the right people at the right time. It is tested through samples, reperformance, and review of system logs.

An audit technique in which the auditor independently repeats a control activity, such as recalculating a risk score or re-screening a customer against lists, and compares the result with what the institution recorded.

A method that measures how often a defined characteristic, such as documented source of funds, is present in each sampled item. Results are expressed as an exception rate against a tolerable threshold.

A sampled item that fails to meet the tested requirement, such as a missing approval or an untimely review. Exceptions are evaluated for root cause and whether they indicate a systemic control breakdown.

A missing or inadequate control that leaves a risk unaddressed, identified by comparing expected controls with what exists. Gaps are ranked by the severity of the exposure they create.

Automated software that screens customer activity against rules or models and generates alerts for investigation. Auditors examine rule logic, thresholds, data feeds, alert handling, and model change controls.

The process of reviewing, prioritizing, and dispositioning monitoring alerts, including documenting why an alert is closed or escalated. Audit tests timeliness, rationale quality, and consistency of outcomes.

Adjusting rule parameters so alerts balance detection sensitivity against investigation capacity. Poorly tuned thresholds produce excessive false positives or allow genuine suspicious activity to pass undetected.

Independent review of monitoring or risk-scoring models to confirm logic, data quality, and performance remain fit for purpose. It includes testing above and below thresholds and assessing documented assumptions.

Verifying that data used by AML systems is complete, accurate, and timely, including reconciliation of source systems to monitoring and screening platforms. Corrupted feeds undermine every downstream control.

The baseline process of identifying customers, verifying identity, understanding purpose and expected activity, and keeping records current. It underpins monitoring, reporting, and risk classification decisions.

Additional scrutiny applied to higher-risk customers, such as PEPs or those in high-risk jurisdictions, covering source of wealth, source of funds, and senior approval. Auditors test whether EDD was triggered and documented.

Determining the natural persons who ultimately own or control a legal entity customer, typically through ownership percentages and control tests. Auditors check documentation, recalculation, and refresh of this data.

A person entrusted with prominent public functions, plus closely associated family members and associates, who presents elevated corruption risk. Screening and EDD requirements apply, with ongoing monitoring of status changes.

An explanation of how a customer's overall assets were accumulated, distinct from the funds used in a specific transaction. Auditors test whether evidence is independent, plausible, and consistent with the customer profile.

The origin of the specific money used in a transaction or account relationship. Documentation should match the stated purpose and expected activity, and inconsistencies should trigger escalation.

A score or category assigned to a customer based on factors such as geography, product, occupation, and behavior, which determines the level of due diligence and monitoring applied. Auditors test methodology and override controls.

Scheduled refresh of customer information and risk ratings, with frequency set by risk level. Auditors test whether reviews occurred on time and whether conclusions were supported by evidence.

A filing to the financial intelligence unit describing activity suspected of involving criminal proceeds or terrorist financing. Auditors test the decision process, timeliness, content quality, and confidentiality of filings.

The record showing why an alert or referral was or was not escalated to a filing, including analysis and approver. Weak documentation prevents auditors and examiners from confirming that judgment was reasonable.

A written explanation of why activity reviewed but not reported was judged not suspicious. It should reference specific facts, not boilerplate, and is a frequent focus of audit testing and examiner criticism.

The periodic reassessment of whether suspicious activity already reported is still occurring, which may require additional filings. Auditors check that reviews are triggered and documented for open cases.

The legal restriction on disclosing to a customer or third party that a suspicious activity report has been or may be filed. Auditors examine access controls, communications, and training for compliance.

Rules mandating retention of identity verification evidence, transaction records, correspondence, and filing documentation for specified periods. Auditors test retrievability and completeness, not just the existence of a retention policy.

A documented conclusion that a control is missing, ineffective, or noncompliant, supported by evidence and rated for severity. Findings must state condition, criteria, cause, effect, and a recommended action.

The process of identifying the underlying reason a control failed, such as unclear ownership or inadequate staffing, rather than restating the symptom. It determines whether remediation will actually prevent recurrence.

The business owner's written commitment to address a finding, including action, accountable person, and target date. Auditors assess whether the response addresses the root cause or only the observed instance.

A structured schedule of actions, owners, milestones, and dates to close a control weakness. Effective plans include interim risk mitigation while permanent fixes are built.

Independent testing performed after remediation to confirm the fix works in practice, not just that a document was produced. Validation closes the finding and is reported to the audit committee.

The board committee that oversees the audit function, approves the risk-based plan, and receives findings and remediation status. Its engagement signals whether AML/CFT issues are escalated with sufficient authority.

The institution's ability to demonstrate compliant controls and provide accurate, organized evidence on short notice. Auditors assess documentation quality, data access, and consistency between internal reporting and reality.

A formal obligation made to a supervisor, such as a consent order or agreed action plan, with deadlines and reporting duties. Auditors track progress and verify that commitments are met with evidence.

The freedom of the audit function from operational responsibility and management influence, including direct reporting to the audit committee. Independence is compromised if auditors design or operate the controls they review.

Automated comparison of customers and transactions against government and internal watchlists. Auditors test list currency, fuzzy-matching logic, alert disposition, and coverage of all relevant channels.