I85PREP
⌘ K
CAMS-Audit study materials
CAMS-Audit study resources

CAMS-Audit practice questions

One question at a time. Build your CAMS-Audit understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1AML/CFT Program Governance and Risk Assessment

A newly licensed money services business is drafting its AML/CFT program. Under the risk-based approach promoted by FATF, which element must the program include before it can be considered complete?

  1. A documented customer due diligence process supported by ongoing monitoring Correct answer.
  2. A list of every customer the business intends to refuse
  3. A fixed annual budget approved by the regulator
  4. A guarantee that no suspicious transaction will ever occur

Explanation

The FATF Recommendations require financial institutions to identify, assess, and manage risk through customer due diligence, recordkeeping, and ongoing monitoring, all proportionate to the institution's risk profile. A credible program therefore centers on documented CDD and monitoring rather than on outcomes or budgets. Regulators do not approve internal budgets, and refusing customers in advance is not a program element.

Question 2AML/CFT Program Governance and Risk Assessment

The board of a mid-sized bank asks the compliance officer to explain the purpose of an enterprise-wide risk assessment (EWRA). Which statement best describes its role in the AML/CFT program?

  1. It certifies that the institution is fully compliant with local law
  2. It is a one-time exercise performed at licensing
  3. It replaces the need for customer-level risk scoring
  4. It allocates AML/CFT resources in proportion to identified risks Correct answer.

Explanation

An EWRA identifies and measures the money laundering and terrorist financing risks the institution faces across customers, products, channels, and geographies, and it drives how controls and resources are prioritized. It is iterative and refreshed as the risk environment changes. It does not substitute for customer-level due diligence or certify legal compliance.

Question 3AML/CFT Program Governance and Risk Assessment

A compliance manager is defining the three lines of defense model for AML/CFT governance. Which group constitutes the first line?

  1. The board risk committee
  2. The external regulator's examiners
  3. The business units that own customer relationships Correct answer.
  4. The internal audit function

Explanation

In the three lines model, the first line is the business itself, which originates and manages customer relationships and therefore owns the day-to-day AML/CFT controls. The compliance function forms the second line, and internal audit forms the third. Regulators sit outside the institution's defense structure entirely.

Question 4AML/CFT Program Governance and Risk Assessment

A designated compliance officer (AMLCO) role is being formalized. Which responsibility most appropriately belongs to the AMLCO rather than to the board?

  1. Serving as the institution's external spokesperson
  2. Setting the compensation of business-line staff
  3. Overseeing day-to-day implementation of the AML/CFT program Correct answer.
  4. Approving the institution's overall risk appetite statement

Explanation

The AMLCO is responsible for the operational management of the AML/CFT program, including coordinating CDD, monitoring, reporting, and training. Risk appetite and major policy approvals rest with the board or its committee, which also provides oversight of the AMLCO. Compensation and public communications fall outside the AMLCO's mandate.

Question 5AML/CFT Program Governance and Risk Assessment

During a supervisory review, an examiner notes that the institution's AML/CFT policy manual was last updated four years ago and does not mention a new product launched since then. Which governance weakness does this primarily indicate?

  1. Inadequate independent testing of controls
  2. Insufficient suspicious activity reporting volume
  3. Failure to keep policies current with business and regulatory change Correct answer.
  4. Excessive customer due diligence documentation

Explanation

Policies and procedures must be reviewed and updated regularly so they reflect new products, services, channels, and regulatory requirements. A stale manual that omits a live product shows a change-management gap in governance. The other options concern different controls that this fact pattern does not describe.

Question 6AML/CFT Program Governance and Risk Assessment

Which statement correctly describes the relationship between an institution's risk assessment and its customer due diligence (CDD) procedures?

  1. The risk assessment must be completed only after all CDD files are closed
  2. CDD intensity should be calibrated to the risk levels identified in the risk assessment Correct answer.
  3. CDD procedures should be identical for every customer regardless of risk
  4. CDD is required only for customers the risk assessment labels as high risk

Explanation

The risk-based approach links the institutional risk assessment to CDD by requiring enhanced measures where risk is higher and simplified measures where risk is demonstrably lower. CDD applies to all customers, but its depth varies with risk. The two processes are complementary rather than sequential or independent.

Question 7AML/CFT Program Governance and Risk Assessment

A board director asks why the AML/CFT program needs a training component. Which rationale is most consistent with supervisory expectations?

  1. Training is required only for the compliance department
  2. Training ensures staff can recognize and escalate suspicious activity and understand their obligations Correct answer.
  3. Training transfers legal liability for money laundering from the institution to employees
  4. Training substitutes for transaction monitoring when volumes are low

Explanation

Ongoing training equips employees across the institution to recognize red flags, apply CDD correctly, and escalate concerns, which supports the program's effectiveness. Supervisors expect training to be tailored to roles and refreshed periodically. It does not shift liability or replace monitoring.

Question 8AML/CFT Program Governance and Risk Assessment

An institution's AML/CFT risk assessment scores a jurisdiction as high risk because of weak supervision and significant corruption. How should this score most directly influence the program?

  1. It should be ignored unless the regulator names the country publicly
  2. It should trigger enhanced due diligence and closer monitoring for exposures linked to that jurisdiction Correct answer.
  3. It should lower the risk rating of domestic customers to balance the portfolio
  4. It should automatically result in exiting all customers in that jurisdiction

Explanation

Geographic risk identified in the assessment should translate into enhanced due diligence, senior management approval where required, and more intensive monitoring for relationships tied to higher-risk jurisdictions. Automatic exit is a business decision that may be considered but is not mandated by a score alone. Risk scores are not offset by adjusting unrelated customers.

Question 9AML/CFT Program Governance and Risk Assessment

A compliance officer reports directly to the head of the business line that generates the most fee income. An examiner is likely to raise which governance concern?

  1. The compliance officer is overqualified for the role
  2. The business line has too few compliance resources
  3. The reporting line creates a conflict with marketing strategy
  4. The compliance function lacks sufficient independence to challenge business decisions Correct answer.

Explanation

Effective AML/CFT governance requires the compliance function to have independence and a reporting line, often to the board or a board committee, that allows it to raise concerns without business-line pressure. Reporting solely to a revenue-generating unit undermines that independence. The concern is structural, not about qualifications or marketing.

Question 10AML/CFT Program Governance and Risk Assessment

An institution uses a quantitative risk model to score customers. The model was built five years ago and has never been validated. Which governance action is most appropriate?

  1. Increase the model's risk thresholds to reduce alert volumes
  2. Retire the model and replace it with manual judgment for all customers
  3. Document that the model is presumed accurate because it is automated
  4. Perform independent validation and recalibrate the model against current data Correct answer.

Explanation

Risk models require periodic independent validation to confirm that assumptions, data, and outputs remain fit for purpose as the business and threat environment change. Validation should test discriminatory power and recalibrate where needed. Automated tools are not self-validating, and adjusting thresholds to reduce workload is not a valid risk response.

Question 11AML/CFT Program Governance and Risk Assessment

A bank's risk assessment identifies that a new instant-payments product will be launched with limited onboarding checks. Which control should the risk assessment process recommend before launch?

  1. Removal of the product from the risk assessment until it has customers
  2. Delegation of all product risk decisions to the marketing team
  3. A post-launch review conducted two years after go-live
  4. A pre-launch risk assessment with CDD and monitoring requirements defined Correct answer.

Explanation

New products and channels should undergo a risk assessment before launch so that CDD, monitoring, and reporting controls are designed in from the start. This is a core element of change management under the risk-based approach. Deferring review until well after launch leaves the institution exposed.

Question 12AML/CFT Program Governance and Risk Assessment

Senior management wants to demonstrate that AML/CFT risk assessment results are actually used. Which evidence best supports that claim?

  1. A signed statement that the assessment was completed on time
  2. Minutes showing risk ratings drove changes to monitoring thresholds and staffing Correct answer.
  3. A list of all employees who attended training
  4. A copy of the regulator's most recent public speech

Explanation

The value of a risk assessment lies in how its outputs shape decisions, such as tuning monitoring scenarios, allocating analysts, or tightening CDD for higher-risk segments. Documentation linking findings to concrete changes demonstrates use. Completion timestamps or training rosters show activity but not that results were applied.

Question 13AML/CFT Program Governance and Risk Assessment

A group operates in several countries and prepares a consolidated AML/CFT risk assessment. Which approach best reflects supervisory expectations for a group-wide program?

  1. The parent adopts the least demanding local standard to reduce costs
  2. Group risk assessment is unnecessary if each subsidiary is separately licensed
  3. Each subsidiary assesses risk independently with no group coordination
  4. The parent applies the strictest applicable standard across the group where local rules are weaker Correct answer.

Explanation

Group-wide programs should apply consistent, robust standards across entities, and where local requirements are less stringent, the higher group standard generally prevails. This prevents weak links that could be exploited across the group. Fully independent or lowest-common-denominator approaches undermine group oversight.

Question 14AML/CFT Program Governance and Risk Assessment

An internal audit report finds that the second-line compliance function has never tested whether front-line staff actually perform the CDD steps described in policy. Which gap does this represent?

  1. A deficiency in the institution's marketing materials
  2. A failure of the board to approve the budget
  3. An excess of suspicious activity reports
  4. A breakdown in the design versus operating effectiveness of controls Correct answer.

Explanation

A policy can be well designed yet fail in practice if no one tests whether staff follow it. Independent testing of operating effectiveness is a core expectation under the three lines model. The finding concerns control execution, not reporting volume, budgets, or marketing.

Question 15AML/CFT Program Governance and Risk Assessment

A compliance officer is asked to set the institution's AML/CFT risk appetite. Which statement best expresses an appropriate risk appetite for AML/CFT?

  1. The institution will apply enhanced due diligence only to politically exposed persons
  2. The institution will report suspicious activity only when legally compelled
  3. The institution accepts all customers regardless of source of funds
  4. The institution has zero tolerance for willful facilitation of money laundering Correct answer.

Explanation

An AML/CFT risk appetite typically states that the institution will not knowingly facilitate or tolerate money laundering or terrorist financing, while acknowledging residual risk in its portfolio. It guides decisions on customers, products, and geographies. Blanket acceptance or minimum legal compliance does not constitute a credible appetite.

Question 16AML/CFT Program Governance and Risk Assessment

A supervisor criticizes an institution because its risk assessment is a qualitative narrative with no data on transaction volumes, customer types, or alert trends. Which improvement is most warranted?

  1. Incorporate quantitative indicators and segment-level data to support the conclusions Correct answer.
  2. Replace the narrative with a single numerical score for the whole institution
  3. Delay the next assessment until data systems are fully rebuilt
  4. Remove the narrative entirely and rely on the regulator's national risk assessment

Explanation

A robust institutional risk assessment combines qualitative judgment with quantitative data such as customer and transaction profiles, alert and case trends, and geographic exposure. Data supports and challenges the narrative rather than replacing it with a single number. Relying solely on a national assessment ignores institution-specific risk.

Question 17AML/CFT Program Governance and Risk Assessment

An institution outsources its transaction monitoring system to a vendor. Which governance responsibility remains with the institution?

  1. Delegating suspicious activity reporting decisions to the vendor
  2. Understanding and managing the risks of the outsourced activity Correct answer.
  3. Transferring board oversight to the vendor's compliance team
  4. None, because the vendor owns the monitoring process

Explanation

Outsourcing does not transfer accountability: the institution must conduct due diligence on the provider, monitor performance, and retain ownership of AML/CFT risk and reporting decisions. The board's oversight responsibility cannot be delegated to a vendor. Reporting judgments remain with the institution's own staff.

Question 18AML/CFT Program Governance and Risk Assessment

A whistleblower reports that a branch manager discouraged staff from filing suspicious activity reports to avoid losing a large client. Which governance response is most appropriate?

  1. Suspend all reporting from the branch indefinitely
  2. Ask the client whether the branch manager acted appropriately
  3. Investigate the allegation, protect the reporter, and reinforce the reporting culture through senior messaging Correct answer.
  4. Close the case because the branch met its revenue target

Explanation

An effective AML/CFT culture requires that concerns be investigated independently, that whistleblowers be protected from retaliation, and that senior leadership visibly reinforce the duty to report. Involving the client or closing the matter for commercial reasons undermines the program. A blanket reporting suspension is not a proportionate response.

Question 19AML/CFT Program Governance and Risk Assessment

A national risk assessment identifies real estate as a high-risk sector. A bank with a large mortgage portfolio should most directly respond by:

  1. Reviewing and strengthening controls for real estate exposures in its institutional risk assessment Correct answer.
  2. Reducing CDD for mortgage customers to speed up approvals
  3. Ignoring the national findings because they are not institution-specific
  4. Exiting the mortgage business entirely

Explanation

National risk assessments are an input to institutional risk assessments, so sector-level findings should prompt a review of relevant exposures and controls. Exit is not automatically required, and ignoring the findings or reducing CDD would be inconsistent with the risk-based approach.

Question 20AML/CFT Program Governance and Risk Assessment

An institution's board receives a dashboard showing rising numbers of high-risk customers but no corresponding increase in enhanced due diligence resources. What does this pattern most likely indicate?

  1. A well-balanced risk appetite
  2. A reduction in the institution's overall risk
  3. Effective monitoring that reduces the need for resources
  4. A misalignment between risk profile and control capacity Correct answer.

Explanation

When the risk profile grows without a matching increase in control capacity, the institution is accepting risk it may not be able to manage, signaling a governance and resourcing gap. A rising high-risk population does not reduce overall risk or eliminate the need for enhanced due diligence.

Question 21AML/CFT Program Governance and Risk Assessment

A regulator applies a proportionate, risk-based supervisory approach. Which institutional characteristic would most likely lead to more intensive supervision?

  1. A strong control environment with few repeat findings
  2. A recently updated policy manual
  3. A history of repeat deficiencies and weak remediation Correct answer.
  4. A large training budget with high attendance

Explanation

Risk-based supervision directs more attention and intensity toward institutions whose risk profile and control weaknesses are greater, including repeat findings and poor remediation records. Strong controls, training investment, and current policies tend to reduce supervisory concern rather than increase it.

Question 22AML/CFT Program Governance and Risk Assessment

A group's internal audit function reports only to the business-line heads whose units it audits. Why is this a governance deficiency for the AML/CFT program?

  1. It prevents audit from maintaining the independence needed to provide objective assurance Correct answer.
  2. It reduces the audit budget available for testing
  3. It transfers reporting obligations to internal audit
  4. It requires audit to perform customer due diligence

Explanation

The third line must be independent of the activities it reviews so that its assurance is objective and credible. Reporting solely to audited business heads creates a conflict of interest and may discourage findings. Budget, CDD execution, and reporting duties are separate matters.

Question 23AML/CFT Program Governance and Risk Assessment

An institution's risk assessment concludes that residual risk exceeds its stated risk appetite for a particular product. Which action is most consistent with sound governance?

  1. Record the excess risk and continue operating unchanged
  2. Escalate to senior management and the board to reduce, mitigate, or exit the activity Correct answer.
  3. Lower the risk appetite to match the residual risk without any control changes
  4. Exclude the product from future risk assessments

Explanation

When residual risk breaches the approved appetite, governance requires escalation so that senior management and the board can decide whether to add controls, reduce exposure, or exit. Simply documenting the breach, adjusting the appetite downward without justification, or hiding the exposure undermines the framework.

Question 24AML/CFT Program Governance and Risk Assessment

A bank uses a risk-scoring model that weights country risk heavily. A compliance analyst notices that a low-risk country is home to a free-trade zone widely associated with trade-based money laundering. What is the most appropriate governance response?

  1. Flag the limitation and consider refining the model to capture sub-national and sector-specific risk Correct answer.
  2. Override the model manually for every customer without documentation
  3. Increase the country's score only after a regulator instructs the bank
  4. Ignore the issue because the model is automated

Explanation

Models can miss granular risk factors such as free-trade zones or sector-specific vulnerabilities, so identified limitations should be documented and fed into model refinement and validation. Undocumented overrides, waiting for regulatory direction, or ignoring the issue all weaken the control environment.

Question 25AML/CFT Program Governance and Risk Assessment

An institution's AML/CFT program is mature, but the board has not reviewed the enterprise risk assessment for two years and the business has since expanded into cryptoasset services. Which conclusion is most defensible?

  1. The risk assessment is likely stale and does not reflect a materially changed risk profile Correct answer.
  2. The program remains adequate because it was mature two years ago
  3. Cryptoasset services are outside the scope of AML/CFT programs
  4. Board review is optional once the program reaches maturity

Explanation

Risk assessments must be refreshed when the business changes materially, and entry into a higher-risk activity such as cryptoasset services is a significant change. A past maturity rating does not substitute for current analysis. Board oversight remains ongoing regardless of program maturity.

Question 26AML/CFT Program Governance and Risk Assessment

Which three elements make up the classic 'three lines of defense' model as applied to an AML/CFT program?

  1. The board sets strategy, the regulator supervises, and law enforcement investigates
  2. The business line owns and manages risk, an independent compliance function sets frameworks and monitors, and internal audit provides independent assurance Correct answer.
  3. Front-line staff file reports, the compliance function approves them, and the regulator reviews them
  4. The risk committee, the audit committee, and the external auditor share responsibility for AML/CFT controls

Explanation

The three lines model separates risk ownership from oversight and assurance. The first line (business) owns and manages AML/CFT risk, the second line (compliance) designs the framework and monitors it, and the third line (internal audit) gives independent assurance to the board. Keeping these roles distinct prevents the function that takes on risk from also being the sole judge of whether it is controlled.

Question 27AML/CFT Program Governance and Risk Assessment

A new AML/CFT officer wants to know the primary purpose of a documented enterprise-wide risk assessment. Which purpose is most accurate?

  1. To calculate the exact fine the regulator would impose if a control failure occurred
  2. To provide a defensible basis for calibrating controls, policies, and resources in proportion to identified risks Correct answer.
  3. To record the personal risk tolerance of the chief executive officer
  4. To satisfy the annual filing requirement for the institution's suspicious activity report statistics

Explanation

The enterprise risk assessment links identified inherent risks to the controls applied and the residual risk that remains. Its purpose is to justify, in a documented and repeatable way, how the program's policies, monitoring thresholds, staffing, and training are proportionate to the risks the institution actually faces. It is a decision-support and defensibility tool, not a reporting formality or a fine calculator.

Question 28AML/CFT Program Governance and Risk Assessment

Which statement best describes the role of the board of directors in AML/CFT governance?

  1. The board personally reviews and files every suspicious activity report
  2. The board sets the transaction monitoring thresholds for each business unit
  3. The board approves the AML/CFT program and risk appetite and receives regular reporting on its effectiveness Correct answer.
  4. The board delegates all AML/CFT matters to the compliance officer and has no further duty

Explanation

The board is ultimately accountable for the AML/CFT program. It approves the policy framework and risk appetite and then oversees management through periodic, meaningful reporting on risk, control effectiveness, and emerging issues. It does not perform operational tasks such as filing reports or tuning thresholds.

Question 29AML/CFT Program Governance and Risk Assessment

An institution's AML/CFT policy states that 'the institution has zero tolerance for money laundering.' Why is this statement weak as a risk appetite expression?

  1. Because it states an absolute outcome rather than a measurable tolerance for residual risk that guides decisions Correct answer.
  2. Because money laundering risk cannot be mentioned in board-approved policies
  3. Because risk appetite statements must be kept confidential from staff
  4. Because zero tolerance is illegal in most jurisdictions

Explanation

A usable risk appetite translates into thresholds and qualitative boundaries that staff can apply when making trade-offs, such as acceptable residual risk by customer type or product. Declaring 'zero tolerance' sets an unattainable absolute that provides no guidance when risk cannot be eliminated. Effective statements describe the level of risk the institution is willing to accept and how it will respond when limits are approached.

Question 30AML/CFT Program Governance and Risk Assessment

A bank's business units each complete their own AML/CFT risk assessment, but the results are never combined. What governance weakness does this create at the enterprise level?

  1. It makes individual business-unit assessments invalid
  2. It eliminates the need for a compliance function
  3. It automatically breaches the suspicious activity reporting obligation
  4. It prevents the board and senior management from seeing the institution's aggregate risk profile and allocating resources accordingly Correct answer.

Explanation

Business-unit assessments are building blocks, but governance requires aggregation so leadership can see concentration, emerging themes, and total exposure. Without consolidation, the board cannot compare risk across units or direct resources to the highest-risk areas. The individual assessments remain useful; the gap is the missing enterprise view.

Question 31AML/CFT Program Governance and Risk Assessment

A compliance manager proposes a risk assessment methodology that scores customers on static attributes only, such as country of residence and occupation, without considering transaction behavior. Which criticism is most valid?

  1. Behavioral data is only relevant to credit risk, not AML/CFT risk
  2. Ignoring dynamic behavior means the assessment cannot detect risk that emerges after onboarding Correct answer.
  3. Static attributes are irrelevant to money laundering risk and should never be used
  4. Static scoring is prohibited because it is not transparent

Explanation

Inherent risk changes as customers transact, so a methodology that relies only on onboarding attributes will miss activity-based risk such as unusual volumes, counterparties, or geographies. A sound assessment combines static and dynamic factors and is refreshed as behavior evolves. Static attributes remain useful as a baseline; the flaw is their exclusive use.

Question 32AML/CFT Program Governance and Risk Assessment

An institution identifies a high-risk product line but assigns it the same monitoring resources as low-risk products. Which governance principle is being violated?

  1. Risk-based allocation of controls and resources proportionate to assessed risk Correct answer.
  2. Segregation of duties between the first and second lines
  3. The requirement that all customers receive identical treatment
  4. The principle that monitoring must be outsourced

Explanation

A risk-based approach requires that controls, monitoring intensity, and resources be proportionate to assessed risk. Treating a high-risk product the same as a low-risk one means the higher risk is not being mitigated and the risk assessment is not driving decisions. Proportionality is a core supervisory expectation, not optional tailoring.

Question 33AML/CFT Program Governance and Risk Assessment

A compliance officer prepares a report for the audit committee. Which content best demonstrates effective governance reporting on AML/CFT risk?

  1. The full text of the AML/CFT policy without commentary
  2. Trends in high-risk customer volumes, control testing results, and open remediation items with owners and deadlines Correct answer.
  3. A list of every employee who completed annual training
  4. A count of how many meetings the compliance team held

Explanation

Effective governance reporting gives decision-makers forward-looking information on risk trends, the effectiveness of controls, and the status of remediation with clear accountability. This allows the committee to challenge management and direct action. Raw activity counts and policy text do not convey whether risk is being managed.

Question 34AML/CFT Program Governance and Risk Assessment

A newly appointed AML/CFT officer lacks direct access to the board and must route all communications through the head of retail banking. Why is this a governance concern?

  1. It automatically transfers AML/CFT liability to the retail banking head
  2. It reduces the officer's independence and ability to escalate risk issues objectively Correct answer.
  3. It violates the requirement that the AML/CFT officer hold a banking license
  4. It means the officer cannot approve new customer accounts

Explanation

The AML/CFT officer needs sufficient stature, authority, and unfiltered access to the board or a board committee to raise concerns without business-line interference. Routing everything through a business head can suppress or delay escalation and compromises objectivity. Independence of the compliance function is a recognized supervisory expectation.

Question 35AML/CFT Program Governance and Risk Assessment

An institution's risk assessment identifies correspondent banking as high risk. Which governance response most directly reflects the assessment's findings?

  1. Applying enhanced due diligence and senior approval to new correspondent relationships Correct answer.
  2. Relying solely on the correspondent's own risk assessment
  3. Reducing the frequency of independent testing for that business
  4. Removing correspondent banking from the institution's product list without further analysis

Explanation

When the risk assessment flags a high-risk activity, the program should apply commensurately enhanced controls, such as enhanced due diligence, senior management approval, and closer monitoring. This demonstrates that the assessment drives the control environment. Withdrawing the product or reducing testing would not be a proportionate, risk-based response.

Question 36AML/CFT Program Governance and Risk Assessment

A supervisor asks how an institution ensures its AML/CFT risk assessment stays current between full annual refreshes. Which practice best answers the question?

  1. Deleting the prior assessment to avoid confusion
  2. Relying on the compliance officer's memory of recent events
  3. Establishing triggers such as new products, new markets, or significant regulatory change that prompt an interim update Correct answer.
  4. Freezing the assessment until the next scheduled annual cycle

Explanation

Risk assessments should be living documents with defined triggers for interim refresh, such as launching a product, entering a jurisdiction, a merger, or a material regulatory change. Trigger-based updating keeps the assessment aligned with the actual risk profile. Waiting for a fixed annual date can leave material changes unaddressed.

Question 37AML/CFT Program Governance and Risk Assessment

A financial group's AML/CFT program is managed centrally, but local subsidiaries argue they should be exempt from group standards because local rules are less demanding. How should governance resolve this?

  1. The group should apply the higher of group and local standards so the stricter requirement prevails Correct answer.
  2. Each subsidiary should set its own standards with no group oversight
  3. The group should lower its standards to match the least demanding jurisdiction
  4. Local subsidiaries should follow only local rules and ignore group standards

Explanation

Group-wide programs generally apply the more stringent of group policy or local requirements so that the consolidated program is not weakened by operating in lighter-touch jurisdictions. This preserves a consistent global control baseline and supports the group's ability to oversee risk across entities. Local law may require more, but it rarely justifies applying less than the group standard.

Question 38AML/CFT Program Governance and Risk Assessment

An internal audit report notes that the AML/CFT risk assessment has never been validated against actual outcomes, such as confirmed suspicious activity or regulatory findings. What is the most significant consequence?

  1. Internal audit must take over the risk assessment process
  2. The assessment becomes legally void
  3. The assessment may be mis-calibrated, over- or under-stating risk without anyone knowing Correct answer.
  4. The institution must immediately suspend all customer onboarding

Explanation

Without back-testing against real outcomes, an institution cannot tell whether its risk scoring and control calibration reflect reality. Persistent mis-calibration can leave high-risk areas under-controlled or divert resources to low-risk areas. Validation is a governance feedback loop, not a reason to halt operations or reassign the process.

Question 39AML/CFT Program Governance and Risk Assessment

A board is considering whether to approve a new product that the AML/CFT risk assessment rates as high inherent risk with currently immature controls. What is the most defensible governance decision?

  1. Approve only with defined mitigating controls, a residual-risk acceptance decision within appetite, and a monitoring plan Correct answer.
  2. Approve immediately because revenue projections are strong
  3. Approve and defer all control design to the first year of operation
  4. Reject the product permanently without any risk discussion

Explanation

Governance requires that high inherent risk be matched with adequate mitigating controls before or alongside launch, and that any residual risk be explicitly accepted by the appropriate authority within the approved appetite. A documented monitoring plan allows the board to track whether controls mature as expected. Approving without controls or deferring design exposes the institution to unmanaged risk.

Question 40AML/CFT Program Governance and Risk Assessment

An examiner observes that the AML/CFT risk assessment is prepared entirely by the compliance function with no input from the business lines that own the risks. Which conclusion is most supportable?

  1. The assessment is automatically invalid because compliance prepared it
  2. The assessment should be discarded and rebuilt by internal audit
  3. The business lines have fulfilled their risk ownership duties
  4. The assessment is likely to miss business-specific risk drivers and may not be accepted as owned by the first line Correct answer.

Explanation

First-line business units hold information about customers, products, and delivery channels that compliance may not fully capture. An assessment built without their input risks overlooking business-specific risk drivers and is less likely to be embraced as a shared responsibility. The concern is completeness and ownership, not automatic invalidity.

Question 41Audit Planning, Scoping, and Methodology

An audit team is defining the scope of a first-time CAMS audit for a digital-asset exchange. Which element most appropriately belongs in the audit scope statement rather than in the audit objectives?

  1. The specific business lines, entities, jurisdictions, and time period the audit will cover Correct answer.
  2. The audit conclusion reached at the end of fieldwork
  3. The overall purpose the audit is intended to serve for governance
  4. The criteria against which findings will be judged

Explanation

Scope defines the boundaries of the engagement: which entities, processes, systems, locations, and period are included or excluded. Objectives describe why the audit is being performed, while conclusions come after evidence is gathered.

Question 42Audit Planning, Scoping, and Methodology

A compliance officer is drafting the audit universe for an AML/CFT audit function at a money services business. What does the audit universe represent in audit planning?

  1. The set of findings carried forward from the prior audit cycle
  2. The inventory of regulatory citations applicable to the institution
  3. The roster of external auditors engaged for the year
  4. The list of all auditable entities, processes, and systems subject to potential review Correct answer.

Explanation

The audit universe is the complete inventory of auditable units from which engagements are selected and prioritized over the audit cycle. It is broader than prior findings or regulatory citations and drives risk-based coverage decisions.

Question 43Audit Planning, Scoping, and Methodology

During planning, an auditor learns the firm launched a new cross-border payment product 30 days ago. Which action best reflects proper risk-based scoping?

  1. Assess the inherent risk of the product and decide whether to include it in the current engagement Correct answer.
  2. Defer all judgment to the business line head who owns the product
  3. Exclude the product until a full year of data exists
  4. Add the product only if a regulator has already cited it

Explanation

Risk-based scoping requires the auditor to evaluate new activities for inherent risk and make an independent inclusion decision, regardless of how new the product is. Deferring to management or waiting for a full data year undermines audit independence and timeliness.

Question 44Audit Planning, Scoping, and Methodology

An audit plan specifies that sampling will follow a documented methodology with defined confidence levels and tolerable error rates. Which planning element does this describe?

  1. Audit methodology Correct answer.
  2. Audit charter
  3. Audit universe
  4. Audit criteria

Explanation

Audit methodology covers the techniques and standards the team applies, including sampling approach, testing procedures, and evidence standards. Criteria are the benchmarks used to evaluate conditions, while the universe and charter serve different planning purposes.

Question 45Audit Planning, Scoping, and Methodology

A planning memo states that the engagement will test transaction monitoring alerts generated between January and June. Which characteristic of a well-defined scope does this statement best illustrate?

  1. A statement of audit objectives
  2. A defined time boundary for the population under review Correct answer.
  3. A description of audit criteria
  4. An audit conclusion

Explanation

Specifying a date range establishes the period boundary that defines the population to be tested. Well-defined scope statements include such temporal limits so the evidence population is unambiguous.

Question 46Audit Planning, Scoping, and Methodology

An auditor is deciding between a full population test and a sample for a high-volume wire transfer process. Which factor most directly supports using a statistical sample?

  1. The population consists of three manually approved exceptions
  2. The auditor has limited familiarity with the process
  3. Management has requested a lighter testing burden
  4. The population is large and homogeneous with documented control performance Correct answer.

Explanation

Statistical sampling is appropriate when the population is large and sufficiently homogeneous to support reliable inferences at a defined confidence level. Small populations of exceptions or convenience-driven requests do not justify sampling methodology.

Question 47Audit Planning, Scoping, and Methodology

An audit team is developing the engagement work program. What is the primary purpose of a work program in audit planning?

  1. To list the regulatory penalties applicable to the entity
  2. To record the final audit opinion for distribution
  3. To set out the procedures, extent, and timing needed to achieve the audit objectives Correct answer.
  4. To document the auditor's independence declaration

Explanation

A work program translates objectives into specific procedures, specifying what will be done, how extensively, and when. It guides fieldwork and provides a basis for supervision and review.

Question 48Audit Planning, Scoping, and Methodology

A financial intelligence unit supervisor asks why the audit plan prioritizes correspondent banking over branch cash operations. Which justification is most consistent with a risk-based audit plan?

  1. Correspondent banking was audited more recently than cash operations
  2. Cash operations have more staff assigned to them
  3. Correspondent banking carries higher inherent risk and weaker mitigating controls Correct answer.
  4. The branch network is larger in headcount

Explanation

Risk-based prioritization weighs inherent risk against the strength of mitigating controls to direct audit resources where residual risk is highest. Recency, headcount, and staffing levels are not primary risk drivers.

Question 49Audit Planning, Scoping, and Methodology

During planning, the auditor identifies that the entity's customer due diligence records are stored in three separate systems with no reconciliation. How should this affect the audit approach?

  1. Treat it as a control weakness and design procedures to test completeness across all three sources Correct answer.
  2. Ignore it because data storage is an IT matter outside audit scope
  3. Reduce sample size because data is spread across systems
  4. Rely on management's assurance that the systems are integrated

Explanation

Fragmented, unreconciled data sources raise completeness risk and should shape the audit approach, prompting cross-system testing rather than reliance on assurances. Data integrity is squarely within the audit scope when it affects AML recordkeeping.

Question 50Audit Planning, Scoping, and Methodology

An audit manager is preparing a planning memorandum. Which item is least appropriate to include as an audit objective?

  1. Assess the adequacy of enhanced due diligence documentation
  2. Determine whether suspicious activity reports were filed timely
  3. Evaluate the effectiveness of sanctions screening controls
  4. Confirm that the chief compliance officer holds a specific certification Correct answer.

Explanation

Audit objectives should address the effectiveness of controls and compliance with criteria, not verify an individual's personal credential unless a rule requires it. Objectives framed around control effectiveness keep the engagement focused and evidence-based.