AML/CFT Program Governance and Risk Assessment
This domain tests whether you can evaluate the oversight structure sitting above an AML/CFT program and judge the quality of the risk assessment that drives everything downstream. The exam expects you to know who owns risk (the business, first line), who sets the framework (compliance, second line), and what internal audit as the third line may and may not do.
Pillars and accountability
- The five core pillars: internal policies, procedures and controls; a designated compliance officer; ongoing employee training; independent testing; and customer due diligence with recordkeeping.
- The board approves the AML/CFT policy and the risk appetite; the audit committee receives independent audit results directly and has unrestricted access to management and records.
- Senior management implements the program; the AML/CFT officer needs authority, resources and stature to act on findings.
- Independence tests: audit reports to the audit committee rather than to the compliance officer, and auditors must not design or operate the controls they test.
Evaluating the risk assessment
Look at coverage, methodology, data and governance. Does it cover all customer types, products, services, channels, delivery methods and geographies? Is inherent risk scoring defined and consistently applied? Were mitigating controls actually tested before residual risk was set? Is it refreshed on a stated cycle and after material change, and did the board approve it?
Worked example
An auditor reviews a bank's enterprise-wide risk assessment and finds every foreign jurisdiction rated medium, because the matrix caps country risk at medium and the source data is three years old. Rather than re-scoring the bank's customers - which is management's job - she tests the methodology. She documents the cap, traces the jurisdiction list to the bank's own country-attribution data, and finds two jurisdictions on the FATF call-for-action list that are absent entirely. The finding is a design deficiency in the risk assessment, with a recommendation to refresh source data quarterly and add an override for FATF-listed jurisdictions.
Traps that cost marks
- Performing the risk assessment instead of auditing it; audit may recalculate and challenge, never own the score.
- Accepting residual risk without evidence that the mitigating controls operate.
- Overlooking that the assessment was never board-approved, never refreshed, or excludes a whole business line.