Audit Planning, Scoping, and Methodology
Audit planning, scoping and methodology tests whether you can build an engagement that is risk-based, defensible and reproducible. The exam probes your ability to define an audit universe, allocate scarce resources, write scope statements a reviewer can test against, and select methods - walkthroughs, sampling, data analytics - that actually support the opinion you issue.
The annual plan and the audit universe
- The audit universe covers every auditable entity, process, product, system and third party within AML/CFT scope.
- Rank by inherent risk (customer base, product complexity, geography, channel, volume), control maturity, prior findings, regulatory attention and time since last review.
- The plan and any deferrals go to the audit committee for approval; independence requires that the compliance officer not dictate it.
- Justify resourcing and skills: monitoring audits need data and model expertise, not just AML knowledge.
Writing scope statements
A usable scope names the legal entities, the processes (onboarding, monitoring, reporting, training), the systems (core platform, screening, monitoring engine), the period under review, and what is explicitly excluded. Tie it to the risk assessment and to prior audit results.
Methodology choices
- Design effectiveness asks whether the control, as written and configured, addresses the risk.
- Operating effectiveness asks whether it worked consistently throughout the period; that requires inspection, observation or reperformance, not inquiry alone.
- Sampling: define confidence level and tolerable exception rate up front, prove the population is complete before drawing, and expand or qualify when exceptions appear.
Worked example
A bank generates 240,000 alerts a year across three monitoring systems. Rather than testing only the largest system, the auditor scopes all three. She defines the population as alerts generated January through December, reconciles the alert count to the system's own reporting to prove completeness, then draws a stratified sample of 60 - 30 from high-risk tiers, 30 from standard - and tests disposition, escalation and timeliness. The scope statement records the exclusions (one decommissioned system, six months of pre-migration data) and the reason for each.
Traps that cost marks
- Testing operating effectiveness only by asking the control owner.
- Drawing a sample without confirming population completeness.
- Scope statements that say AML program with no boundaries.
- Ranking risk without reference to prior findings and open regulatory issues.