Testing Internal Controls and Transaction Monitoring
This domain asks whether you can gather evidence that controls actually work, with particular weight on transaction monitoring. The exam expects you to distinguish design from operating effectiveness, to know the evidence hierarchy, and to audit the monitoring lifecycle from data ingestion through alert disposition.
The evidence hierarchy
Inquiry is the weakest form of evidence and must be corroborated by observation, inspection of records, or reperformance. A completed checklist proves a form was filled in, not that an investigation happened.
Testing transaction monitoring
- Data integrity first: reconcile source systems to the monitoring engine, look for missing feeds, currency and country-code mapping errors, and broken account-to-customer linkage.
- Scenario coverage mapped to the risk assessment: which typologies are covered, which are absent, and who approved the gap.
- Thresholds and segmentation: confirm tuning changes were approved, documented and supported by above-the-line and below-the-line testing.
- The workflow: generation, triage, investigation, disposition, escalation and referral. Test timeliness, documentation quality and consistency of disposition decisions.
- Access and change management over the monitoring system.
- Model validation is a separate function; audit tests whether validation occurred and whether its findings were resolved.
Worked example
An auditor reperforms 40 closed alerts, comparing each investigator narrative to the underlying transaction data. Six alerts were closed as no SAR with a single-line comment and no description of the activity reviewed; in two of these the underlying transactions included repeated structured deposits the investigator never addressed. She characterises this as an operating deficiency in alert disposition, quantifies the error rate at 15 percent, and projects it across the population to size a look-back.
Traps that cost marks
- Testing the tool's output rather than the human judgements applied to it.
- Sampling only escalated alerts, so closed and no-action cases are never examined.
- Treating model validation as a substitute for auditing the monitoring process.
- Ignoring data completeness, then drawing conclusions from an incomplete alert population.