CAMS-Audit study plan
CAMS-Audit · Give each week a clear focus.
8 weeks · About 6 hours per week
AML/CFT Program Governance and Risk Assessment
Map the four required elements of an AML/CFT program (internal controls, designated compliance officer, training, independent testing) and write a one-sentence audit implication for each
Distinguish enterprise-wide risk assessment from customer risk assessment and list the risk factors (product, service, customer, geographic, channel) an auditor would expect to see scored
Explain how the board and senior management set risk appetite and how that appetite should be evidenced in policy and in the audit charter
Draft five interview questions that would reveal whether governance is operating or merely documented
Your checkpoint
A two-page governance control matrix listing each element, the evidence source an auditor would request, and the failure mode it detects
AML/CFT Program Governance and Risk Assessment & Audit Planning, Scoping, and Methodology
Evaluate a sample risk assessment for scoring consistency, documented rationale, and linkage to the monitoring and CDD programs
Identify the three lines of defense and articulate why the independent audit function must report outside the compliance line
Build a scoping memo that ties audit objectives to the institution's highest residual risks
Apply a materiality and risk-ranking approach to decide which business units fall inside the audit universe
Your checkpoint
A one-page risk-based scoping memo for a hypothetical mid-size bank with the audit universe ranked and justified
Audit Planning, Scoping, and Methodology
Write audit objectives, scope, and criteria for a transaction monitoring audit using a recognized internal control framework
Sequence the audit lifecycle from annual planning through fieldwork, workpaper review, and clearance
Design a sampling approach that combines judgmental selection for high-risk populations with statistical sampling for control testing
Specify workpaper standards that would survive an examiner's review: preparer, reviewer, date, source, and conclusion
Your checkpoint
A complete audit program for one process area with test steps, sample sizes, evidence types, and pass/fail criteria
Audit Planning, Scoping, and Methodology & Testing Internal Controls and Transaction Monitoring
Select test procedures (inquiry, observation, inspection, reperformance) appropriate to each control type and justify the choice
Draft a data request list that a first-line team could fulfill without ambiguity
Define how to test the design of a control separately from its operating effectiveness
Explain how to document and escalate a control deficiency found during fieldwork before the report is issued
Your checkpoint
A fieldwork pack: data request list, sampling worksheet, and a mock issue write-up with severity rating and root cause
Testing Internal Controls and Transaction Monitoring
Trace how monitoring scenarios are built from the risk assessment, tuned, and validated, and identify what evidence proves tuning occurred
Test threshold and scenario logic by reperforming a rule against a known population and reconciling alert volumes
Evaluate alert disposition quality by testing whether investigation narratives document the decision and the data reviewed
Assess model or scenario change management, including version control, approval, and post-implementation review
Identify red flags of monitoring backlogs, alert suppression, or undocumented tuning that inflate apparent effectiveness
Your checkpoint
A transaction monitoring test report section covering scenario coverage, alert disposition quality, and two findings with supporting evidence
Customer Due Diligence and Enhanced Due Diligence Auditing
Test whether customer risk ratings are assigned consistently and refreshed on the scheduled cycle by sampling files across risk tiers
Verify beneficial ownership identification and verification for legal entities, including control-person determination
Audit enhanced due diligence for politically exposed persons and high-risk customers against documented triggers and approval levels
Confirm that CDD deficiencies identified during onboarding are remediated or escalated within policy timelines
Check recordkeeping retention and retrievability for CDD documentation
Your checkpoint
A CDD/EDD sample testing workbook with 15-20 files scored against defined attributes and a deficiency rate by risk tier
Suspicious Activity Reporting and Recordkeeping Audits
Test the end-to-end suspicious activity reporting workflow from alert through investigation, decision, filing, and 90-day continuing review
Verify that filing decisions are made within regulatory timelines and that supporting documentation is retained
Assess the quality of narrative writing in a sample of filings for specificity, completeness, and consistency with the file
Test confidentiality controls around filings and the prohibition on tipping off the subject
Audit recordkeeping obligations for currency and monetary instrument thresholds and for wire transfer records
Your checkpoint
A SAR testing memo with timeline metrics, a narrative quality scorecard, and a list of any late or missing filings
Audit Reporting, Remediation, and Regulatory Expectations
Draft findings in the condition-criteria-cause-effect-risk format and rank them by severity
Write remediation recommendations that specify an owner, a due date, and a validation method
Design issue tracking and validation testing so closure is evidence-based rather than asserted
Prepare for examiner expectations on audit coverage, independence, and responsiveness to prior findings
Build a 30-day final review schedule covering all six domains
Your checkpoint
A full mock audit report with executive summary, findings, ratings, management responses, and a validation plan
Milestones
Week 2: You can explain without notes how the risk assessment drives scoping, and your scoping memo names the highest residual risk and the audit objective that addresses it
Week 4: Your audit program could be handed to another auditor and executed: every test step names the evidence, the sample, and the pass/fail threshold
Week 5: You can reperform a monitoring scenario against a sample population and state whether alert volumes are consistent with the underlying rule logic
Week 6: Your CDD workbook produces a defensible deficiency rate by risk tier and each finding traces to a specific file and attribute
Week 7: You can calculate filing timeliness from raw dates and identify at least one narrative quality gap with a concrete improvement
Week 8: Your mock report findings each state condition, criteria, cause, effect, and risk, and every recommendation has an owner, date, and validation test