Independent Testing That Was Neither Independent nor Risk-Based
At a mid-sized savings bank with 38 branches, the 2024 AML independent test was performed by the internal audit team that had designed the bank's CDD procedures in 2022. The test sampled 60 files, all from the low-risk retail segment, and found a 0% error rate. It concluded that the AML program was 'effective'. The board's risk committee received a one-page summary and approved the conclusion in 20 minutes. In 2025, the FSS examination found that 12% of high-risk corporate files lacked beneficial ownership verification, 27% of PEP files had no senior management approval, and 41% of STRs were filed more than five business days after the triggering transaction. The bank's AML officer had flagged the STR backlog in an email eight months earlier, but no action was taken. The bank has 14,000 high-risk customers and 3 AML staff. The CEO asks for a remediation plan that will satisfy the FSS and the board within six months, without hiring more than two additional staff.
1. Critique the 2024 independent test. Why was the 'effective' conclusion unreliable?
Read the worked answer
The test failed on independence, scope, and evidence. The internal audit team had designed the CDD procedures it was testing, creating a self-review threat; an independent tester or outsourced function should have assessed the design and operating effectiveness. The sample covered only 60 low-risk retail files, so it could not support a bank-wide effectiveness conclusion when the known risks were in high-risk corporate, PEP, and STR processes. A 0% error rate from a non-representative sample is not evidence of effectiveness; it is evidence of a weak sample. The board received a one-page summary and approved it in 20 minutes, which is not meaningful challenge or oversight. The test also appears to have ignored the AML officer's earlier STR backlog warning. A credible test should be risk-based, cover high-risk customers and STR timeliness, test both design and operation, report root causes, and be reviewed by the board with enough time and detail to challenge management.
2. Design a six-month remediation plan that addresses the FSS findings with only two additional staff. What should be prioritised?
Read the worked answer
The plan should be risk-based and sequenced. Month 1: appoint an accountable remediation lead, validate the FSS findings, freeze new high-risk onboarding where files are incomplete, and build a register of the 12% BO gaps, 27% PEP approval gaps, and 41% late STRs. Months 1–2: hire the two additional staff, one focused on high-risk CDD/BO remediation and one on STR quality and backlog; use temporary contractors only if the budget allows and the work is supervised. Months 2–4: remediate all PEP files first because the approval gap is a control failure, then BO files for high-risk corporates, then STR timeliness. Introduce a same-day escalation rule and a daily STR ageing report. Months 3–5: retrain relationship managers and branch staff on BO, PEP approval, and STR triggers; update procedures and system aggregation. Month 6: commission an independent validation of the remediation and report results to the board. Metrics should include percentage of high-risk files remediated, STR filing days, PEP approvals, and repeat findings.
3. What should the board risk committee receive monthly, and what governance changes are needed after the FSS findings?
Read the worked answer
The board risk committee should receive a monthly dashboard showing open high-risk CDD gaps, BO verification rates, PEP approvals, STR volumes and ageing, training completion, and remediation milestones against the six-month plan. It should also receive root-cause analysis, not just counts, and a clear statement of residual risk and any accepted risks. Governance changes should include separating the AML testing function from the team that designs AML procedures, giving the AML officer direct and timely access to the board risk committee, and requiring board minutes to record challenge and decisions. The bank should add AML remediation progress to CEO and branch manager scorecards so that target pressure does not override controls. It should also set a formal escalation rule for overdue STRs and CDD gaps, with named owners. Finally, the board should approve the independent validation plan and require management to report any repeat FSS findings immediately.