Performing AML Audits with Technology
This article discusses independent anti-money laundering audits performed for banking corporations.
What is an Anti-Money Laundering (AML) audit?
An AML audit (sometimes referred to as an ‘examination’) undertakes an evaluation across a bank’s business operations, measuring the level of compliance that the bank is achieving against its regulatory obligations.
To begin the audit, the auditor will examine the adequacy of the bank’s risk methodology for identifying its vulnerabilities to unwittingly facilitating money laundering (ML) or the financing of terrorism (FT).
After validating the bank’s risk model, the audit will then examine the strengths of the bank’s policies, procedures and controls for managing its ML/FT risks and more particularly, how it manages its higher risk areas.
Validating the Bank’s Risk Model
An AML/CFT auditor’s role starts with examining the bank’s risk profile. Auditors painstakingly read through these written reports in order to test the theory of the bank’s methodology. This is a slow moving audit process of a typical AML auditing style. It relies on auditors sifting through volumes of large data, making notes and conducting interviews to clarify certain matters. This typical style of AML auditing is inefficient use of the auditor’s time and given the rate of technology growth, very soon may be considered old fashioned.
Auditing with Regulatory Technology (RegTech)
The AML audit process must be able to readily identify those areas that need strengthening. Being able to readily identify weaknesses will lessen the probability of a regulatory breach occurring. By avoiding a regulatory breach, the bank is potentially avoiding a hefty financial penalty.
By using technology, auditors have capability to quickly check the compliance status of a bank, carry out analysis of large volume of data and make findings quickly, sometimes within hours of an audit commencing.
The quality and speed of the audit is delivering a service that a team of auditors cannot deliver. In doing so, auditors are providing quality client service and lessening the risk of harm occurring.
What is the auditor’s toolkit?
So long as the RegTech solution is effective, analysis undertaken through technology will always be more efficient than analysis undertaken by a team of humans. AML360 as a software vendor provides auditors a digital toolkit. The toolkit includes testing platforms. It reliably tests a bank’s risk methodology, including the strength of its policies, procedures and controls. The analysis is fast. The reporting is instant. The findings are validated.
Stakeholders need to understand the rationale of the audit findings. AML360’s auditing toolkit is configured to provide a summary of the findings, including an explanation of the analysis and references to legislative requirements.
Configuring testing platforms
AML360’s auditing solution allows auditors to easily configure a testing platform for validating a bank’s AML/CFT risk models. No coding skills are needed. Obtain deep analysis of 70+ known areas of vulnerability to banks.
The ultimate goal of an AML auditor is to assist their client to efficiently manage their compliance obligations and in doing so, avoid regulatory breaches. AML360 uses a proven auditing solution to evaluate the ‘reasonableness’ of a bank’s AML/CFT risk model. The AML360 audit report includes reasonings to findings. This method of analysis and reporting allows auditors to manage higher volumes of auditing assignments.
The auditor can present findings displayed as data visualisation. This simplified reporting option is perfect for executives and boards of directors. Should deeper analysis be required, additional reports can be downloaded from the auditor’s register.
Validating the Strength of Policy, Procedures and Controls
The AML360 auditing toolkit allows auditors to quickly validate the reliability of a bank’s AML/CFT risk model. It also highlights those areas presenting greater risk through inherent vulnerabilities or weaknesses in a policy, procedure or control.
Why should auditors’ care?
Auditors need to ensure their testing and audit findings are reasonable so that the bank’s risk managers and directors are informed of AML/CFT regulatory risk BEFORE a material breach occurs.
How does the system work?
Designed as Regulatory Technology, AML360 uses algorithms to measure a bank’s systems against its inherent vulnerabilities, as well as testing the strength of the bank’s policies, procedures and controls. The algorithms alert auditors to areas presenting greater risk to a compliance breach.
How can auditors test transaction rules?
AML360’s toolkit includes a transaction monitoring platform from where auditors can set rules to match the banks. No coding is needed to set the rules. Once rules are entered and data loaded, filters can be turned on. ‘Red flags’ are generated, providing the audit reliable data for case testing.
Who benefits from this automated AML testing tool?
A bank’s internal AML auditing team can use the testing system to assess adequacy of controls across their bank’s business divisions, including transaction rules. They can test whether a rule is producing low quality alerts.
BSA examiners can assess a bank’s risk rating against their own methodology.
Independent auditors or professional advisory firms receive a detailed risk profile of their banking client. With that knowledge, they are better informed to provide the right auditing/advisory service.
Banking executives and directors are increasingly coming under fire for being ill informed of AML compliance risk exposures. Using the AML360 auditor’s toolkit, these senior personnel can be well informed through visually attractive charts – no need for extensive reading.
Digital auditing is fast and efficient and allows auditing firms to manage a significantly higher volume of client engagements.
Want to know more?