Anti Money Laundering Audit: A Practical Preparation Guide

Across the UK's direct AML supervision activity, only 50% of firms subject to desk-based review or onsite visit were assessed as compliant, while 25% were non-compliant, and 9,013 direct supervision actions covered 10% of the supervised population in 2023–24 UK AML/CTF supervision report 2023–24. That is the right starting point for any anti money laundering audit. Supervisors are not rewarding tidy folders, they're testing whether controls work when customer files, monitoring alerts, escalations and governance decisions are put under pressure.

Table of Contents

• Why an AML Audit Is Really an Operating-Effectiveness Test
  • What that means in practice
• Scoping the Audit Under MLR 2017 Regulation 21
  • A workable scope memo
• Testing SAR Decisions, Not Just SAR Counts
  • How to sample reporting quality
• Building the Evidence Map Across CDD, Monitoring and Governance
  • Where the evidence usually sits
• Reading the Pattern in Common AML Audit Findings
  • How to read the pattern in one firm
• Remediation That Survives the Next Audit
  • Separate the type of failure
  • What strong closure evidence looks like
• Practical AML Audit Checklist and Common Questions

Why an AML Audit Is Really an Operating-Effectiveness Test

A weak AML programme can look orderly on paper. The policy exists, the risk assessment is signed off, the training deck was circulated, and the MLRO has a standing committee invite. None of that proves the firm can spot unusual behaviour, challenge weak files, or escalate cases in a way that produces useful intelligence.

The split in supervision is often visible in how findings are made. Desk-based reviews can stay close to documents and management answers, while onsite visits expose whether staff follow the process under pressure. HMRC's own supervisory work shows how quickly gaps surface once reviewers look beyond the paper trail, with non-compliance outcomes appearing across both desk-based reviews and visits HMRC economic crime supervision annual assessment report 2022 to 2024.

What that means in practice

A useful audit focuses on the points supervisors test repeatedly, customer due diligence, transaction monitoring, suspicious activity escalation, governance records, and management accountability. The evidence sample should show whether controls work on new business and across the life of the relationship, not just at onboarding.

Practical rule: if the audit does not test a live file, a live alert, or a live management decision, it is too easy to praise policies that nobody actually follows.

A firm can still fail with a tidy policy pack. The harder questions are the ones auditors should press: did staff recognise suspicion, was the MLRO's judgement reasoned, and can the board show it understood the residual risk? That is also why firms need to align the audit with wider governance expectations, as set out in FCA compliance requirements guidance.

Scoping the Audit Under MLR 2017 Regulation 21

Regulation 21 of the Money Laundering, Terrorist Financing and Transfer of Funds Regulations 2017 is more useful than many firms realise. It requires an independent audit function where that is appropriate to the size and nature of the business, and it gives the function three clear jobs, examine the adequacy and effectiveness of AML policies, controls and procedures, make recommendations, and monitor whether those recommendations are followed Regulation 21.

That matters because scope is where many audits go wrong. Firms either make the scope so narrow that it only checks one policy family, or so broad that the team ends up spreading effort across low-risk corners while missing the live weakness in onboarding or monitoring. The right scope memo ties the audit plan to the business model, customer risk, products, jurisdictions and delivery channels.

A workable scope memo

Start by naming the in-scope business lines and control owners. Then define what “independent” means in that organisation, not in theory, for example, an internal audit team, a compliance function with direct access to senior management, or an external reviewer where internal independence isn't credible. A small firm can still have an independent audit, but the depth, cadence and sampling logic should reflect the firm's scale and risk profile, not an annual template copied from a bank.

Practical rule: scope follows risk, not convenience. If a firm's highest exposure sits in onboarding and ongoing review, the audit should not spend most of its time re-reading policy wording.

For higher-risk firms, a multi-cycle approach is usually more defensible than a single annual pass. One cycle can concentrate on customer due diligence and onboarding controls, another on transaction monitoring and escalation, and another on governance and remediation closure. That structure gives the board a clearer answer to a simple question, do the controls hold up where the exposure is real?

For a wider view of how UK regulated firms should frame governance and documentation, UK financial services regulation guidance is a useful companion reference.

Testing SAR Decisions, Not Just SAR Counts

A low SAR count can mean several different things. It can mean the firm has low-risk customers and sound controls. It can also mean analysts aren't spotting suspicion, case closures aren't documented properly, or the MLRO is rejecting referrals without a trail that would survive challenge.

ICAEW's 2025 thematic review is a good reminder that volume alone is a poor proxy for effectiveness. The review found firms generally understood SAR obligations and reported suspicion when appropriate, but some submitted no SARs because they believed their CDD was effective ICAEW AML thematic review 2025. That creates a real audit gap, because a firm can look disciplined while still closing weak cases for the wrong reasons.

How to sample reporting quality

Build the sample around decisions, not just outputs. Pull a mix of alerts generated, alerts dismissed, internal reports raised, MLRO decisions, escalations to the NCA and written rationale for closure. Then score each case in one of four ways, appropriately reported, appropriately closed, insufficiently evidenced, or incorrectly handled.

A strong sample also checks management information. Look at alert ageing, repeat alerts on the same customer and cases where the MLRO overturned the first line's view. If those patterns are ignored, the audit ends up describing a filing habit rather than a control environment.

Approved person responsibilities and accountability matter here too, because reporting quality often depends on whether the right individuals own the decision, not whether the organisation has a generic escalation path on paper.

Building the Evidence Map Across CDD, Monitoring and Governance

The fastest way to waste an AML audit is to collect documents without a map. Auditors need a field-by-field view of what should exist, where it should live and what a competent reviewer would expect to see if the control is working.

Where the evidence usually sits

Customer due diligence files should show identity evidence, beneficial ownership checks, source of funds logic and a risk rating that reflects the customer's actual profile. Ongoing monitoring should show transaction screening, name screening refreshes and the triggers for periodic review. Governance should show board or committee minutes, MLRO reporting and the three lines of defence trail. Training should show induction records, annual refreshers and role-based modules.

Practical rule: if a file tells a clean story but the dates, signatures and review trail don't line up, the control probably isn't working as described.

The common failure point is not absence of documents, it's inconsistency. One file says the customer is low risk, another shows repeated adverse indicators, and a third has no record of why the risk rating never changed. ICAEW's monitoring review highlighted failure to update CDD during the relationship as one of the frequent weaknesses, which is exactly the kind of issue that surfaces when an audit tests the file trail rather than the policy wording.

Here's a simple way to organise the evidence pull:

• Customer Due Diligence: check who was identified, who was verified, who approved the risk rating, and whether source of funds was properly reasoned.
• Ongoing Monitoring: check whether alerts were generated, reviewed and closed with a rationale that matches the facts.
• Governance and Oversight: check whether the board or committee saw meaningful MI, not just a compliance dashboard.
• Suspicious Activity Reporting: check the logic for referral, escalation, decision and filing.
• Training Records: check whether the right people were trained for the risks they face.

Financial risk assessment guidance helps compliance teams build the same evidence logic into their risk assessment process, which makes the audit trail easier to defend later.

Reading the Pattern in Common AML Audit Findings

ICAEW's 2024/25 monitoring reviews show a familiar weakness profile. Across 1,185 reviews, 19.4% of firms were fully compliant, 60.6% were generally compliant and 20.0% were non-compliant ICAEW AML supervision report. The point is simple, the everyday controls are where firms usually slip.

The same report found ineffective risk documentation at 12.6%, ineffective client-identification procedures at 11.9%, ineffective verification at 10.2% and failure to update CDD during the relationship at 11.6%. Those figures are useful because they point to broken control execution, not just weak paperwork. The CDD update issue is already picked up in the earlier evidence trail, so the central question here is why the pattern keeps reappearing across files.

How to read the pattern in one firm

Clustered onboarding failures usually point to problems with identification, verification or the initial risk rating. Clusters in periodic review files usually mean CDD is not being refreshed when facts change, or enhanced due diligence is not being triggered soon enough. Thin governance records point to a different weakness, management challenge is either absent or too vague to matter.

Mid-tier firms saw more repeat findings, while smaller firms were more likely to face first-time issues, according to the same report. Recurrence tells you more than headline severity. A modest issue that appears in file after file says more about the control environment than one larger error that never happens again.

A useful findings register groups issues by root cause, affected customers, control owner and recurrence. That makes retesting sharper because it shows whether the same failure is appearing in different files for the same reason. It also stops the board from treating the audit as a grab-bag of paperwork defects.

Remediation That Survives the Next Audit

An AML audit earns its value at the next supervisory touchpoint, when the firm can show that behaviour changed, not just that a findings log was closed. A remediation note marked “completed” without retesting is administration, not evidence of control improvement.

Separate the type of failure

Execution errors are usually the quickest to fix. A missed refresh on one file, a late escalation, or a missing sign-off can often be addressed through retraining and a targeted file review. Control-design failures are more serious, because the trigger that should have fired was missing in the first place. Governance failures are harder still, because the pattern was never surfaced clearly enough for management to act on it.

A workable remediation plan assigns an owner, states the root cause, sets a due date and defines the retest method. It also identifies the affected customer population and records whether the fix required system changes, policy changes or training changes. If the issue repeats, the retest needs to cover more than one file and more than one team.

HMRC's 2023 to 2024 enforcement data shows why this matters. It issued 977 penalties for AML and counter-terrorist-financing breaches, with a combined value of £5,318,077, and it refused 601 registration applications HMRC economic crime supervision annual assessment report 2022 to 2024. Remediation evidence can decide whether a firm moves on cleanly or keeps explaining the same weakness.

What strong closure evidence looks like

Practical rule: closure should show the fix, the retest and the management sign-off. If one of those is missing, the finding is not really closed.

Good closure packs usually include the original issue, the revised process, the training delivered, the retest sample and the senior manager's acceptance of the result. Where the issue touches governance, the board paper should show the decision, the rationale and the residual risk that remains. That is the standard that holds up under challenge, because it shows the firm corrected the problem rather than just archiving it.

Practical AML Audit Checklist and Common Questions

Use this as the working checklist before a scoping meeting.

• Scope and governance: define in-scope entities, products, channels and risk themes. Confirm who is independent, who owns remediation and who signs off closure.
• Evidence and sampling: pull files across onboarding, monitoring, SAR decisions, governance packs and training records. Sample for recurrence, not just completeness.
• Reporting quality: test whether referrals, closures and SAR decisions are documented, reasoned and consistent with the facts.
• Remediation and board reporting: require an owner, a root cause, a due date, a retest plan and a board-level summary for anything material.
• Retest discipline: don't accept “process updated” as closure unless a sample shows the update changed behaviour.

How often should an audit happen? For many firms, an annual cycle is the minimum sensible rhythm, but higher-risk businesses need a cadence that reflects change in customer profile, products and regulatory exposure.

What does independent mean in a small firm? It means the reviewer shouldn't be checking their own work. If the firm can't separate that function internally, external support is usually the cleaner answer.

When should external support be brought in? Use it when the business has recently changed, the internal team lacks AML depth, or the board wants a more defensible view of operating effectiveness.

What if a finding touches a board decision? Don't soften it. Record the decision, the rationale, the residual risk and the date the board reconsidered it after remediation.

---

If you want this turned into a board-ready audit plan, a remediation tracker or an AML evidence pack that holds up under regulatory challenge, visit Glentorion. We help regulated and crypto businesses turn messy AML controls into evidence, decisions and regulator-ready documentation.