Independent evaluation of an Australian AML/CTF program

Set frequency and scope from risk

The program should state how often independent evaluation will occur and why that frequency suits the business. Three years is a maximum interval, not a reason to wait when risk or control change warrants earlier work. New high-risk services, acquisition, major system migration, serious breach, repeated CDD failures, regulator concern or significant growth can justify an additional or accelerated evaluation. Record the decision and governing-body visibility.

Scope the whole program over a cycle: governance, risk assessment, policies, designated-service boundaries, CDD, PEP and sanctions controls, ongoing monitoring, reporting, tipping off, records, personnel controls, outsourcing, data and technology. A targeted review may address an urgent issue, but it should not silently replace the required program-wide evaluation. Map every applicable obligation and material risk to an evaluation procedure before fieldwork begins.

Protect evaluator independence and competence

Select a person with sufficient AML/CTF, sector, testing and analytical expertise. Independence means the evaluator can form and report an objective view without reviewing work for which they were materially responsible or being constrained by revenue owners. An internal evaluator may be suitable if organisational position, prior involvement, reporting line and conflicts permit genuine independence. External status alone does not cure a conflict or lack of skill.

Document qualifications, experience, declarations, previous advisory work, access rights and the person who can approve scope changes. The evaluator should report findings without management editing away disagreement and have access to the governing body where material issues arise. If specialist technology, sanctions, legal or data expertise is needed, add it while maintaining clear responsibility for the final opinion. Preserve limitations and unavailable evidence in the report.

Test design, implementation and effectiveness

Design testing asks whether the program addresses current legal obligations and the risks identified. Implementation testing asks whether policies are embedded in systems, roles and workflows. Effectiveness testing asks whether controls produce reliable outcomes. Use interviews, walkthroughs, data analysis, observation and risk-based file samples across services, customer types, locations and time periods. Include exceptions, declined work, overrides and closed files rather than sampling only clean completions.

Trace end to end. For example, take a complex customer from initial scope and identification through ownership, risk, screening, approvals, service activity, ongoing review and reporting consideration. Reperform selected decisions against evidence and current policy. Test whether monitoring parameters reflect the risk assessment, whether alerts are timely and well resolved, and whether governance receives accurate information. Record sampling rationale and do not generalise beyond what the evidence can support.

Write findings that management can fix

Each finding should state the requirement or control objective, condition observed, evidence, cause, risk and recommended outcome. Grade severity using defined criteria that consider regulatory exposure, customer or transaction impact, duration, population and compensating controls. Separate isolated documentation defects from systemic failures, but do not downgrade missing evidence solely because staff say a step normally occurs.

Management responses should identify an accountable owner, specific action, target date, interim control and residual risk acceptance where necessary. The governing body should see material findings, overdue actions and disputes. Verification must test the completed change on real evidence; closing an action because a policy was rewritten is insufficient if systems, training and files still follow the old process. Preserve the report, response, progress and closure evidence as program records.

Run a credible evaluation lifecycle

AUSTRAC guidance describes specific exemptions for businesses that provide only item 54 where all conditions are met. Mixed-service entities should not rely on that setting. For everyone else, budgeting and evaluator selection should start well before the due date so independence and sample access are not compromised by a rushed engagement.

• Calculate the applicable due date, document risk-based frequency and obtain governing-body visibility of the evaluation plan.
• Confirm evaluator competence, independence, conflicts, reporting rights and access to data and personnel.
• Map obligations and risks to procedures, then select representative and adverse samples.
• Test policy design, operational implementation and real-world effectiveness using reproducible evidence.
• Issue prioritised findings with owners, dates, interim controls and transparent management responses.
• Independently verify remediation and report overdue or ineffective closure to governance.