An auditor should verify that an institution has ensured its AML systems and controls include:

An AML audit's primary function is to test the adequacy and effectiveness of an institution's AML systems and controls against its risk profile. Therefore, the auditor must first verify that the institution has formally documented its risk management policies and its overall AML risk profile. These documents form the foundation upon which all other systems and controls are built and evaluated. The audit assesses whether the implemented controls are appropriate for the identified risks.

B. Risk should be considered in all relevant operations, not just on a monthly basis. The frequency should be risk-based and often continuous.
C. Daily reporting is overly prescriptive and not a universal requirement; reporting frequency should be risk-based and appropriate for the institution's size and complexity.
D. Training is required for all appropriate staff, not just senior management. Limiting training would be a significant control deficiency.

1. ACAMS. (2021). Advanced CAMS-Audit Certification Study Guide. Section 2.1, "The Elements of an AML/CFT Program," emphasizes that an effective program is built on a foundation of a comprehensive risk assessment and corresponding risk management policies.

2. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Recommendation 1, "Assessing risks and applying a risk-based approach," states that financial institutions should be required to identify, assess, and take effective action to mitigate their money laundering risks.