Which best explains why the auditor rates the audit finding on sanction screening severity high?

The severity of an audit finding is determined by its potential impact on the organization's ability to comply with regulations and manage risk. Long intervals between updating sanctions lists create a direct and significant risk that the organization could unknowingly process transactions for, or maintain relationships with, a newly sanctioned entity. This constitutes a direct breach of sanctions regulations, which can result in severe penalties, reputational damage, and regulatory enforcement actions. The high probability of control failure makes this a high-severity finding.

A. While using wrong sanctions lists is also a high-severity issue, the specific finding described is about the timeliness of updates.
B. The audit topic is irrelevant to the severity rating; severity is based on the risk and impact of the finding itself.
D. Reporting a non-violation is an efficiency issue (a false positive), which is a much lower risk than failing to detect a true violation.

1. ACAMS. (2021). Advanced CAMS-Audit Certification Examination Study Guide, Chapter 4: Audit Execution, Section: "Rating the Significance of Audit Findings," pp. 91-92. (Explains that high-risk findings relate to significant control weaknesses that could result in major compliance breaches).

2. The Wolfsberg Group. (2019). Wolfsberg Guidance on Sanctions Screening, Section 2.2: "List Management," p. 6. (Stresses the importance of timely and accurate updates to sanctions lists to ensure the screening process is effective).

3. U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC). (2019). A Framework for OFAC Compliance Commitments, Section B: "Risk Assessment," p. 4. (Highlights that a root cause of sanctions violations is improper or incomplete sanctions list screening).