Which does a financial institution (FI) need to do when outsourcing an independent audit?

When outsourcing any function, especially a critical one like an independent audit, the financial institution (FI) retains ultimate responsibility for compliance. The primary consideration must be the competency and suitability of the third party. This involves ensuring the audit firm possesses the necessary expertise in AML/CFT regulations and that the proposed scope of the audit is comprehensive enough to cover the FI's specific products, services, customers, and geographic risks. A mismatch in either experience or scope can render the audit ineffective, providing a false sense of security and failing to meet regulatory expectations.

A. Recommendations are useful input, but the selection must be an independent process to avoid conflicts of interest and ensure objectivity.
B. While part of due diligence, a lack of prior audits is not an automatic disqualifier; a new, qualified firm may be suitable.
D. Price and location are secondary business considerations; they must not compromise the quality, independence, and effectiveness of the audit.

1. Basel Committee on Banking Supervision (BCBS). (2020). Guidelines: Sound management of risks related to money laundering and financing of terrorism. Section 4.4, Paragraph 65. "The audit function should be independent, adequately resourced and staffed by individuals with sufficient skills and expertise...".

2. The Wolfsberg Group. (2021). Statement on Effectiveness. "An effective AML/CFT programme requires... independent testing of the programme’s soundness and efficacy." This implies the testing function must be competent.

3. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation. Recommendation 18. While focused on group-wide programs, the underlying principle requires adequate controls and functions, including competent audit, across the institution.