Which should the auditor recommend to management in terms of the client's risk rating procedures?

The question asks what the auditor should recommend regarding the client's risk rating procedures. The most direct and impactful recommendation to address existing deficiencies is to perform a remediation of client files. This action verifies the accuracy of current risk ratings against the established (or newly revised) procedures and ensures that required enhanced due diligence (EDD) is documented for high-risk clients. This addresses the root cause of potential misclassification and lack of EDD, which is a critical audit finding. While other options touch on related areas, remediation directly tests and corrects the application of the procedures.

A. This weakens controls. A client's tenure does not automatically reduce their risk, and this recommendation contradicts the principles of a risk-based approach.
B. While including these factors is good practice for improving a risk model, the immediate priority is often to fix the incorrect application of the current procedures, which remediation (D) addresses.
C. This recommendation concerns record retention, not the client risk rating procedures, which is the specific subject of the question.

1. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. Recommendation 10: Customer Due Diligence. This recommendation requires firms to apply EDD to higher-risk relationships, which necessitates a proper risk rating and documented evidence.

2. ACAMS. (2023). Advanced CAMS-Audit Study Guide. Chapter 4: Auditing Key AML/CFT Areas. The guide details that a key audit step is to test the application of the risk-rating methodology and verify that appropriate levels of due diligence are performed and documented.

3. Wolfsberg Group. (2020). Guidance on Sanctions Screening. While focused on sanctions, the principles of documenting due diligence and remediating files with identified gaps are universally applicable to AML risk management.