FRM Part II · FRM Exam Part II · Sound Management of Risks Related to Money Laundering and Financing of Terrorism

A bank's internal audit function is reviewing the AML/CFT programme. It finds that the compliance function itself performs the periodic testing of transaction monitoring controls and reports results to the board as independent assurance. Internal audit also finds that audit staff recently helped redesign the monitoring scenarios. Which conclusion is most appropriate?

Both practices are problematic. Compliance testing is second-line monitoring, not independent assurance, which belongs to internal audit. Meanwhile audit staff designing the monitoring scenarios compromises audit's independence, because it would later be assessing controls it helped build.

1. ABoth are problematic: compliance testing is second-line monitoring not independent assurance, and audit's design role impairs its independence to assess those scenariosCorrect
2. BOnly the compliance testing is problematic; audit helping design scenarios strengthens third-line assurance
3. CNeither is problematic since all functions share responsibility for AML/CFT
4. DOnly the audit involvement is problematic; compliance testing counts as independent third-line assurance