AML Quality Assurance & Audit Readiness

AML quality assurance checks whether reviews are consistent, evidence-backed and aligned with policy. Audit readiness means a case file can be understood later by another reviewer, auditor, regulator or MLRO without relying on memory.

Boundary: this page explains assurance concepts. It does not define a mandatory audit programme, sampling method or regulatory examination standard.

1. Why quality assurance matters #

AML work can fail even when individual analysts try to do the right thing. Common weaknesses include unclear rationale, missing evidence, inconsistent escalation, weak match-clearing notes and decisions that cannot be reconstructed later.

Quality assurance focuses on repeatability:

similar cases should be reviewed using similar logic;
material facts should be supported by evidence;
alerts should not be closed with vague wording;
escalations should be understandable and complete.

2. QC, QA and audit #

Layer	Plain meaning	Typical AML use
Quality control	Check of a specific case or output.	Four-eyes review, maker/checker, targeted correction.
Quality assurance	Broader review of process quality and consistency.	Sample testing, trend analysis, coaching and methodology improvement.
Internal audit	Independent assurance over whether controls are designed and operating effectively.	Testing governance, policy adherence, issue remediation and evidence.

3. What a reviewer tests #

A reviewer may test whether:

customer identity and identifiers are clear;
ownership/control is documented;
screening results are captured and explained;
red flags are addressed, not ignored;
risk rating rationale matches the facts;
decision options are consistent with policy;
escalation decisions are documented;
evidence links or screenshots are recoverable.

4. Four-eyes principle #

The four-eyes principle means that certain decisions should be reviewed by a second competent person. It is useful for higher-risk onboarding, true or possible sanctions matches, PEP cases, complex structures, material adverse media, unusual transaction activity and MLRO escalations.

Four-eyes review should not be a rubber stamp. The second reviewer should be able to challenge assumptions, request evidence and record approval or disagreement.

5. Audit-ready case file #

An audit-ready case file should show:

what was reviewed
which sources were used
which identifiers were searched
what evidence was captured
what risks were found
what risks were cleared
what remains unresolved
who reviewed the case
what decision or recommendation was made
why that decision was reasonable at the time

6. Common quality findings #

Examples of quality findings include:

“no match” without identifiers searched;
adverse media noted but not assessed;
PEP match cleared without date of birth or country comparison;
customer risk rating changed without rationale;
EDD requested but evidence not attached;
escalation decision missing from the case file;
outdated CDD accepted without refresh logic.

7. Metrics That Matter #

AML quality is not measured only by the number of alerts reviewed or reports filed. A mature programme also looks at whether reviews are explainable, consistent and useful for risk decisions.

Useful quality indicators include:

Metric	Why it matters
Evidence completeness	Case decisions can be reconstructed later.
Rationale quality	Closures and escalations explain the reviewer’s reasoning.
Escalation consistency	Similar risk patterns are routed in a similar way.
False-positive learning	Repeated weak alerts are reviewed and calibrated rather than ignored.
Unresolved-risk handling	Open questions are tracked rather than buried in summaries.
Reviewer rework rate	Poor first reviews create downstream MLRO/audit burden.
Audit trail quality	Another reviewer can understand who did what, when and why.

Weak metrics include raw alert volume, raw closure count or raw STR/SAR count without quality review. High volume does not automatically mean effective AML control.

8. Source basis #

FATF Recommendations for internal controls, compliance function and training concepts.
OFAC Framework for Compliance Commitments for sanctions compliance testing, internal controls and training context.
FFIEC BSA/AML Examination Manual for examination, internal-control and independent-testing concepts.

Auditing for effectiveness#

SRC-WOLF-008 adds an industry-practice layer focused on whether financial-crime controls produce effective outcomes rather than merely existing on paper.

Audit and QA should test both:

design: whether the control is capable of addressing the identified risk;
operation: whether it is applied consistently, produces useful outputs and drives remediation.

The Wolfsberg source is not binding law. It should be mapped to FATF, local regulation, supervisory expectations and the institution's own control framework.