Exam Overview and Format
About the credential. ACAMS currently calls this credential the Certified AFC Auditor; it was formerly named Advanced CAMS-Audit. It is intended for professionals who conduct AFC audits, compliance monitoring, or independent testing. This guide is an English-language study resource, not an ACAMS publication.
Current format. ACAMS materials describe an exam of 90 single-choice questions in 180 minutes. The credential’s public subject areas cover the audit function and governance, planning and scoping, fieldwork and evaluation, and reporting, recommendations, and follow-up. No official domain percentages are verified here. The four guide topics and concepts below are editorial study groupings based on those broad subject areas; they are not presented as official ACAMS domains or a provider-verified topic-by-topic syllabus. Confirm current appointment rules, fees, and language availability with ACAMS before booking; this guide’s English language does not indicate which exam languages ACAMS offers.
Version note. Information was checked against the provider dossier on October 11, 2026. Exam logistics and program materials can change, so use the ACAMS Certified AFC Auditor page for current provider information.
Guide Topics and Study Priorities
| Guide topic | Coverage | Editorial study focus |
|---|---|---|
| AFC Audit Planning | Audit universe, risk-based planning, scope and objectives, sampling, materiality, resources, and communication. | Practise risk-based coverage and engagement design. |
| Evaluating Program Effectiveness | Governance, culture, policies, procedures, training, independent testing, issue management, management information, and board reporting. | Assess whether the program works in practice, not only whether documents exist. |
| Testing Key AFC Controls | KYC/CDD, transaction monitoring, sanctions screening, SAR/STR processes, models, data quality, quality assurance, and control evidence. | Practise separating control design, actual performance, and evidence quality. |
| Reporting and Remediation | Findings, ratings, reports, action plans, repeat issues, residual risk, validation, escalation, and applicable regulatory expectations. | Practise making findings evidence-based and linking remediation to root cause. |
60 Concepts for Practical AFC Audit Judgment 1–10
1. The Auditor’s Independent Assurance Role
AFC Audit Planning
An AFC auditor independently assesses whether the organisation’s arrangements for managing financial-crime risk are appropriately designed and working as intended. The auditor evaluates evidence against defined criteria; they do not take over operational decisions, investigate every suspicion, or guarantee that misconduct cannot occur. The conclusion should match the audit objective and the evidence obtained.
Example: An audit tests whether high-risk customer reviews are completed and escalated under approved procedures. It reports control gaps and their implications, while leaving customer decisions and any case investigation to the responsible teams.
Common misconception: A red flag does not make the auditor the investigator or establish criminal conduct. The audit conclusion should concern the control and evidence, with any separate referral handled through the appropriate channel.
2. Governance and Lines of Responsibility
AFC Audit Planning
Effective assurance depends on knowing who owns a control, who monitors or challenges it, and who independently assesses it. These responsibilities may be organised differently across institutions, so auditors should map the actual governance structure rather than rely on labels. Clear accountability helps identify gaps, overlaps, and inappropriate reliance between operational teams and independent assurance.
Example: A business unit performs customer reviews, compliance monitors overdue cases, and internal audit samples completed reviews. The auditor maps each role and checks whether monitoring is genuinely independent of the activity it assesses.
Common misconception: Calling a team “second line” or “independent” does not prove its work is independent. Assess reporting relationships, responsibilities, and actual challenge before deciding what assurance its work provides.
3. Board and Committee Oversight
AFC Audit Planning
Oversight bodies need relevant, accurate information to challenge management and understand significant AFC risks. An auditor assesses whether reporting supports that oversight: whether material weaknesses and overdue issues are visible, explanations are meaningful, and decisions or challenges are recorded. The audit does not substitute for the board’s judgment; it evaluates whether the governance process can support it.
Example: A board pack reports every AFC issue as on track, although the issue log contains long-overdue actions. The auditor traces how status is prepared and tests whether the pack gives the committee a fair picture.
Common misconception: A regular board meeting or a large reporting pack is not evidence of effective oversight by itself. Test the quality and accuracy of information and the evidence of meaningful challenge.
4. Management Ownership of Controls
AFC Audit Planning
Management is responsible for operating controls, maintaining procedures, addressing deficiencies, and making decisions within its authority. Audit can assess these responsibilities but should not assume them. Keeping ownership clear protects the independence of assurance and makes remediation accountable to people who can change the relevant process, systems, or resources.
Example: An audit finds a recurring backlog in alert investigations. Management owns the response, including prioritisation and capacity decisions; the auditor evaluates the evidence supporting its action plan and later tests whether the backlog is controlled.
Common misconception: Writing or implementing a control for management can impair the auditor’s ability to assess it independently. Recommendations may identify the needed outcome without taking operational ownership of the solution.
5. Independence and Organisational Position
AFC Audit Planning
Independence requires the audit function to be able to set its scope, perform work, and communicate results without inappropriate interference. Organisational position, access to records, and routes for escalating concerns all matter. Auditors should identify actual restrictions or conflicts and assess their effect on the engagement rather than treating a reporting chart as conclusive.
Example: A senior manager asks the audit lead to exclude a weak control from scope because a regulator is visiting. The lead documents the request, assesses its effect, and uses the appropriate governance route if independence is threatened.
Common misconception: A direct reporting line to a senior executive does not, on its own, prove independence or its absence. Consider practical authority, access, interference, and available escalation safeguards.
6. The Audit Charter and Mandate
AFC Audit Planning
An audit charter or equivalent mandate explains the function’s authority, responsibilities, access, and relationship with governance. It provides a basis for planning and for resolving barriers to evidence or scope. Auditors should understand the applicable mandate and follow the organisation’s governance arrangements; a document’s existence does not show that the authority works in practice.
Example: A team refuses to provide alert records, claiming audit has no access. The auditor checks the approved mandate, explains the relevant authority, and escalates any unresolved restriction through the established route.
Common misconception: Possessing a charter is not proof that an engagement can obtain necessary evidence. Test how access works in practice and document any limitation that affects the scope or conclusion.
7. Assurance Work Versus Advisory Work
AFC Audit Planning
Assurance work reaches an evidence-based conclusion against defined criteria. Advisory work may provide views or help management consider options, but management remains responsible for decisions and controls. The distinction affects the engagement’s purpose, safeguards, and how the result is described. Agreeing to advisory work should not silently convert a later independent assessment into self-review.
Example: Audit discusses possible ways to improve a control with compliance, then later plans an assurance review. It discloses the earlier involvement and assesses whether safeguards or different reviewers are needed.
Common misconception: Any advice automatically makes future audit impossible is too broad. Consider the nature and significance of the advice, the applicable independence safeguards, and whether objective assessment remains possible.
8. Objectivity and Conflicts of Interest
AFC Audit Planning
Objectivity means forming conclusions from evidence and criteria rather than personal interest, prior ownership, or pressure. Auditors should identify conflicts before and during an engagement, disclose them through the proper process, and apply suitable safeguards. Depending on the conflict, safeguards may include reassignment or independent review; the response should be proportionate to the threat.
Example: An auditor is assigned to test a customer-screening workflow they designed in a previous role. The audit lead assesses the self-review risk and assigns another tester or introduces an appropriate independent review.
Common misconception: Disclosure alone does not always remove a conflict. The audit lead must assess whether the remaining threat can be managed and whether the auditor can still reach an unbiased conclusion.
9. The Audit Universe
AFC Audit Planning
The audit universe is a structured view of areas that may require assurance, such as products, processes, systems, locations, and key controls. It gives planners a way to consider coverage across an organisation rather than selecting engagements only because they are familiar or easy to access. It should be updated when the business or risk environment changes.
Example: A bank adds a digital onboarding channel and enters a new market. The audit team updates its universe to include the channel’s customer data, onboarding decisions, and related monitoring arrangements.
Common misconception: A static list is not a risk-based audit universe. If new products, systems, or risk changes do not affect coverage decisions, the list is not serving its planning purpose.
10. Inherent and Residual Risk in Planning
AFC Audit Planning
Inherent risk describes exposure before considering controls; residual risk is the exposure that remains after relevant controls are considered. Planning can use inherent risk to identify areas requiring attention, while evaluation of current findings should consider how control performance affects remaining exposure. Keep assumptions and control evidence visible so a risk rating is not mistaken for a proven outcome.
Example: Cross-border payments have significant inherent exposure, but the audit first examines screening and escalation controls. Testing then finds a subset of payments bypasses screening, changing the assessment of risk that remains.
Common misconception: High inherent risk does not automatically mean a high-rated control finding. Nor does a promised fix lower current residual risk before implementation and validation.
60 Concepts for Practical AFC Audit Judgment 11–20
11. A Risk-Based, Adaptable Audit Plan
AFC Audit Planning
A risk-based plan directs finite audit resources toward areas where assurance is most valuable. It should consider changes in products, threats, control performance, issues, and organisational structure, then be revisited when material information changes. A plan is not a fixed checklist: changes should be reasoned, documented, and approved through the relevant governance process.
Example: A newly introduced payment feature produces a sharp increase in unusual activity. The audit function reassesses planned coverage and considers whether a targeted review should take priority over a lower-risk routine engagement.
Common misconception: Completing every scheduled review does not prove that the plan remained appropriate. A plan can need revision when significant risks or control failures emerge during the year.
12. Assessing AFC Risk Drivers
AFC Audit Planning
AFC audit planning considers the organisation’s actual exposure, including customer types, products, services, delivery channels, locations, transaction patterns, and reliance on third parties. These factors help identify where control failure could matter. They are prompts for analysis, not automatic ratings; their significance depends on the organisation’s context and evidence about how controls operate.
Example: A firm offers a new product with rapid transfers and several intermediaries. The audit team traces the product’s customer, transaction, and data flows before deciding which controls need coverage.
Common misconception: A long list of risk factors is not a risk assessment. Explain how the factors apply to this business and how they affect the audit’s coverage decisions.
13. Defining Scope Boundaries
AFC Audit Planning
Scope states what the engagement will examine, including processes, systems, locations, periods, and relevant interfaces. Clear boundaries make it possible to plan testing and interpret conclusions accurately. Scope should be broad enough to address the objective but controlled enough to complete responsibly. Any exclusions or later changes should be justified and communicated.
Example: An audit reviews alert handling but excludes the data feed that populates the monitoring system. After discovering missing customer records, the team revisits scope because the exclusion prevents a complete assessment of the control chain.
Common misconception: A narrow scope is not automatically efficient. If it omits a dependency necessary to answer the audit objective, even detailed testing inside that boundary may produce a misleading conclusion.
14. Writing Objectives and Criteria
AFC Audit Planning
An audit objective states the question the engagement must answer; criteria define the expected condition against which evidence will be assessed. Criteria may come from applicable obligations, approved internal requirements, or other clearly identified standards. Defining them before testing helps avoid shifting expectations and supports conclusions that are specific, fair, and reproducible.
Example: The objective is to assess whether required customer reviews are completed and escalated. Criteria are drawn from the organisation’s approved procedure and the applicable requirements identified for the review period.
Common misconception: A vague objective such as “review AML” gives no clear test or conclusion. Likewise, do not describe a preference as a legal requirement unless its authority and applicability are established.
15. Materiality and Significance
AFC Audit Planning
Materiality helps determine which issues matter to the audit’s objective and how much testing or escalation may be warranted. In AFC work, significance is not necessarily captured by financial value alone: the nature, scope, recurrence, affected population, and possible control consequences may matter. Document the reasoning and use applicable organisational rating criteria consistently.
Example: A small number of files lack a key review record, but all involve the same approval path and period. The auditor considers the shared control weakness, not just the number of files, when assessing significance.
Common misconception: A low monetary amount does not automatically make an AFC control issue immaterial. Assess the risk and control implications using the engagement’s criteria, not a financial threshold alone.
16. Designing a Risk-Appropriate Sample
AFC Audit Planning
Sampling is a way to obtain evidence about a defined population when examining every item is not practical. The auditor should define the population, period, test purpose, selection method, and any limitations before choosing items. The method should match the risk and conclusion sought; a convenient sample may identify issues but may not support broader inference.
Example: To test customer review completion across a quarter, the auditor first reconciles the population, then selects items across risk categories and months using a documented method appropriate to the objective.
Common misconception: A larger sample is not automatically a representative one. If selection excludes certain channels or periods, the auditor must not imply that conclusions apply to those untested items.
17. Planning Skills and Resources
AFC Audit Planning
The engagement needs enough time, suitable expertise, and access to complete its objectives. Planning should identify specialist needs, data dependencies, language or technology requirements, and competing commitments early. Resource constraints should lead to a documented adjustment, such as narrowing or changing scope with appropriate approval, rather than silent reductions in testing quality.
Example: A review of monitoring scenarios requires both AFC knowledge and an understanding of the data platform. The audit lead plans for those skills and schedules data access before fieldwork begins.
Common misconception: A capable team is not just a team with general audit experience. If an engagement needs specialist knowledge, assuming it can be learned during limited fieldwork may undermine the work.
18. Stakeholder Communication During Planning
AFC Audit Planning
Early communication helps confirm the engagement’s purpose, logistics, contacts, evidence needs, and anticipated milestones. It also gives stakeholders a chance to identify factual context without allowing them to determine the auditor’s conclusion. Keep a record of material scope changes, access problems, and agreements so that expectations remain clear throughout the engagement.
Example: At the opening meeting, the audit lead explains the review period and data request. A process owner identifies a system migration, which the team verifies and considers when finalising test populations.
Common misconception: Stakeholder agreement is not a substitute for independent planning. Management can clarify facts and constraints, but the audit team remains responsible for scope and evidence decisions.
19. Governance Effectiveness in Practice
Evaluating Program Effectiveness
Assessing governance means examining how responsibilities, escalation, challenge, and decisions work, not merely confirming that committees and policies exist. Evidence may include meeting records, issue decisions, follow-through, and interviews corroborated against actual outcomes. The auditor should distinguish formal arrangements from their operation and identify whether governance gaps affect the AFC program’s ability to respond.
Example: A committee receives regular AFC updates, but minutes show that overdue issues are repeatedly noted without owners or follow-up. The auditor examines whether escalation and accountability arrangements produce action.
Common misconception: A committee’s existence or meeting frequency does not establish effective governance. Test whether it receives useful information, challenges management, and tracks significant decisions to completion.
20. Assessing Risk Culture
Evaluating Program Effectiveness
Risk culture concerns the behaviours and incentives that shape how people identify, raise, and respond to AFC concerns. It is not measured by slogans alone. Auditors can compare stated expectations with observable patterns, such as escalation practices, issue handling, management responses, and staff understanding, while recognising that individual observations may need corroboration.
Example: An approved procedure requires staff to document the rationale for closing unusual-activity concerns and to route specified cases for review. Interviews and case records show repeated closures that bypass those steps. The auditor corroborates the pattern across teams or periods before assessing whether it indicates a broader behavioural weakness.
Common misconception: One interview cannot establish the culture of an organisation. Use multiple sources and look for consistent patterns before making a broader conclusion.
60 Concepts for Practical AFC Audit Judgment 21–30
21. Policies, Procedures, and Implementation
Evaluating Program Effectiveness
Policies express expectations, while procedures describe how work should be performed. Program evaluation checks whether both are clear, current, aligned with applicable requirements, and implemented across relevant teams and systems. Document review can assess design, but observation and testing are needed to learn whether staff and technology apply the documented process in practice.
Example: A procedure requires escalation of incomplete customer records, but the workflow allows staff to close cases without recording an exception. The auditor compares documents with system behaviour and completed case records.
Common misconception: A well-written procedure does not establish an effective process. It describes the intended control; evidence of actual use is needed to assess implementation and operation.
22. Training Effectiveness
Evaluating Program Effectiveness
Training should be relevant to employees’ responsibilities and support their ability to carry out AFC tasks. Attendance records show participation, not learning or workplace application. Auditors may assess content, role coverage, assessment methods, refresh practices, and indicators of performance, then compare training claims with observed errors or staff understanding.
Example: All alert investigators completed a course, yet several cannot explain when an unresolved issue should be escalated. The auditor reviews the course and assessment method and compares results with casework evidence.
Common misconception: A high completion rate alone does not demonstrate effective training. It proves recorded completion, not that content was understood or applied to the employee’s role.
23. Independent Testing and Monitoring
Evaluating Program Effectiveness
Monitoring and independent testing can help management identify control weaknesses, but their value depends on scope, competence, independence, methods, evidence, and follow-up. An auditor should assess what each activity actually covers and whether exceptions lead to correction. Do not assume a function’s title establishes the quality or independence of its testing.
Example: Compliance reports monthly alert-review results. The auditor examines the sample method, reviewer independence, underlying records, exception escalation, and whether reported fixes were checked afterward.
Common misconception: An existing monitoring report is not automatic assurance for audit. The auditor must assess its reliability and decide whether it is relevant to the audit objective.
24. Issue Management and Escalation
Evaluating Program Effectiveness
A sound issue-management process records deficiencies, assesses significance, assigns accountable owners, tracks actions, and escalates delays or unresolved risk. Evaluation should follow issues from identification through decision and closure, including whether overdue items remain visible to appropriate oversight. A log can be complete as a database yet ineffective if issues do not receive action.
Example: The issue register shows a high-risk data gap as closed, although the underlying reconciliation still fails. The auditor traces the closure approval and asks whether closure evidence was independently reviewed.
Common misconception: Marking an action complete is not the same as resolving the issue. Assess the evidence that the control weakness was addressed and whether the remaining risk was properly considered.
25. Management Information and Indicators
Evaluating Program Effectiveness
Management information helps decision-makers understand AFC activity and control performance. Useful measures need defined meaning, reliable data, appropriate coverage, and context; a count without a denominator or trend may mislead. Auditors should trace selected metrics to source records and assess whether limitations, changes, and adverse trends are disclosed to their intended users.
Example: Management reports fewer alerts this quarter as improved performance. The auditor checks whether alert volumes changed because of a rule adjustment and whether relevant volumes or quality indicators are included.
Common misconception: A favourable metric does not necessarily mean risk has fallen. Understand how it is calculated, what population it covers, and whether a change in process affected comparability.
26. Accuracy of Board Reporting
Evaluating Program Effectiveness
Board reporting should present an appropriately complete and accurate view of significant AFC risks, control weaknesses, and remediation status. Auditors can trace selected statements to source systems, issue logs, and management decisions, and assess whether material limitations are disclosed. The purpose is to evaluate the information provided for oversight, not prescribe one universal reporting template.
Example: A board dashboard shows all remediation as on schedule. A comparison with the action tracker reveals that several milestones have passed, so the auditor tests how dates and status are reconciled before reporting.
Common misconception: Concise reporting is not the same as incomplete reporting. A short dashboard can be useful, but it must not conceal material issues or give a falsely reassuring picture.
27. Accountability, Incentives, and Conduct
Evaluating Program Effectiveness
Accountability and incentives can influence whether employees follow AFC procedures and raise concerns. Program evaluation considers whether responsibilities are understood and whether performance expectations support, or undermine, control obligations. Evidence may include role descriptions, decision records, escalation patterns, and how management responds to failures; avoid assuming that a single incentive explains a control outcome.
Example: Investigators are praised for clearing high alert volumes, while quality reviews find repeated premature closures. The auditor explores whether targets, supervision, or procedures contribute to the pattern.
Common misconception: A performance target is not automatically improper or the root cause of errors. Corroborate its practical effect and consider other contributing factors before reaching a conclusion.
28. Governance of Significant Change
Evaluating Program Effectiveness
Changes to products, systems, data flows, staffing, or third-party arrangements can affect AFC controls. Effective governance identifies those effects before or during implementation, assigns responsibilities, and checks that required controls remain suitable. Auditors should trace selected changes through approval and post-implementation evidence rather than assume a general change policy covers AFC risk adequately.
Example: A new onboarding platform changes how customer names and countries are stored. The auditor checks whether compliance reviewed the impact on screening and whether post-launch testing identified data issues.
Common misconception: A project’s general approval does not show that AFC control impacts were assessed. Look for evidence that relevant risks and control dependencies were considered.
29. Business Self-Assessment
Evaluating Program Effectiveness
Self-assessment can help business owners understand their controls and identify issues, but it is management evidence rather than independent assurance. An auditor evaluates its method, ownership, candour, supporting records, and follow-through. The result may inform planning, while independent testing is still needed when the audit objective requires the auditor’s own conclusion.
Example: A business unit rates its customer-review process as effective. The auditor examines the criteria and supporting evidence, then samples completed reviews rather than relying on the rating alone.
Common misconception: A signed self-assessment is not proof that controls work. It may be a useful risk indicator, but its claims must be evaluated against reliable evidence.
30. Coordination Across Assurance Providers
Evaluating Program Effectiveness
Several functions may review overlapping AFC risks. Coordination can reduce unnecessary duplication and reveal coverage gaps, but reliance should be based on the other work’s relevance, competence, independence, scope, and evidence quality. The audit function remains accountable for its own conclusion and should document why any work used is appropriate.
Example: A compliance monitoring team recently tested sanctions alerts. Audit reviews its sample, test steps, source evidence, and exception handling before deciding whether any results can inform audit coverage.
Common misconception: Another team’s review does not automatically replace audit testing. A different objective, weak sample, or limited independence may make that work unsuitable for reliance.
60 Concepts for Practical AFC Audit Judgment 31–40
31. Management Capacity and Program Resourcing
Evaluating Program Effectiveness
AFC controls depend on sufficient capability and capacity to perform required work, but staffing levels alone do not determine effectiveness. Assess workloads alongside backlogs, timeliness, error patterns, prioritisation, and relevant skills. The auditor should connect evidence of resource pressure to specific control effects before concluding that capacity is a cause or significant program weakness.
Example: Alert queues grow while investigation times lengthen and quality failures increase. The auditor compares workload and staffing evidence with case outcomes to assess whether capacity is contributing to control breakdowns.
Common misconception: A busy team does not by itself prove an inadequate program. Show how workload affects required control activity and consider process, technology, and prioritisation factors too.
32. Escalation Routes and Speak-Up Arrangements
Evaluating Program Effectiveness
Employees need workable routes to raise control concerns, seek decisions, and escalate issues that remain unresolved. Evaluation considers whether routes are understood, accessible, appropriately protected, and followed through. Auditors can compare stated arrangements with case records and staff accounts while respecting confidentiality and using the organisation’s established handling procedures.
Example: Staff report that they cannot obtain timely guidance on a complex alert. The auditor checks the escalation procedure, sampled cases, response times, and whether unresolved cases reach an accountable decision-maker.
Common misconception: Having a reporting channel does not show employees use it or receive a response. Assess accessibility and outcomes without treating low complaint volume as proof of a healthy culture.
33. AFC Risk Appetite and Decisions
Evaluating Program Effectiveness
Risk appetite and related decision arrangements provide context for how management accepts, mitigates, or escalates exposure. An auditor can assess whether decisions are authorised, reasoned, documented, and consistent with applicable requirements and approved governance. The audit should not invent a universal acceptable risk level or treat management’s acceptance as proof that a control is effective.
Example: Management accepts a temporary monitoring limitation while a system is upgraded. The auditor checks the approval, rationale, compensating measures, review points, and whether remaining risk is clearly reported.
Common misconception: Management acceptance does not erase a control failure or change an applicable legal obligation. Report the control facts and assess whether the decision was properly authorised and governed.
34. Reliability of Program-Level Records
Evaluating Program Effectiveness
Program evaluation often relies on issue logs, training records, committee packs, and performance dashboards. Their usefulness depends on accurate definitions, complete populations, controlled updates, and traceability to source evidence. Auditors should test selected entries and reconcile relevant records, especially where management uses the information to assert that an AFC control or remediation process is effective.
Example: A training dashboard reports full completion. The auditor compares employee records with the assigned population and investigates whether departed staff, contractors, or recently transferred employees were handled consistently.
Common misconception: A polished dashboard is not inherently reliable. Trace key figures to their source and assess whether omissions, stale data, or unclear definitions affect the conclusion.
35. Programme-Wide Effectiveness Versus Isolated Success
Evaluating Program Effectiveness
A program is made up of connected responsibilities, processes, and controls. A successful result in one area does not establish effectiveness everywhere, and one exception does not automatically prove the whole program ineffective. Auditors should define the conclusion’s breadth, consider dependencies and common causes, and distinguish isolated failures from patterns supported by evidence.
Example: A sample shows customer files are generally complete, but the same data feed supplies incomplete names to screening. The auditor reports the file-review result separately from the system-wide screening dependency.
Common misconception: Do not generalise beyond the evidence in either direction. A clean sample may not cover an important dependency, while a single error may not establish a program-wide pattern.
36. Evaluating Program Sustainability
Evaluating Program Effectiveness
A control may appear effective during a short review yet depend on fragile workarounds, a single employee, or temporary attention. Sustainability asks whether processes, skills, systems, oversight, and resources can support the control over time. Auditors should base this judgment on evidence of repeatable operation and resilience, not on speculation about future failure.
Example: A backlog clears after managers temporarily assign extra staff, but ordinary workload remains unchanged. The auditor examines whether the improvement is sustained and whether normal capacity can maintain timely reviews.
Common misconception: A temporary improvement does not prove a durable fix. Conversely, reliance on a workaround is not automatically ineffective; assess whether it is controlled, repeatable, and appropriately approved.
37. Testing KYC and Customer Due Diligence
Testing Key AFC Controls
KYC/CDD testing assesses whether required customer information is obtained, evaluated, kept current, and used in relevant decisions under the institution’s procedures and applicable requirements. The auditor should define the customer population and review period, then test evidence of the control steps that apply to each selected case. A complete form alone may not establish sound assessment.
Example: For a sample of newly onboarded business customers, the auditor traces required ownership information, risk assessment, approval, and any recorded follow-up to source records and system timestamps.
Common misconception: A file containing every template field does not necessarily show effective due diligence. Test the substance, accuracy, and use of the information as well as document presence.
38. Risk-Based Customer Review
Testing Key AFC Controls
Customer review processes may vary according to assessed risk and relevant changes. Audit tests whether risk classification is supported, review activity occurs as designed, and changed information is considered under the applicable process. The auditor should not impose one universal review frequency; test the institution’s approved requirements and any applicable jurisdiction-specific obligations.
Example: A customer’s activity changes materially, but the risk profile remains unchanged. The auditor traces the event through monitoring, review triggers, decision records, and any required escalation.
Common misconception: A risk label alone does not prove that the review is adequate. Nor should an auditor assert a universal timing rule without establishing which requirement applies.
39. Customer-File Quality Assurance
Testing Key AFC Controls
Quality assurance can detect incomplete or inconsistent customer work, but its effectiveness depends on coverage, reviewer competence, defined criteria, independence where appropriate, and remediation. Audit should test both the original control and the quality-review process, including whether identified errors are corrected and recurring patterns are escalated.
Example: A quality team reviews a small share of onboarding files and reports few errors. The auditor assesses how cases are selected and compares QA results with an independent sample of higher-risk files.
Common misconception: A low error rate in QA is not conclusive if the review misses relevant cases or uses weak criteria. Test the QA process and its source population.
40. Transaction-Monitoring Control Chain
Testing Key AFC Controls
Transaction monitoring depends on a chain of controls: relevant activity must enter the system, scenarios must be configured appropriately, alerts must be reviewed, and decisions must be recorded and escalated. Audit should identify the objective and test the relevant links, rather than treating an alert count or a model report as proof that the end-to-end process works.
Example: An audit traces selected transactions from the source platform into monitoring, then follows generated alerts through investigator review, disposition, and any subsequent action.
Common misconception: Testing alert handling alone cannot prove that the monitoring process captured the relevant activity. Check upstream data and configuration dependencies when they affect the objective.
60 Concepts for Practical AFC Audit Judgment 41–50
41. Alert Investigation and Disposition
Testing Key AFC Controls
An alert review should be assessed against the organisation’s procedures and applicable requirements, including whether analysis, rationale, approvals, and escalation are sufficiently recorded. Audit evaluates the quality and timeliness of selected decisions; it does not decide that an alert itself proves suspicious conduct. Exceptions should be described in terms supported by case evidence.
Example: An investigator closes an alert with a brief note that activity is expected. The auditor checks whether the file supports that rationale and whether relevant information was considered under the procedure.
Common misconception: An alert closure is not proof that the activity was harmless or that it was suspicious. The audit question is whether the documented control decision met the applicable criteria.
42. Sanctions-Screening Process Testing
Testing Key AFC Controls
Sanctions-screening testing can examine data inputs, matching settings, alert handling, escalation, and relevant decision records. The scope should reflect the systems, parties, and transactions covered by the institution’s process and the legal obligations applicable to its jurisdiction. Avoid inferring a universal ownership or blocking rule from a single screening result.
Example: The auditor traces selected payment parties from source records into the screening system, then reviews potential-match decisions and evidence of escalation against approved procedures.
Common misconception: A screened name or a closed match does not by itself establish compliance. Test the relevant data, decision process, and applicable requirements; do not import one jurisdiction’s rule as universal.
43. Testing SAR/STR Processes
Testing Key AFC Controls
Audit may assess the institution’s process for identifying, reviewing, approving, and filing suspicious activity or transaction reports where required. Define the applicable jurisdiction, period, and internal criteria before testing any deadline or filing rule. The auditor assesses process evidence and governance, not whether a customer is criminal or whether every unusual event legally required a filing.
Example: A sample of cases includes decisions not to file. The auditor checks whether the rationale and approvals meet the institution’s criteria and whether any filing requirement applicable to that case was followed.
Common misconception: An unusual transaction does not automatically prove a report was required, and the auditor should not apply an invented universal deadline. Establish the relevant rule and evidence first.
44. Data Quality and Lineage
Testing Key AFC Controls
Data quality concerns whether relevant data is complete, accurate, timely, and fit for its intended control use. Lineage shows how data moves from source systems through transformations into screening, monitoring, or reporting. Testing should reconcile populations and trace fields across that path; a downstream control cannot reliably address information it never receives.
Example: The audit compares source-system customer names with the screening input and finds that some characters are truncated during transfer. It traces the transformation and quantifies the affected records.
Common misconception: A successful system run does not prove complete inputs. Test what entered the system and how it changed, rather than assuming that technical availability equals data integrity.
45. Model Validation and Model Use
Testing Key AFC Controls
Model validation examines whether a model’s design, assumptions, performance, and limitations are understood and appropriately assessed for its intended use. Audit should understand the validation scope and its evidence, while distinguishing validation from day-to-day operation and data integrity. A sound validation conclusion cannot compensate for incomplete or inaccurate inputs in production.
Example: A recent review supports the monitoring scenario design, but audit finds that a source feed omits a transaction category. The auditor tests the feed before drawing conclusions about operational performance.
Common misconception: A validation report does not prove that every production control works. Check its scope, date, assumptions, and the integrity of the data and process actually in use.
46. System Access and Configuration Changes
Testing Key AFC Controls
Access and change controls protect AFC systems from unauthorised or unreviewed changes that could affect screening, monitoring, customer data, or case decisions. Testing may examine approved access, role changes, change records, testing, and release evidence. The relevant population and criteria should be defined; system documentation alone does not establish that controls operated.
Example: A monitoring threshold changed during the review period. The auditor traces the change request, approval, testing, implementation record, and subsequent review to determine whether the process followed approved controls.
Common misconception: An approved change request alone does not show the change was tested or correctly deployed. Follow the change through implementation and evaluate evidence of the required steps.
47. Control Design Effectiveness
Testing Key AFC Controls
Design effectiveness asks whether a control, if performed as described, could reasonably address the identified risk and achieve its intended objective. Assess the control owner, trigger, frequency, data, decision criteria, escalation, and evidence. A design gap may exist even when staff consistently follow a process that cannot detect or prevent the relevant failure.
Example: A procedure requires review of customer names but not beneficial-owner information, although ownership data is available and relevant to the stated screening objective. The auditor assesses whether the control design covers that risk.
Common misconception: Consistent execution cannot make an inadequately designed control sufficient. First determine whether the control could address the risk; then separately assess whether it operated.
48. Operating Effectiveness
Testing Key AFC Controls
Operating effectiveness asks whether a suitably designed control was performed consistently and appropriately during the period under review. Evidence should relate to actual executions, selected from a defined population and checked against the control’s criteria. A walkthrough can explain the process, but it rarely proves that the control operated throughout the period.
Example: The procedure requires a supervisor to approve specified exceptions. The auditor selects cases from the period and verifies whether approvals occurred, were timely under the procedure, and addressed the stated exception.
Common misconception: A current walkthrough or policy does not prove past performance. Obtain period-specific evidence and distinguish an execution failure from a design weakness.
49. Sufficiency and Reliability of Evidence
Testing Key AFC Controls
Sufficient evidence has enough breadth to support the conclusion; appropriate evidence is relevant and reliable for the question asked. Reliability depends on source, accuracy, completeness, and how the evidence was obtained. Interviews and policies can explain context, while records and system data may support performance claims; contradictory evidence should be investigated, not ignored.
Example: A manager says all cases were reviewed, while the case system shows missing review records. The auditor validates the extract, checks the population, and asks for evidence resolving the difference.
Common misconception: More evidence is not automatically better if it is irrelevant or unreliable. A polished policy cannot outweigh credible contradictory records about what actually happened.
50. Population Completeness and Sample Inference
Testing Key AFC Controls
A sample is meaningful only in relation to a defined and sufficiently complete population. Reconcile the source of the population, period, exclusions, and selection method before testing. Conclusions should match the method: targeted selections can investigate particular risks, while broader statements about a population require a defensible basis for inference.
Example: The auditor receives a list of alerts marked closed but checks it against system totals and finds an omitted channel. The population is corrected before sample selection and conclusion.
Common misconception: A clean sample from an incomplete list does not support a clean conclusion about the whole process. Validate the population and disclose limits on any inference.
60 Concepts for Practical AFC Audit Judgment 51–60
51. Evaluating and Corroborating Exceptions
Testing Key AFC Controls
An exception is a difference between expected and observed control performance that requires evaluation. Confirm the facts, compare them with the criteria, determine whether the item is an error or an explained variation, and consider whether similar cases exist. Corroboration helps distinguish a genuine control failure from a data, timing, or interpretation issue.
Example: A sampled review appears overdue in the tracker. The auditor checks system timestamps and supporting records, then confirms whether the delay reflects a real missed step or an inaccurate status field.
Common misconception: The first apparent exception is not automatically a finding. Verify the record and applicable criteria, but do not dismiss a confirmed failure merely because management offers an explanation.
52. The Building Blocks of a Finding
Reporting and Remediation
A defensible finding connects the applicable criteria with the observed condition, explains the cause where supported, and describes the effect or risk. Its evidence should be traceable and its wording proportionate. This structure helps readers understand what failed and why it matters, while separating verified facts from analysis or unresolved questions.
Example: The procedure requires documented approval for specified exceptions; sampled cases lacked that record. Further testing identifies an unconfigured approval step, creating uncertainty that exceptions receive required review.
Common misconception: A finding that states only “staff did not follow procedure” may describe a symptom without explaining significance or cause. Do not invent a cause when evidence does not support one.
53. Rating Findings on Current Residual Risk
Reporting and Remediation
A finding rating should reflect the significance of the weakness and the risk that remains, using the organisation’s applicable criteria. Consider affected activity, scope, recurrence, control dependencies, and any effective compensating measures. Clearly distinguish current evidence from planned remediation; an action that has not been implemented and validated does not reduce current residual risk.
Example: A team proposes an extra review next quarter, but the existing control gap remains during the audit period. The auditor rates the current issue under the approved criteria and records the proposal separately.
Common misconception: Do not rate an issue solely from inherent risk or management’s future promise. Assess the control failure and current residual exposure using established rating criteria.
54. Clear, Evidence-Led Reporting
Reporting and Remediation
An audit report should let its intended readers understand the objective, scope, evidence, conclusion, significant findings, and any relevant limitations. Use precise language, distinguish facts from assessment, and explain why an issue matters. Avoid implying a broader legal or operational conclusion than the evidence and applicable criteria support.
Example: Instead of saying the monitoring programme “failed,” the report specifies which data feed omitted records, the tests performed, the control objective affected, and the limitations of the sample.
Common misconception: Forceful wording does not make a report clearer or stronger. Broad claims unsupported by the test scope can undermine a valid finding and confuse the reader.
55. Root Cause and Contributing Factors
Reporting and Remediation
Root-cause analysis seeks the underlying conditions that allowed a control weakness to occur or recur. A symptom describes what happened; causes may involve process design, system configuration, unclear ownership, capability, or capacity. Use evidence to distinguish a confirmed cause from a hypothesis, and consider interacting factors rather than stopping at the first explanation.
Example: Several reviews lack required approvals. The auditor traces the workflow and finds the system permits closure without an approval field, while supervision does not detect the omission.
Common misconception: Calling “human error” the root cause often ends inquiry too early. Examine the process and environment that allowed the error, and qualify any cause not yet confirmed.
56. Recommendations and Action-Plan Quality
Reporting and Remediation
An effective action plan links proposed work to the finding’s cause and intended control outcome. It should identify an accountable owner, concrete actions, milestones or target dates under the organisation’s process, and evidence that will demonstrate completion. The auditor can assess adequacy without dictating every operational detail or taking responsibility for implementation.
Example: For a missing data control, management proposes a source-to-system reconciliation, an accountable owner, staged implementation, and evidence of successful testing before the issue is presented for closure.
Common misconception: “Provide more training” may not address a system or governance cause. Check whether each action would plausibly resolve the identified weakness and how completion will be demonstrated.
57. Repeat Findings and Failed Remediation
Reporting and Remediation
A repeat finding signals that a prior issue or remediation may not have addressed the underlying weakness. Compare the current condition with the earlier finding, action plan, closure evidence, and subsequent changes. Recurrence warrants analysis and appropriate escalation under governance arrangements, but the rating should still reflect current risk and applicable criteria.
Example: An earlier finding on delayed reviews was closed after reminders were sent. The backlog returns, and audit compares the two periods to determine whether capacity and prioritisation were ever addressed.
Common misconception: A repeat issue is not automatically the highest possible rating. Its history matters, but the current impact, cause, evidence, and rating criteria still need assessment.
58. Management Responses and Disagreement
Reporting and Remediation
Management should have a fair opportunity to check factual accuracy and provide a response. Audit should consider relevant evidence, correct errors, and preserve its independent judgment where disagreement remains. Document the differing views and use the organisation’s governance process for unresolved matters rather than weakening a supported conclusion simply to secure agreement.
Example: Management disputes the report’s sample results and provides additional case records. The auditor verifies those records, updates any affected facts, and records the remaining difference in view.
Common misconception: Management’s disagreement does not automatically invalidate an evidence-based finding. Equally, auditor independence is not a reason to ignore relevant new evidence.
59. Follow-Up and Validation Before Closure
Reporting and Remediation
Follow-up checks whether agreed actions were implemented and whether they address the weakness sufficiently for the issue to be closed under the organisation’s criteria. Evidence may require more than a completed policy or management certification; testing should match the action and risk. Closure is an assurance decision, not merely an administrative status change.
Example: Management installs a new screening validation but has not shown it works with complete source data. Audit tests the relevant records and results before recommending closure under the applicable process.
Common misconception: A completed action ticket is not proof that the control is effective. Validate the result and consider whether enough operation has occurred to support the closure decision.
60. Timely Communication of Significant Matters
Reporting and Remediation
Material issues may need to be communicated through an appropriate channel before the final report, especially if delay could hinder responsible decision-making. The auditor should follow the organisation’s escalation process, communicate verified facts and known limitations, and continue the work needed for a supported conclusion. Interim communication complements rather than replaces formal reporting.
Example: Fieldwork reveals a control gap affecting an active process. The audit lead promptly informs the appropriate governance contact with verified facts, then completes testing and records the issue in the final report.
Common misconception: Waiting for the final report is not always the right response to a significant emerging concern. But an interim alert should be factual, appropriately routed, and clear about what remains unverified.
Six Actionable Study Steps
Provider Source and Version Note
Primary provider reference: ACAMS, “Certified AFC Auditor,” https://www.acams.org/en/certifications/afc-auditor (checked against the supplied provider dossier on October 11, 2026). ACAMS is the authority for its credential and exam information. Confirm current logistics and language availability with ACAMS. The guide’s topic groupings and concept explanations are editorial study material; the cited provider source confirms credential-level information and broad subject areas, not these exact concepts or any question distribution. Study priorities are editorial, not official exam weights.