Independent audit of controls: stages and deadlines
An independent audit of controls checks whether an obliged entity's anti-money-laundering programme actually works, not just whether it exists on paper. The process runs in five stages: scoping, evidence collection, testing, reporting and remediation tracking. A first-time audit typically takes six to ten weeks; a repeat cycle with a known scope runs faster. The point of no return is the moment the auditor signs the final report — after that, findings cannot be renegotiated.
Why an independent audit changes the risk position
Once an audit is commissioned, the entity's compliance file stops being a self-assessment and becomes a document a third party can be asked to produce. A supervisor reviewing governance will treat an unfinished audit differently from a completed one with open remediation items. If the review overlaps with a period when an on-site inspection is announced authorisation who decides and is already in motion, the audit file becomes the first thing requested, so timing the two processes together is worth planning rather than leaving to chance.
The practical effect is twofold. First, findings create a paper trail: an identified gap that is not remediated within an agreed window is harder to explain later than a gap that was never tested. Second, the audit report becomes the baseline against which future supervisory questions are measured, so its scope and wording matter as much as its conclusions.
Stages and typical timing
| Stage | What happens | Typical duration |
|---|---|---|
| Scoping | Auditor and entity agree the perimeter: which controls, which period, which business lines | 1–2 weeks |
| Evidence collection | Policies, transaction samples, training records and escalation logs are gathered | 2–3 weeks |
| Testing | Controls are tested against the agreed sample; gaps are logged as they are found | 2–3 weeks |
| Reporting | Draft findings are shared for factual comment, then the report is finalised | 1–2 weeks |
| Remediation tracking | Agreed fixes are implemented and closed off against deadlines set in the report | Varies, usually 4–12 weeks |
What to do
- Appoint an auditor with no operational role in the controls being reviewed — independence is the point of the exercise, not a formality.
- Fix the scope in writing before evidence collection starts, including which entities and which time window are covered.
- Assign a single internal contact who collects and hands over documents, so the auditor is not chasing multiple departments.
- Flag any outsourced function to the auditor early, including any automated monitoring tool. Where a vendor contract is silent on how outputs are generated — for example when the contract is silent on AI output — the auditor will need that clarified before testing can rely on the tool's results.
- Review the draft findings for factual accuracy only, within the window the auditor sets — this is not a stage for negotiating conclusions.
- Set remediation deadlines in the final report itself, not in a separate memo that can be quietly extended later.
Who decides
The management body of the obliged entity decides whether to commission the audit and approves its scope. The auditor decides testing methodology and findings independently — this is what makes the report usable as evidence of independence. Remediation deadlines are set jointly, but the auditor's sign-off on closure is final: an item the auditor has not confirmed as closed remains open regardless of internal assurances.
Where scope questions branch out
If the entity has already outsourced part of its compliance function, the audit scope must state clearly whether the outsourced function is tested directly or through the entity's oversight of it — these are different exercises with different evidence requirements.
If the entity holds a licence obtained through a group restructuring or an asset transfer, check separately whether the licence itself needs to be recorded to remain effective; that is a distinct question from whether the controls built around it pass the audit, covered in when a licence must be recorded to be effective.
If a prior audit left an item open and it was never formally closed, the current audit will treat it as a repeat finding rather than a new one — repeat findings tend to draw closer supervisory attention than first-time gaps.
What this page does not decide
This page describes the audit procedure and its usual timing. It does not set the exact scope for a specific entity, does not predict how a supervisor will react to a given finding, and does not replace legal advice on how a particular gap should be closed. Sector-specific detail on unrelated intellectual property questions — such as a competing patent filing next to an existing product — sits outside this procedure entirely and is handled on its own track.
Verified
Reviewed for accuracy as part of the current compliance-and-AML file update. Primary reference points are internal audit methodology documents and the entity's own control inventory; no external source is cited on this page because the procedure described here does not depend on a specific statutory provision.
Related publications
A closely related procedure sets out the mirror question for functions handled by a third party: Outsourcing of compliance functions step by step.
FAQ
How long does independent audit of controls take in practice?
A first-time audit usually takes six to ten weeks from scoping to final report. A repeat audit with a stable scope and no major structural change tends to finish in four to six weeks, since evidence collection is faster once the entity knows what will be requested.
Which documents are needed to start?
The auditor needs the current AML policy set, a sample of transaction monitoring records for the audit period, training and awareness records, escalation and suspicious-activity logs, and the closure status of any findings from the previous audit. Missing items delay scoping rather than the audit itself.
What happens if the other side does not respond?
If an internal department does not provide requested evidence within the agreed window, the auditor records the gap as an unverified control rather than waiting indefinitely. An unverified control is reported as a finding, which usually carries the same weight as a confirmed failure until it is resolved.
Next steps
If governance questions are already on a supervisor's agenda, see a supervisor asks about governance authorisation for what to prepare first. For matters outside this compliance track, including intellectual property exposure such as when a competitor files a patent application next to your existing product, a separate review is the right starting point.