Independent audit of controls: what the decision maker looks at
An independent audit of AML and crypto-asset controls checks three things for the decision maker: whether the control design matches the licensed activity, whether staff apply it consistently, and whether last cycle's gaps were actually closed. The audit does not approve or reject the business. It produces a rated finding, and senior management must close that finding within a set window.
What changes once the audit is commissioned
The clock starts the moment the mandate is signed. The audit team requests records, interviews, and sampling access, usually within days of the kick-off meeting. The business line keeps operating while producing evidence on demand, which is why the internal contact named at the start matters more than the audit plan itself.
Findings are rated by severity, not by volume. A single high-rated gap in transaction monitoring outweighs a dozen low-rated formatting issues in a policy document. A high or critical rating triggers a fixed remediation deadline and a follow-up test at a set date. A low rating is noted and tracked at the next cycle, without an immediate deadline attached to it.
Nothing in this process is optional once the mandate exists. A team that stalls on document requests extends its own remediation window later, because the clock for closing a finding starts only once the finding is confirmed in writing, not when the problem was first noticed.
What the audit actually samples
Fieldwork rarely reviews every file. It samples a set of client due diligence records, a set of transaction monitoring alerts that were closed without escalation, sanctions screening logs, and training records for staff in customer-facing roles. The sample size grows with the volume of activity and with how many gaps the previous cycle left open.
A recurring pattern in these samples is a control that exists on paper but is not followed in practice. That gap is rated higher than a missing document, because it points to a design problem rather than an isolated slip.
Stages, in order
| Stage | Typical duration | What it produces |
|---|---|---|
| Scoping and mandate | 1–2 weeks | Written scope, sample criteria, access list |
| Fieldwork | 2–5 weeks | Interview notes, sample testing, control walkthroughs |
| Draft findings | 1–2 weeks | Rated findings shared for management response |
| Management response | 1–3 weeks | Root cause, owner, and remediation date per finding |
| Sign-off | 1 meeting cycle | Final report accepted by the decision-making body |
Duration depends on how many business lines sit in scope and on how many prior findings remain open. An open backlog slows the management-response stage, not fieldwork, because each open item needs its own root-cause note before the file can close.
What to do before fieldwork starts
- Compliance officer assembles the control inventory and maps it to the agreed audit scope.
- Risk owner confirms which prior findings remain open and attaches evidence of partial remediation.
- Data or IT team prepares extract logic for sampling, agreed with the audit lead in advance.
- Senior management names one internal contact who owns every document request end to end.
- The board or its risk committee confirms the sign-off date before fieldwork begins, not after.
Who decides, and by when
The audit team does not decide whether a finding is acceptable. That decision sits with senior management, or with the board for high-rated findings. The usual forum is a standing risk or audit committee meeting, not an ad hoc call between two managers.
Once a finding is confirmed in writing, its remediation deadline becomes the point of no return. Missing that date without a documented extension turns a control gap into a governance failure. That failure has a different owner and a different conversation than the original finding did.
Escalation follows a fixed path. The named internal contact reports first to the risk owner, then to senior management, and only then to the board if the deadline is missed twice in a row.
Common branches
If the audit finds a licence application still pending with the regulator, the two timelines run in parallel and each one adds pressure to the other. A related situation, on handling a regulator's deficiency letter, is set out here: The application file is returned with questions authorisation the.
If a vendor inside the audit scope pushes back with a contract change, treat that as a separate negotiation track. Do not fold it into the audit timeline. One frequent version of this is covered here: When a customer demands unlimited liability.
If the same team runs audits across more than one entity, keep one master finding log per entity. Merging logs across entities is the most common cause of a missed remediation date.
If two audits land in the same quarter, from an external supervisor and from internal assurance, align the sample requests first. Duplicated document pulls waste the internal contact's time and slow both files.
What this page does not decide
This page does not cover the tax treatment of royalty payments to a non-resident licensor, even when the audited business also licenses software. That question sits here: When withholding tax hits the royalty flow.
It also does not cover a dispute over intellectual property rights in monitoring tools reviewed during fieldwork. That situation, and who decides it, is set out here: When the other side files revocation first.
The page does not fix the exact severity thresholds a given control framework uses. Those thresholds come from the framework the entity has adopted, not from this description of the process. Nor does it set training-programme content, which is a separate policy decision for the compliance function.
Verified
This description reflects internal audit and remediation practice used across compliance functions at digital asset businesses. It is reviewed on a rolling basis as supervisory expectations and audit methodology change, and it does not depend on any single dated source.
Related publications
A closely related process, where the compliance function itself is delegated rather than audited, is covered step by step here: Outsourcing of compliance functions step by step.
Cost factors and response time
The cost of preparing for and supporting an independent audit depends on the number of registers and jurisdictions in scope, on whether a remediation deadline is already running, and on whether a regulator or counterparty is actively involved. These factors, not a fixed rate, set the estimate for any given file.
A partner replies within minutes during business hours. A written cost estimate follows within one working day.
Frequently asked questions
How long does an independent audit of controls take in practice?
Most files run eight to twelve weeks from mandate to sign-off. A file with open findings from the previous cycle usually runs longer, mainly at the management-response stage, since each open item needs its own root-cause note before sign-off.
Which documents are needed to start?
The audit team needs the current control inventory, the policy set it maps to, the log of prior findings with their status, and named access to the systems used for sampling and evidence retrieval.
What happens if the audited team does not respond?
Silence does not stop the clock. The audit team escalates first to the named internal contact and, after a set number of reminders, to senior management directly, which usually shortens the delay considerably.