Finding positives in AML audits

An independent anti-money laundering (AML) audit may help solicitors’ firms streamline and improve their processes and can also help avoid professional indemnity claims, not only those arising from fraud. It should not just be about tick-box compliance; this can be an area where solicitors with practical case-handling experience of dealing with ‘real clients’ can help. If they are practising solicitors, it may also enable the firm to withhold legal advice on account of legal professional privilege.

But there are of course also regulatory compliance reasons why firms have an audit when it is ‘appropriate to the size and nature of the business’ for the purposes of regulation 21 of The Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017, in order to avoid problems with the Solicitors Regulation Authority.

In this Keynote, Partners Frank Maher and Sue Mawdsley look at some of the points an audit will cover.

What firms commonly overlook

One of the most common weaknesses is the gap between what a firm’s AML documentation says should happen and what takes place on individual matters.

A firm may have a detailed AML policy, a comprehensive firm-wide risk assessment, and sophisticated onboarding systems. None of these necessarily demonstrates that AML risk is being managed effectively.

The real test is whether fee earners understand their responsibilities and are applying the firm’s procedures consistently.

This can expose deceptively simple problems. Is the client and matter risk assessment completed properly, or simply treated as another onboarding form? Is the rationale for a risk rating recorded? Where enhanced due diligence is required, is it actually undertaken and evidenced? Are source of funds and source of wealth considered critically with a documented analysis rather than merely noted in a tick box as having been considered? Are the ongoing monitoring procedures applied effectively and when required?

The SRA has identified precisely this sort of disconnect. In work covering the AML policies, controls, and procedures of 2,241 firms over three years, it highlighted weaknesses including generic policies, outdated references, and firms having procedures without controls capable of assessing whether those procedures were actually being followed.

That last point matters. A procedure tells someone what to do; a control helps the firm establish whether they have done it.

What should an independent AML audit actually test?

A robust independent audit should therefore go considerably further than reviewing a firm’s AML manual.

It should examine the complete framework, starting with the firm’s risk assessment and whether the firm’s policies, controls, and procedures respond appropriately to the risks identified.

It should then test implementation.

That will include sampling matters across different departments and risk profiles, assessing client and matter risk assessments, customer due diligence, beneficial ownership enquiries, enhanced due diligence, source of funds and source of wealth work, ongoing monitoring, and the treatment of politically exposed persons and sanctions risks.

Training should also be considered. Attendance records can show that training took place, but they do not necessarily demonstrate that employees understand how to apply the firm’s procedures. Interviews and file testing can provide a much clearer indication of whether training has translated into practice.

Similarly, an audit should look at governance. Findings from previous file reviews or audits should be tracked through to remediation, with responsibility for action clearly allocated.

Independent AML audits commonly combine review of risk assessments, policies, and procedures with interviews with key personnel and file reviews designed to establish whether the firm’s controls are actually being followed.

Policies versus practice

This distinction between design and effectiveness is central to a meaningful AML audit.

Imagine that a firm’s procedure says all high-risk matters require enhanced due diligence and approval before work begins.

A policy review can establish that the requirement exists and that it appears appropriate.

An effectiveness test asks very different questions:

• Were high-risk matters correctly identified?
• Was enhanced due diligence actually undertaken?
• Was the evidence proportionate to the risk?
• Was the required approval obtained at the appropriate stage?
• Can the firm demonstrate each step from its records?

The same principle applies to ongoing monitoring. It is relatively easy to state in a policy that matters will be monitored throughout the client relationship. An auditor should test a sample of longer-running matters to determine whether changes in risk were recognised, considered, and documented.

That is the difference between asking, “Do we have a process?” and “Can we prove our process works?”

The latter is increasingly the more valuable question. The SRA’s October 2026 guidance, Anti-money laundering policies, controls and procedures, specifically encourages firms to test what happens in practice using recorded AML file reviews rather than relying on informal oversight.

Lessons from larger firms

Larger and more complex firms demonstrate another important principle: AML arrangements need to work consistently across different practice areas, offices, teams, and types of client, and where there are overseas offices, address the differences and any weaknesses in different regulatory requirements.

As complexity increases, informal oversight becomes harder to rely upon. A central compliance team may establish the framework, but effective AML compliance ultimately depends on the lawyers and staff applying that framework to individual matters.

The strongest approach is therefore one in which assurance is continuous rather than concentrated around an audit date. Regular risk-based file reviews, management information, documented escalation routes, and follow-up of previous findings can help identify inconsistencies before they develop into more significant issues.

Technology can support that process, but it cannot replace professional judgement. Electronic verification, sanctions screening, and workflow controls may provide valuable safeguards, but the firm’s systems still need appropriate human oversight and escalation.

Preparing for regulatory scrutiny

The best way to prepare for an independent audit, or regulatory scrutiny, is not to conduct a last-minute clean-up which in any event will not necessarily avoid regulatory action for past breaches.

Instead, firms should be able to demonstrate a clear and continuous compliance cycle:

• identify risk,
• establish appropriate controls,
• implement them,
• monitor how they operate,
• test their effectiveness, and
• address weaknesses.

Ahead of an audit, firms should consider whether their firm-wide risk assessment remains current, whether their policies reflect the firm’s actual practices and systems, whether staff can explain their responsibilities, and whether file records demonstrate the decisions that have been made.

Previous findings are particularly important. Identifying a weakness is not necessarily the greatest concern; failing to address a known weakness can be much harder to explain.

Would your procedures withstand testing?

An independent AML audit should not be viewed simply as another compliance exercise. Done properly, it provides an opportunity to test the firm’s AML framework before weaknesses become regulatory problems.

A beautifully written policy provides limited protection if nobody follows it. Similarly, a sophisticated onboarding system cannot compensate for risk assessments completed without meaningful thought or due diligence that is never revisited.

The firms best prepared for scrutiny will be those that can demonstrate not only what their AML procedures require, but that those procedures operate effectively in everyday practice.

That is ultimately what a meaningful independent AML audit should establish. But as noted in the opening, it can also deliver real benefit to the business.

If you have questions or concerns about AML audits, please contact Frank Maher and Sue Mawdsley. Frank and Sue provide independent AML audits for leading UK and US law firms.