An AML/CFT programme can be extensively documented and still fail to identify or manage meaningful exposure. Independent testing should therefore answer a harder question than whether policies exist: are controls operating consistently, producing useful risk signals and leading to defensible decisions?
A risk-based review connects governance, customer-risk assessment, KYC/CDD, screening, transaction monitoring, investigations and regulatory reporting. Sampling should follow risk pathways and include both successful and failed control outcomes.
The most useful report distinguishes isolated errors from systemic design issues. It also gives management a prioritised remediation path grounded in exposure, dependencies and realistic implementation capacity.