Summary

• The AML/CFT Act requires an independent audit of your risk assessment and compliance programme at least every three years, or when the supervisor requests it
• Your auditor must be suitably qualified and independent of whoever wrote or last updated your programme
• Expect a document request first, then a scoping conversation, then file sampling to test whether practice matches what’s on paper
• Most audits produce findings. What matters is how serious they are and whether they point to a pattern
• The written report goes to senior management and can be requested by DIA. Your remediation feeds into your next programme update
• Choose an auditor with current knowledge of NZ legislation and your industry

New Zealand has been under the AML/CFT Act since 2013 for Phase 1 entities, and 2019 for Phase 2 entities. Many reporting entities will have undergone an audit already, and know what is expected of them. But others are not clear about what happens on the day, or what the auditor is actually looking for.

So here’s what to expect from an AML/CFT audit.

 

Why you’re doing this in the first place

The Act requires an independent audit of your risk assessment and compliance programme at least every three years, or whenever the supervisor advises you otherwise. The objective is to check that what’s written in your Compliance Programme is what occurs in practice, and that your documents are current with recent updates and changes.

 

Who can audit your business?

The auditor has to be suitably qualified, and genuinely independent. That means they can’t be the person who wrote or last updated your risk assessment and/or compliance programme. If your consultant helped build your programme, they can’t be the one signing off on it too, without an intervening update. It’s a separate set of eyes, by design.

Scoping comes first

“Don’t tell me, show me.”

Before anything else, the auditor asks for the paper trail, such as your risk assessment, compliance programme, policies and procedures, training records, and a sample of customer files. They need this to prepare and select samples appropriately.

“Don’t tell me, show me” is the mindset. The documents set the baseline. The scoping conversation that follows – about your business, your customers, your channels, your risk exposure – is where they test whether what’s on paper matches how the business runs.

 

What is looked at

The audit usually covers:

• Whether your risk assessment sufficiently identities the risks that your entity currently faces
• Whether your compliance programme addresses those risks
• Customer Due Diligence (CDD) files, checked against the applicable legislation and guidance, and what your own policies say should happen
• How potential suspicious activity is identified, monitored and reported
• Staff training
• Staff vetting
• How compliance is monitored and managed, such as how assurance review outcomes get properly reported up to senior management or the board

Auditors sample files rather than review every single one. If the sample highlights problems, they’ll pull more files to see how deep the issue runs.

“If it’s not written down, it didn’t happen.”

 

Findings aren’t a verdict

Almost every audit turns something up. That’s normal. What matters is how serious it is, and whether it’s a one-off or a pattern. A missing field on one file is a different conversation to CDD being applied inconsistently across the board.

Your audit report will contain findings with recommendations attached. From there, it’s on you to put together a remediation plan with a timeframe to address any identified deficiencies. Your supervisor may ask to see a copy of your audit report and records of any remediation that has taken place where required.

 

What happens once it’s done

You get a written report. It goes to your senior management, and often the board depending on how your entity is structured. Your supervisor can request a copy too, so this isn’t something to skim and forget.

The remediation work you do afterward also feeds back into your next risk assessment and compliance programme, which is the point. Good practice means treating an AML/CFT audit as part of a cycle of continuous improvement.

 

Why it matters who your auditor is

Not all independent audits look the same. Some are done in person, while others are entirely remote, over email and video call, with some auditors even based in other countries. It’s an option, but it comes with trade-offs worth thinking through.

An auditor based in New Zealand is working under the same legislation day to day, not reviewing it from a distance. They tend to have a closer read on how the supervisor applies the rules in practice, and they’re quicker to pick up on updates as they land.

Being able to sit down with your auditor in person also changes the quality of the conversation. Questions get answered properly instead of sitting in an email thread. Nuance in how your business operates is less likely to get lost. And when findings come back, you can talk them through face to face rather than piecing together a report on your own.

Cost matters, but so does whether the audit actually holds up under scrutiny.

 

Evaluating your auditor

Before you commission your auditor, ask them these questions to see if they’re right for you:

• Do they understand your industry?
• Is their working knowledge of New Zealand’s AML/CFT legislation, rules, and guidance up to date?
• Are they based in New Zealand or a foreign jurisdiction?
• What experience do they have delivering New Zealand AML/CFT audits?

 

Getting it right the first time

It’s important that your independent audit is both done right, and delivers value to your AML/CFT programme. The wrong auditor, or one who isn’t genuinely independent from your compliance programme, can leave you exposed rather than covered.

AML Solutions has delivered over 3,000 audits since 2012 to reporting entities across all industries. If your independent audit is due, book it with a team that knows exactly what to look for.

Get in touch with our team