ACAMS Advanced CAMS — Audit

Which framework is most commonly referenced as the authoritative standard for internal audit practice globally, including AML audits?

• ACOSO Internal Control-Integrated Framework
• BIIA International Professional Practices Framework (IPPF)
• CFFIEC BSA/AML Examination Manual
• DFATF 40 Recommendations

What is the primary purpose of a risk-based AML audit approach?

• ATo audit every transaction individually
• BTo focus audit resources on areas of highest money laundering risk
• CTo replace the need for a compliance program
• DTo eliminate the need for regulatory examinations

Which U.S. regulatory manual is the primary reference for AML examination procedures for banks and is frequently cited by AML auditors?

• ASEC Enforcement Manual
• BFFIEC BSA/AML Examination Manual
• COCC Comptroller's Handbook on Derivatives
• DFINRA Rule 3310 Manual

What does the acronym 'COSO ERM' stand for, and why is it relevant to AML audits?

• ACommittee of Sponsoring Organizations Enterprise Risk Management — provides a framework f…
• BCompliance Operations and Supervisory Oversight Enterprise Risk Management — a sanctions-…
• CCorporate Oversight and Standards Organization Enterprise Risk Manual — an ACAMS-issued d…
• DConsolidated Overseas Supervisory Organization Enterprise Risk Matrix — a FATF tool

Under the BSA, which of the following is NOT one of the required pillars of an AML program?

• ADesignation of a BSA/AML Compliance Officer
• BIndependent testing
• CWritten policies, procedures, and internal controls
• DMandatory external criminal background checks on all customers

An auditor reviews the institution's enterprise-wide AML risk assessment. Which of the following is the MOST significant red flag?

• AThe risk assessment is refreshed annually
• BIt covers all products, services, customers, and geographies
• CIt was last updated 4 years ago and does not reflect new virtual-asset products the bank…
• DIt uses a 5-point risk-rating scale

What are the four minimum pieces of identifying information a U.S. bank must collect from a customer under the Customer Identification Program (CIP) rule?

• AName, date of birth, address, and identification number (e.g., SSN or ITIN)
• BName, employer, annual income, and account purpose
• CName, phone number, email, and photo ID
• DName, occupation, net worth, and source of wealth

Under FinCEN's CDD Rule, a legal entity customer opening an account must identify beneficial owners owning at least what percentage of equity?

• A10%
• B15%
• C25%
• D50%

When testing the transaction monitoring system, an auditor notices the bank has not tuned alert scenarios in 5 years despite significant business growth. Which audit finding category is MOST appropriate?

• ALow-severity administrative finding
• BModel risk management (SR 11-7) deficiency
• CTraining deficiency
• DCustomer identification gap

What is the primary regulatory purpose of an independent AML testing review?

• ATo replace the BSA Officer role
• BTo provide an unbiased assessment of AML program adequacy and compliance with regulatory…
• CTo train staff on new AML rules
• DTo approve new products for launch

Which sampling methodology selects items such that every item has an equal probability of being chosen?

• AJudgmental sampling
• BStratified sampling
• CRandom (simple random) sampling
• DBlock sampling

An auditor wants to test whether SARs are filed within 30 days of the bank's determination of suspicious activity. Which sampling approach is BEST?

• AAttribute sampling — testing a yes/no compliance attribute across a statistically valid s…
• BVariable sampling — estimating a dollar-value population
• CJudgmental sampling — selecting only the largest SARs
• DBlock sampling — reviewing all SARs filed in one month

Stratified sampling is MOST useful when:

• AThe population is homogeneous
• BThe auditor has no population data
• CThe population contains distinct subgroups with different risk profiles (e.g., high-risk…
• DThe entire population must be examined

Judgmental (non-statistical) sampling is appropriate when:

• AThe auditor wants to extrapolate the results to the whole population with a confidence le…
• BThe auditor wants to target specific high-risk items based on knowledge and experience
• CRegulatory rules mandate 100% coverage
• DThe population is fully homogeneous

Under the IIA IPPF, audit evidence must be 'sufficient and appropriate.' 'Sufficient' primarily refers to:

• AThe relevance of the evidence to the audit objective
• BThe quantity of evidence obtained
• CThe reliability of the source
• DThe cost-effectiveness of gathering the evidence

Audit working papers should:

• ABe destroyed immediately after the audit report is issued
• BDocument the procedures performed, evidence obtained, and conclusions reached sufficient…
• CBe provided directly to external parties without review
• DBe kept only as handwritten notes

Which of the following is considered the MOST reliable source of audit evidence?

• AManagement's verbal assurances
• BIndependently obtained, original documents from third parties (e.g., bank confirmations)
• CPhotocopies provided by the audited business unit
• DInternal management presentations

Root cause analysis (RCA) in an AML audit finding is performed to:

• ADetermine who to discipline for the finding
• BIdentify the underlying systemic or control cause so corrective action addresses the sour…
• CEliminate the need for management response
• DReduce the severity rating of the finding

A common severity-rating approach for audit findings ranks issues by:

• AManagement's preference
• BLikelihood and impact (including regulatory, financial, reputational, and operational)
• CAge of the auditor
• DLength of the finding narrative

Which audit report element is typically required by IIA IPPF and external stakeholders?

• AOnly the scope
• BScope, objectives, methodology, findings, and conclusions/opinion
• COnly management's response
• DOnly the raw data from sampling

A 'Matter Requiring Attention' (MRA) in a regulatory examination report generally signifies:

• AAn informational note with no expected action
• BA deficiency that, if not addressed, may result in a more severe enforcement action
• CA public enforcement action
• DA permanent prohibition from banking

Which U.S. regulator primarily examines national banks for BSA/AML compliance?

• AFDIC
• BOCC
• CNCUA
• DSEC

Under which U.S. statute does FinCEN derive its BSA enforcement authority?

• ASarbanes-Oxley Act (SOX)
• BGramm-Leach-Bliley Act (GLBA)
• CBank Secrecy Act (BSA) / USA PATRIOT Act / AML Act of 2020
• DFDIC Improvement Act

The FATF 40 Recommendations serve as:

• AMandatory U.S. federal law directly enforceable by FinCEN
• BThe international standard for AML/CFT that countries implement through their own laws
• CA private-sector best practice with no governmental recognition
• DAn ACAMS membership requirement

OFAC sanctions screening is a required component that the AML auditor should test. Which statement about OFAC screening is MOST accurate?

• AOFAC screening is required only for new customers
• BScreening must cover customers and transactions against updated sanctions lists (SDN, sec…
• COFAC enforcement is handled by FinCEN
• DOnly international wires must be screened

The USA PATRIOT Act Section 314(a) allows:

• ALaw enforcement to share information with U.S. financial institutions to locate accounts/…
• BFinancial institutions to share customer information freely with any party
• CThe Treasury to freeze any foreign bank account without process
• DBanks to refuse to file SARs

What is the primary scope of SR 11-7 guidance relevant to AML audits?

• AA framework for model risk management — governing model development, implementation, use,…
• BA consumer protection rule
• CA sanctions regulation
• DA mortgage lending rule

An auditor testing the TM system finds that 95% of alerts close as false positives and alert thresholds have never been statistically tuned. What is the MOST likely concern?

• AThe TM system is operating efficiently
• BOver-tuning or ineffective scenarios may produce excess noise and miss true positives — r…
• CNo action needed
• DThe bank should deactivate transaction monitoring

A 'below-the-line' (BTL) test in a TM model validation assesses:

• AThe integrity of the customer's signature card
• BWhether transactions just below the alert threshold contain suspicious activity (and ther…
• CVendor licensing fees
• DThe physical location of a data center

When auditing data governance for AML, a KEY focus area is:

• AThe color scheme of the data dashboard
• BData lineage — the flow and transformations of data from source systems into AML systems
• CThe marketing department's use of data
• DThe employee cafeteria menu

In a correspondent banking relationship, the U.S. bank providing accounts must:

• AConduct EDD on the foreign respondent bank, including assessing its AML controls and owne…
• BExempt the respondent from any monitoring
• CShare customer-level data freely without contract
• DAvoid all record-keeping requirements

A 'shell bank' under U.S. law is:

• AA small community bank
• BA bank with no physical presence in any country and not part of a regulated financial gro…
• CA digital-only bank regulated as a national bank
• DA cryptocurrency exchange

Trade-based money laundering (TBML) red flags the auditor should test monitoring for include:

• AStandardized vendor contracts
• BOver- and under-invoicing, phantom shipments, and multiple invoicing for the same goods
• CCustomers with high FICO scores
• DLow-volume wire activity

Which EU directive introduced centralized beneficial ownership registers across the EU?

• A1st AMLD
• B4th AMLD
• CAMLR Article 3
• DGDPR

Which of the following is a Wolfsberg Group output directly relevant to correspondent banking audit?

• AFATF Mutual Evaluation Report
• BWolfsberg Correspondent Banking Due Diligence Questionnaire (CBDDQ)
• COCC Comptroller's Handbook
• DFFIEC IT Booklet

An auditor reviews SARs and notices narratives are short, vague, and lack the '5 W's + H'. The MOST appropriate classification is:

• AMinor observation
• BModerate/High finding — SAR quality issue creating regulatory and law-enforcement value c…
• CNot an AML audit issue
• DTraining issue only, not a compliance concern

CTR (Currency Transaction Report) filing under the BSA is required when:

• AA cash transaction exceeds $5,000
• BCash transactions by or on behalf of a person exceed $10,000 in a business day (aggregate…
• CAny wire transfer exceeds $3,000
• DA customer opens any new account

Under U.S. BSA regulations, what is the SAR filing deadline after initial detection of suspicious activity?

• A30 calendar days (with a 30-day extension if subject unknown, up to 60 days total)
• B90 calendar days
• C5 business days
• D180 days

Which of the following is the MOST common root cause finding in AML audits?

• AInsufficient risk assessment driving weak risk-based controls
• BExcessive training hours
• COverly aggressive customer onboarding rejections
• DOver-reliance on law enforcement

A Consent Order issued by a federal banking regulator against a bank for AML deficiencies is:

• ANon-public guidance
• BA formal public enforcement action requiring specific remedial actions often with civil m…
• CA request that the bank may ignore
• DA tax audit notice

An audit of AML training should verify that:

• ATraining is a one-time event at hiring only
• BTraining is role-based, updated for regulatory changes, and includes testing/attestation…
• CTraining is optional
• DOnly the BSA Officer attends training

The audit trail for an AML case management system should document:

• AOnly the final disposition
• BEach user action, timestamp, evidence attached, decision rationale, and supervisory appro…
• COnly the transactions involved
• DOnly SAR filings

The 'three lines of defense' governance model places internal AML audit in which line?

• AFirst line (front office/business)
• BSecond line (compliance and risk)
• CThird line (independent assurance)
• DFourth line (external regulator)

An effective audit follow-up protocol should:

• AClose findings when management verbally agrees to remediate
• BRequire documented evidence of completed remediation, independently validated by audit be…
• CAllow management to self-close findings
• DSkip testing and rely on management certifications

Which of the following is the BEST evidence of independent AML testing quality?

• AThe auditor sits in the compliance department and reports to the BSA Officer
• BAudit reports directly to the Audit Committee and is not in the reporting line of the fun…
• CAudit shares staff with compliance during peak periods
• DThe audit function is outsourced to the bank's loan review department

An auditor discovers the bank is processing wires for a customer whose account has been flagged repeatedly for structuring but has never had a SAR filed. This is MOST likely:

• AA minor documentation issue
• BA significant SAR-filing deficiency requiring immediate escalation and likely an adverse…
• CFully compliant
• DA training issue only

Virtual asset service providers (VASPs) under FATF Recommendation 15 must:

• AOperate anonymously
• BApply AML/CFT controls equivalent to traditional financial institutions, including CDD, r…
• CBe exempt from sanctions
• DAvoid transaction monitoring