Staying Audit Ready Between Reviews

When AUSTRAC, an auditor or your board asks “show me,” the firms that cope are the ones that captured the evidence as they went, not the ones reconstructing it under pressure.

What you may be asked to produce

A reporting entity should be able to demonstrate, on request, that it identified and verified its customers, assessed and managed risk, monitored activity, reported what it was required to report, and kept its program current. Each of those claims needs supporting evidence.

Keep the right records for seven years

The Act requires records to be retained for at least seven years. In practice that means keeping:

• Customer identification and verification records;
• Transaction records and the basis for any reports lodged;
• Your AML/CTF Program and each version of your risk assessment; and
• Decisions and their rationale, including risk ratings, overrides, and alert outcomes.

Make your audit trail immutable

An audit trail is only as good as its integrity. Records that can be edited without trace are hard to defend. A tamper evident log that captures who did what, when and why, and cannot be silently altered, turns your day to day activity into ready made evidence.

Submit to independent review

Your AML/CTF Program must be subject to regular independent review to test whether it is effective and being followed in practice. Treat findings as a roadmap: track remediation, record the outcome, and feed lessons back into the program.

Lodge your annual compliance report

Reporting entities lodge an annual compliance report with AUSTRAC. Maintaining your records continuously means the information needed for that report, and for any examination, is already at hand.

Embed it in business as usual

The most resilient firms do not run a separate “compliance file.” They capture identification, screening, monitoring and decisions inside the same workflow staff use every day, so the evidence accumulates automatically.