Identify the failed control
An AML control failure occurs when a measure intended to manage risk or meet a duty does not work as intended.
A missing review, an incorrect setting or an unperformed procedure can each require action. The facts determine whether a legal duty was also breached.
The Act requires the reporting entity to comply with its AML/CTF policies. Correcting a failure does not erase an earlier failure to meet a duty.
Source: Australian Government, Federal Register of Legislation: 26F and 26G.
Apply the relevant duties
The governing body must maintain ongoing oversight of the risk assessment and compliance. It must take reasonable steps to ensure appropriate risk management and compliance.
For services through an Australian permanent establishment, AML/CTF policies must deal with the response to an independent evaluation report.
Adverse findings trigger the specified risk assessment review or policy review requirements, according to the subject of the finding.
These requirements do not make every internal defect an independent evaluation finding. Examine the source of the finding and the applicable duties.
Sources: Australian Government, Federal Register of Legislation: 26H; Australian Government, Federal Register of Legislation: 5-1, 5-4 and 5-10.
Record a response and an owner
A practical response can start with a record of the failed measure, affected work and immediate action needed.
Assign a person to investigate the cause and complete the correction. Record the evidence, required decisions and target date.
Examine whether the correction works before closing the action. These steps are an illustrative process; apply any specific legal duties and the business’s policies.
Source: Australian Government, Federal Register of Legislation: 26G and 26H.
Example: a review queue stops working
In a fictional business, a software change stops cases from entering a customer review queue. Staff find the error during routine work.
The manager identifies affected cases, assigns their review and restores the queue. The business also examines whether a separate legal duty was missed.
The manager uses test cases to confirm the correction and records the result. A working queue alone does not resolve the affected cases.
Source: Australian Government, Federal Register of Legislation: 26G and 26H.
- Failure found
A software change prevents cases from entering a review queue.
- Response
Restore the queue and assign review of affected cases.
- Evidence
Test the correction and examine whether a legal duty was missed.
Correct the control and address affected work
Fictional example. Repairing the queue does not resolve every affected case or erase an earlier failure to meet a duty.
Follow the process from top to bottom.