Compliance Associate Test

Best Practice:
Financial institutions should establish an expected transaction profile for each customer and investigate transactions that significantly deviate from that profile.

Scenario:
A sole trader was onboarded with an expected monthly turnover of ₦3,000,000. In one month, the customer recorded transactions totalling ₦45,000,000. No alert was generated because the customer completed KYC at onboarding.

Best Practice:
Organisations must clearly inform data subjects of the purpose and legal basis for processing their personal data through a privacy notice.

Scenario:
A company collects biometric data from employees for access control but its privacy notice does not mention biometric data or its purpose.

Best Practice:
Policies should not only be approved by management but also communicated and embedded into daily operations through training and awareness.

Scenario:
An organisation has an approved AML policy, but staff interviewed during the audit are unaware of its existence or procedures.

Best Practice:
Customer risk profiling should be documented, approved, and periodically reviewed to ensure appropriate monitoring.

Scenario:
An institution identifies high-risk customers but cannot produce documentation showing how risk ratings were assigned.

Best Practice:
Politically Exposed Persons (PEPs) require enhanced due diligence due to their increased exposure to corruption and financial crime risks.

Scenario:
A customer is identified as a PEP but is assigned a “medium risk” rating with no justification.

Best Practice:
Where personal data is shared with vendors, organisations must conduct vendor due diligence and execute a Data Processing Agreement (DPA).

Scenario:
A company shares customer data with a payroll vendor but has no DPA or vendor risk assessment on file.

Best Practice:
AML compliance requires continuous monitoring of customer activity, not just checks at onboarding.

Scenario:
A company performs KYC only at customer onboarding and does not review customer profiles afterward.

Best Practice:
Audit conclusions should be supported by reliable, verifiable, and independent evidence.

Scenario:
An auditor is provided with verbal assurance from staff that controls are in place, but no documentation or system evidence is available.

Best Practice:
Structuring transactions to avoid reporting thresholds is a known AML red flag.

Scenario:
A customer consistently makes cash deposits just below the regulatory reporting threshold.

Best Practice:
A Data Protection Impact Assessment (DPIA) should be conducted for processing activities that pose high risks to data subjects.

Scenario:
An organisation deploys facial recognition technology without conducting a DPIA.

Best Practice:
Controls should be documented to enable accountability, monitoring, and auditability.

Scenario:
Management claims a control exists, but there is no documentation or evidence to support this.

Best Practice:
Auditors are expected to document findings clearly, assess and communicate risk using a risk-based approach, and recommend corrective actions that are practical, proportionate, and aligned with regulatory expectations. Even minor gaps should be evaluated for their potential impact if they recur or escalate.

Scenario:
During a compliance audit of an organisation’s AML and data protection controls, you identify the following issue:

• Periodic compliance reviews are required to be documented and approved by management.
• In practice, the reviews are conducted, but documentation is often completed late or not completed at all.
• This issue has been observed in three consecutive review periods.
• Management acknowledges the gap but considers it “minor” because no regulatory breach or enforcement action has occurred.

You are required to include this observation in the audit report.

Task:
Using the information above, explain how you would approach the following as a trainee auditor:

1. Documenting the Finding
   • What key details would you include in the audit finding to ensure it is clear, factual, and defensible?
2. Communicating the Associated Risk
   • How would you explain the risk of this recurring gap to management in a way that goes beyond “policy non-compliance”?
3. Recommending Corrective Action
   • What type of corrective action would you recommend to address the root cause of the issue and prevent recurrence?