Before commissioning an independent AML audit, a law firm should establish what the reviewer will examine, how independence will be maintained and what the firm will receive afterwards.
An attractive quotation tells you little if it does not explain whether the work includes client files, staff discussions, assessment of the firm’s controls and follow-up of recommendations.
The audit should give management a supported assessment of the arrangements examined, with clear findings and practical recommendations. Its scope and limitations should be understood before the work begins.
Start with the firm’s audit requirement
Regulation 21 of the Money Laundering Regulations 2017 requires an independent audit function where appropriate having regard to the size and nature of the business.
The function includes evaluating the adequacy and effectiveness of AML policies, controls and procedures, making recommendations and monitoring compliance with those recommendations.
This is a qualified requirement. It should not be described as a universal obligation for every law firm to purchase an annual external audit. A firm undertaking work within the regulations should assess its position and record the reasoning behind its arrangements.
For the separate question of timing, read how often a law firm should conduct an independent AML audit.
Check independence and relevant competence
“Independent” does not necessarily mean external. The SRA’s AML questions and answers explain that an audit can be undertaken internally, provided the necessary independence exists.
The practical question is whether the reviewer can objectively examine the arrangements concerned. Someone responsible for operating a control should not simply mark their own work as independently audited.
Before appointing a reviewer, ask:
- What experience do they have of AML controls in legal practice?
- Do they understand the work types and funding arrangements your firm handles?
- Have they designed, operated or made decisions within the arrangements they will review?
- How will any conflict or risk of self-review be addressed?
- Will findings reach the appropriate senior decision-makers?
A familiar adviser may understand the firm well. Their previous involvement still needs consideration when defining an independent review.
Agree a written scope
The engagement should identify the parts of the practice, period and controls to be examined. It should also explain exclusions and any work the firm must undertake before the review.
Depending on the practice and agreed scope, relevant areas may include:
- the firm-wide risk assessment and how it informs the controls adopted;
- documented AML policies, controls and procedures;
- client and matter risk assessments;
- identification, verification and beneficial ownership;
- source-of-funds work and source-of-wealth enquiries where relevant;
- enhanced due diligence and ongoing monitoring;
- training, supervision and escalation arrangements; and
- the response to previous findings and recommendations.
If the firm needs a particular concern examined, say so at the outset. A review prompted by recurring funding discrepancies may need a different emphasis from one following a merger, a system change or an adverse regulatory finding.
Confirm how implementation will be tested
A review of written policies establishes what the firm says should happen. Client files and discussions with staff help establish what happens in practice.
The SRA’s 2024–25 AML annual report identified independent audits that were inadequate because they did not include file reviews.
Ask how files will be selected, what information the reviewer needs and how the sample relates to the firm’s risks. A sample made up entirely of straightforward, well-documented matters may leave important questions unanswered.
Our separate article on what independent AML file testing should reveal in a conveyancing practice examines that work in more detail.
Agree access and confidentiality arrangements
Establish how the reviewer will receive documents, access sampled files and speak with relevant staff. Agree secure transfer arrangements, access permissions and the treatment of sensitive material.
Confidentiality, legal professional privilege and restrictions affecting particular records require consideration before access is granted. Do not assume that every item on a client file can be circulated without assessment.
For remote or on-site work, identify a contact who can locate records and answer procedural questions. The method should give the reviewer sufficient access to perform the agreed work.
Know what the report will contain
A useful report should explain the work undertaken, the evidence examined and any material limitations. Findings should be sufficiently specific for management to understand the issue and decide what action is needed.
Before instructing, clarify whether the deliverables include:
- a written report identifying findings and recommendations;
- an explanation of priorities and matters requiring prompt attention;
- a discussion of the findings with management;
- an opportunity to correct factual inaccuracies; and
- arrangements for reviewing implementation.
An audit report reflects the scope, sample and information available. It cannot guarantee that every weakness has been identified or that the firm will avoid regulatory action.
A certificate, if offered, should not be treated as blanket confirmation that every file or aspect of the firm is compliant.
Separate audit findings from remedial work
The quotation should explain whether updating documents, training staff, reviewing further files or checking completed actions is included.
Those tasks can require substantial work. Agreeing the boundary early helps the firm budget and prevents recommendations being mistaken for a commitment that the auditor will implement them.
Where the firm needs document support, Lexsure’s AML policies and procedures provide material to consider and adapt. Purchasing wording does not establish that the resulting procedure is suitable or operating effectively.
Decide who will act on the recommendations
Allocate responsibility for each agreed action, set an appropriate deadline and identify the evidence needed to demonstrate completion.
Distinguish immediate safeguards for affected matters from longer-term changes to procedures or systems. Record how implementation will be monitored and who will review unresolved findings.
Our guide to following through a conveyancing compliance plan explains how to connect findings, actions and evidence.
If an SRA request has already arrived, the firm must respond within the applicable timetable. Commissioning an audit does not suspend that deadline or replace any separate reporting obligation. Our guide to the evidence needed for an SRA AML review provides practical preparation points.
Discuss an independent AML audit for your firm
Lexsure provides independent AML audits for law firms, reviewing risk assessments, policies, controls and implementation within an agreed scope.
Explain your firm’s work, previous findings and particular concerns so that the proposed review, deliverables and follow-up arrangements can be discussed before you instruct.