We offer a comprehensive set of internal control testing solutions to help financial institutions, financial service providers, AML/CFT reporting entities, and other regulated businesses get a better understanding of their controls’ effectiveness and compliance status. This solution includes:
- Control Testing Methodologies Development: Fit for purpose when testing specific controls, aligned with risk appetite, risk management frameworks, residual and inherent risk assessment methodologies, and other evaluation metrics across your business.
- Leading Internal Control Testing: We conduct thorough Compliance Controls Testing to evaluate the design and operational effectiveness of your internal controls. We offer compliance controls testing as either:
- A standalone option
- An integral part of our 2nd line compliance management solutions. Visit our Compliance Management Solutions page for more information
- Compliance Controls Audit: Our Compliance Controls Audit involves a detailed review of your internal compliance systems to ensure they meet the required regulatory standards.
- Visit our Compliance Assurance page for more information
- Visit our AML/CFT Audit page for more information on our specialised anti-money laundering and counter-terrorist financing audits
- Internal Compliance Audit: We focus on providing an independent and confidential review of your organisation’s compliance controls effectiveness, enabling you to:
- Identify and address compliance gaps discreetly
- Focus on specific compliance areas requiring immediate attention
- Internal Controls Assessment: We assess the effectiveness of your organisation’s internal controls, going beyond compliance controls. This service highlights opportunities for improvement, helping you enhance operational efficiency and compliance outcomes.
Internal Controls Assessment
We test internal controls for the following businesses:
Financial Institutions and Regulated Entities
- Investment bankers, investment firms, and fund managers, including MIS (Managed Investment Schemes) and DIMS (Discretionary Investment Management Services)
- Brokers, including forex brokers and derivatives platforms
- Currency exchange providers, e-money issuers, money remitters, and money transmitters
- Non-bank lenders, including consumer credit providers, credit unions, corporate finance providers, building societies, savings and loan associations, and finance companies
- Neo-banks
- Derivatives issuers
- Investment advisers and wealth managers, including financial planning specialists
- Custodians and licensed trustees, including custodial or depository service providers
- P2P lending platforms and crowdfunding services
- Insurance providers, including life and maritime insurance providers
- Online casinos and gambling outlets
- Fintech companies
- Payment gateway providers
Public and Private Organisations
- Publicly listed companies
- Private companies
- Family-owned businesses
- Non-profit organisations
Designated Non-Financial Businesses and Professions (DNFBPs)
- Accountants, lawyers, and auditors regulated under AML/CFT obligations
- Real estate businesses
- Trust and company service providers (TCSPs)
Internal Control Testing Areas
The following list is not exhaustive. Our services cover testing internal controls in the following key areas:
- Operational Oversight Controls Testing:
Testing controls for corporate governance, outsourcing provider compliance, operational risk management, incident escalation, business continuity planning, and operational resilience. - Market Integrity & Transparency Controls Testing:
- Market Conduct Controls: Testing controls designed to regulate advertisement, marketing, and overall market conduct to uphold market integrity.
- Fair Dealing and Disclosure Standards: Testing controls covering product suitability, onboarding due diligence, and client asset protection.
- Resource Management Controls Testing:
Testing controls related to the professional competence of staff, representatives, senior management, and adequacy of organisational resources. - Regulatory Reporting Controls Testing:
- Regulatory and Financial Reporting: Testing controls to ensure adherence to all aspects of regulatory and financial reporting.
- Record-Keeping, Information Security, and Transactional Reporting: Testing controls for documentation, record-keeping, and compliance with internal and external reporting obligations.
- Product and Service Management Controls Testing: Testing controls for product suitability, lifecycle management, customer onboarding (including KYC and KYB controls) and compliance with data protection and privacy laws.
- AI-Operated Controls Testing: Assessing the effectiveness of AI-operated control activities to ensure they deliver a robust control environment.
- Compliance with Emerging Regulations: Testing controls to ensure compliance with new and evolving regulations, such as GDPR and digital payment rules.
- Sustainability and ESG Compliance Testing: Assessing adherence to Environmental, Social, and Governance (ESG) criteria to meet current and forthcoming sustainability compliance standards.
Internal Controls Testing
Our focus areas include, but are not limited to, testing compliance controls to comply with:
- AML/CTF controls
- Fraud controls
- Sanctions-related controls
- Corporate governance controls
- Data privacy controls
- Banking and reconciliation controls
- Risk management requirements under financial licensing regimes and license conditions
- Financial market conduct-related controls
- Resource management risks
- Operational controls, including but not limited to controls for:
- Product promotion
- Customer onboarding
- Customer communication
- Transaction monitoring
- Internal communications
- Reporting
- Incident management
- Third-party risk management
- Recordkeeping
- Conflict of interest management
Regional Coverage
Our internal control design solutions are best suited for the following jurisdictions:
Developed Financial Markets
- Australia: Compliance controls designed to meet provisions of:
- AFSL licensing regime
- Corporations Act
- AML/CTF Act 2006
- AUSTRAC guidance
- Australian Prudential Regulation Authority (APRA) standards and codes of practice
- United Kingdom: Compliance controls designed to meet provisions of:
- FCA's authorisation regime
- FSMA 2000
- UK AML/CFT regime covering the Money Laundering, Terrorist Financing and Transfer of Funds (Information Powers) Act 2017, SAMLA 2018, and POCA 2002
- Prudential Regulation Authority's (PRA) rules
- United States: Compliance controls designed to meet provisions of:
- Securities and Exchange Commission (SEC) regulations for securities and markets
- Financial Industry Regulatory Authority (FINRA) oversight of brokerage firms and broker-dealers
- Commodity Futures Trading Commission (CFTC) regulations for derivatives markets
- Consumer Financial Protection Bureau (CFPB) enforcement regime for consumer protection
- National Credit Union Administration (NCUA) regulations for credit unions
- US AML compliance, including the Anti-Money Laundering Act of 2020, Bank Secrecy Act (BSA), and FinCEN guidance
- Singapore: Compliance controls designed to meet provisions of:
- Financial Services and Markets Act 2022
- Capital Markets Services Licence, Payment Institution Licence, Digital Banking Licence, and Finance Company Licence (under the Finance Companies Act)
- MAS AML/CFT guidance, including the CDSA and other relevant laws and regulations
- European Union: Compliance controls designed to meet provisions of:
- European and national financial marketing conduct AML/CFT laws and regulations
- Local financial licensing regimes
- New Zealand: Compliance controls designed to meet provisions of:
- Financial Service Providers Registration (FSP) requirements
- Financial Markets Conduct Act and applicable regulations
- New Zealand financial licensing regime enforced by the FMA NZ
- Anti-Money Laundering and Countering Financing of Terrorism Act 2009, enforced by the DIA, FMA, and RBNZ
Offshore Financial Centres: Compliance controls designed to meet the requirements of compliance regimes in:
- Belize, including:
-
- International Financial Services Commission Act for financial licensing
- Money Laundering and Terrorism (Prevention) Act
- British Virgin Islands, including:
-
- Securities and Investment Business Act (SIBA), administered by the Financial Services Commission (FSC), for financial licensing
- Proceeds of Criminal Conduct Act
- Cayman Islands, including:
-
- Monetary Authority Law and related regulations under the Cayman Islands Monetary Authority (CIMA) for financial licensing
- Proceeds of Crime Act (2020 Revision) and Anti-Money Laundering Regulations (2020 Revision)
- Jersey, including:
-
- Financial Services (Jersey) Law 1998, regulated by the Jersey Financial Services Commission (JFSC), for financial licensing
- Proceeds of Crime (Jersey) Law
- Malta, including:
-
- Financial Institutions Act, overseen by the Malta Financial Services Authority (MFSA), for financial licensing
- Prevention of Money Laundering Act (PMLA)
- Dubai, including:
-
- DIFC Regulatory Law No. 1 of 2004, DFSA Conduct of Business Module (COB), DFSA Prudential Rules, and other applicable laws and regulations
- DIFC and DFSA Standards and Dubai Virtual Assets Regulatory Framework
- Federal Decree-Law No. (20) of 2018 on AML/CFT
- Bermuda, including:
-
- Investment Business Act 2003, under the Bermuda Monetary Authority (BMA), for financial licensing
- Proceeds of Crime Act 1997 and Anti-Terrorism (Financial and Other Measures) Act 2004
- Mauritius, including:
-
- Financial Services Act 2007, administered by the Financial Services Commission (FSC), for financial licensing
- Financial Intelligence and Anti-Money Laundering Act 2002 (FIAMLA)
- Seychelles, including:
-
- Financial Institutions Act 2004, regulated by the Seychelles Financial Services Authority (FSA), for financial licensing
- Anti-Money Laundering and Countering the Financing of Terrorism Act 2020
- Vanuatu, including:
-
- Financial Dealers Licensing Act, regulated by the Vanuatu Financial Services Commission (VFSC), for financial licensing
- Anti-Money Laundering and Counter-Terrorism Financing Act 2014
Controls Testing Outcomes
- Effective reporting: Our internal controls assessment solutions include detailed reporting that pinpoints:
- Control Effectiveness
- Gaps
- Areas of improvement
- Actionable Recommendations
- Concise Format: We present findings in a well-organised and concise format, making it easy to grasp key takeaways and prioritise remediation efforts.
Internal Controls Enhancement
We offer internal controls’ enhancements to increase their overall effectiveness, reflecting on:
- Results of internal controls testing
- Auditors' and regulators' findings, including identified deficiencies and breaches
- Process optimisation for efficiency
- Internally identified areas of improvement and gaps
- New compliance requirements and compliance policy updates
- Business growth and expansion
- Changes in risk ratings, risk appetite, identified new risks, or changes in risk profiles
- Introduction of new products
- Other triggering events. Visit our Controls Design page for further information.
Internal Controls and Regulatory Compliance Technology Integration
Our focus areas for this service include:
- Needs Assessment
- Technology Selection for risk and compliance environment: Tailored to your budget, resources, and compliance obligations
- Implementation and customisation assistance across the business
- Assisting with testing to validate functionality, usability, and integration with operational, risk management, and compliance structures
- Streamlining internal documentation, including policies, procedures, workflows, and process maps, to accommodate the technology selection
Remediation Assurance: Beyond the Fix
External audits and regulatory reviews are one thing. Fixing compliance issues and addressing their findings is another. Post-remediation efforts can leave you wondering: Did my fixes truly address the issues of the previous audit?
Our focus areas for this service include:
- Validation & Monitoring: We assess whether your corrective actions effectively address compliance deficiencies and establish ongoing monitoring to ensure their continued effectiveness.
- Confidence-Building Reports: Receive a comprehensive report confirming remediation status.
- Effective Regulator Communication: We can help you maintain open communication with regulators, demonstrating your commitment to ongoing improvement.
- Further information: Visit our Remediation Solutions page for more information.
