BSA/AML Independent Audit Preparation Checklist

This checklist covers the core evidence an independent tester typically requests for a BSA/AML audit: scope and readiness, governance documents, transaction monitoring and reporting logs, training records, and the evidence package. It is designed to help you confirm that the audit period, entity scope, and supporting records are organized before testing starts. It does not replace the audit itself; it prepares the materials the tester will review. If your program includes additional lines of business or products, you can extend the checklist to match them.

Use it before every independent BSA/AML audit or annual independent testing cycle, and also after major program changes. That includes new products, new geographies, material changes to transaction monitoring, or a revised risk assessment. Many teams also run it quarterly as a readiness check so missing logs or expired training records are caught early. The goal is to avoid scrambling when the tester requests evidence.

It is usually owned by the BSA/AML compliance lead, with input from operations, investigations, training, and records management. The independent tester should not complete the checklist, because the purpose is to prepare the audit package before testing begins. In smaller organizations, one compliance manager may coordinate the work, but the underlying evidence should still come from the people who maintain the records. If governance is board-level, a committee secretary or compliance officer may also verify the approval trail.

It is aligned to common BSA/AML audit expectations under the Bank Secrecy Act framework, FinCEN guidance, OFAC screening practices, and broader internal control expectations. It also supports the kind of documentation an independent tester expects under a risk-based compliance program. The checklist is not a legal opinion and does not replace counsel or your designated compliance officer. You should tailor it to your institution type, products, and examiner expectations.

Common misses include an outdated risk assessment, incomplete SAR or CTR logs, missing alert disposition evidence, and training records that do not tie back to the audit period. Teams also often forget to retain the independent testing scope and methodology, or they cannot produce board reporting packages on request. Another frequent issue is inconsistent retention, where one department stores evidence differently from another. This checklist helps surface those gaps before the audit starts.

Yes. You can add product-specific items such as correspondent banking, MSB activity, cash-intensive business reviews, or sanctions escalation evidence if those are in scope. You can also add columns for owner, due date, file location, and status so the checklist becomes a working tracker rather than a static list. If your audit request list is already known, map each item to the exact evidence source. That makes it easier to assemble the final binder or shared folder.

Ad hoc gathering usually leaves gaps because different teams respond with different versions of the same record, or they cannot confirm whether the audit period is complete. This checklist creates a repeatable evidence trail so the tester receives the same scope, logs, and approvals every cycle. It also makes open issues visible, which helps management explain remediation status instead of discovering problems during fieldwork. For regulated programs, that consistency is often the difference between a smooth audit and a delayed one.

Yes. The checklist works well as a tracker for a shared drive, evidence binder, or GRC workflow because each section corresponds to a document set the tester will ask for. You can link each line item to a folder path, file name, or ticket number so reviewers can find evidence quickly. If your organization uses workflow approvals, add the approver and completion date fields. The key is to keep the checklist synchronized with the actual evidence repository.