Risk and Scope Planning

An AML assessment begins with a business unit and a question the team can test. The AML Program Manager names the subject, records the operating period and explains which controls fall within scope. The assessment owner can then show the Independent Reviewer why the planned samples address the stated risks. A broad subject such as payment operations needs a scope statement that identifies the work being examined.

Keep the business-unit identity consistent across the risk register and the assessment. A renamed department should retain its code and organization. This makes it possible to follow a control back to the risk it addresses without relying on similar names or a reviewer remembering last quarter’s arrangement.

• Risk context. Record the likelihood and impact with the scale version used to interpret them. The AML Program Manager explains the assessment basis before comparing scores. A change in scale needs an explicit review of how earlier and current assessments will be discussed.
• Control ownership. Link each control to its risk, identify the owner and record when it becomes effective. Draft, Active and Retired describe different operating conditions. The Control Tester needs to know which control was relevant to the period under examination.
• Assessment scope. Set the planned testing, period and revision together. The Independent Reviewer reviews that package before the assessment moves from Draft to Planned. An amended scope needs a review against the revised information.

Agree on business-unit codes, risk scales and the meaning of an assessment period. Decide who prepares scope and who independently approves it. The same person should not prepare the assessment and supply its independent approval. Set the relationship between a signed-in user and their team-member record before using personal work queues.

Choose a recognizable assessment numbering convention. Explain how evidence will identify the relevant assessment and control. Confirm how the team will handle an unresolved period end before submitting work that depends on a complete business period.

Use a pilot assessment of a business unit’s alert escalation control. The AML Program Manager links the control to a documented risk and describes the sample plan. The Independent Reviewer returns the first draft because the period is unclear. The manager corrects the scope and submits the revised package for a fresh decision.

The rehearsal succeeds when the reviewer can identify the exact revision being approved and the Control Tester can explain what evidence to gather. Retain the returned decision and its reason alongside the later approval. A changed plan should remain understandable to someone who was absent from the review meeting.

• Risk Register — Review business-unit risks with their scale version and accountable owner.
• Assessment Calendar — Compare planned assessment periods and ownership before testing starts.
• Active Controls — Find the controls available for the agreed assessment work.

Continue with scope approval and evidence-based testing.