Independent testing, including the frequency, should be commensurate with the ML/TF and other illicit financial activity risk profile of the bank and the bankвЂ™s overall risk management strategy. There is no regulatory requirement establishing BSA/AML independent testing frequency. For detailed information on collaborative arrangements see вЂњ Interagency Statement on Sharing Bank Secrecy Act Resources,вЂќ issued by Federal Reserve, FDIC, FinCEN, NCUA, and OCC, October 3, 2018. Banks with a community focus, less complex operations, and lower-risk profiles for ML/TF and other illicit financial activities may consider utilizing a shared resource as part of a collaborative arrangement to conduct independent testing. Regardless of who performs the independent testing, the party conducting the BSA/AML independent testing should report directly to the board of directors or to a designated board committee comprised primarily, or completely, of outside directors. Banks engaging outside auditors or consultants should ensure that the persons conducting the BSA/AML independent testing are not involved in other BSA-related functions at the bank that may present a conflict of interest or lack of independence, such as training or developing policies and procedures. 12 CFR 208.63(c)(2) (Federal Reserve) 12 CFR 326.8(c)(2) (FDIC) 12 CFR 748.2(c)2) (NCUA) 12 CFR 21.21(d)(2) (OCC)Д«anks that do not employ outside auditors or consultants or do not have internal audit departments may comply with this requirement by using qualified bank staff who are not involved in the function being tested. Independent testing should be conducted by the internal audit department, outside auditors, consultants, or other qualified independent parties. The purpose of independent testing (audit) is to assess the bankвЂ™s compliance with BSA regulatory requirements, relative to its risk profile, and assess the overall adequacy of the BSA/AML compliance program. Objective: Assess the adequacy of the bankвЂ™s independent testing program.

Internal audit requirements for banks