How to Prepare for an AUSTRAC Audit

To prepare for an AUSTRAC audit, identify what the notice requires and assign someone to each response item. Preserve the original records, build an indexed evidence pack and track what you send. The notice determines the scope and response period.

Which AUSTRAC Review You Are Facing

Identify the review before booking an auditor. An information request, a supervisory assessment and an ordered external audit require different responses. Routine independent evaluation is a separate part of maintaining your anti-money laundering and counter-terrorism financing (AML/CTF) program.

Review	Who initiates it	What you organise
Supervisory information request	AUSTRAC	The information or documents specified in the request, supplied through its stated channel
Compliance assessment	AUSTRAC	Requested evidence of how the practice meets its obligations, plus relevant staff access where requested
Ordered external audit	AUSTRAC	An authorised external auditor, the specified audit work and the required report
Independent program evaluation	Your practice under its AML/CTF policies	A suitable independent evaluator and a report on the program and how it works

AUSTRAC says it uses annual compliance reports to develop supervision campaigns and assessments. Receiving a request does not, by itself, mean you have been ordered to appoint an external auditor.

What triggers an AUSTRAC audit? For an ordered audit, the law uses reasonable grounds to suspect inadequate risk management or past, current or proposed non-compliance. Risk management covers money laundering, terrorism financing and proliferation financing. There is no fixed event checklist that guarantees selection or protects a practice from selection. AUSTRAC’s written-notice guidance explains the grounds for requiring an external auditor.

An independent evaluation tests your program and how staff apply it. Your policies govern its frequency and conduct. It can use a suitable internal or external evaluator who is independent of the work. That appointment does not establish authorisation for an AUSTRAC-ordered audit.

Read the Notice and Assign the Response

1. Save the complete notice and its attachments. Identify the legal entity addressed, the legal basis and the services or activities under review. Record the requested period separately from the response deadline.
2. Turn each request into a response-register item. Record the required documents, format, delivery channel and contact. For an ordered audit, also capture auditor nomination conditions, audit scope and report requirements.
3. Assign the principal to approve the practice’s response. Give the AML/CTF compliance officer responsibility for coordinating evidence. Name a staff owner for each request and set internal deadlines before the external deadline.
4. Preserve the records within scope. Suspend routine deletion for those records and keep original versions available. Ask your lawyer to address privilege or legal disputes before you withhold documents or send legal advice.

Under the AML/CTF Act, audit notices specify the matters to cover and the report requirements. The notice sets the report delivery period, subject to a longer period AUSTRAC allows. Information notices also specify how and when to respond. A deadline from another business’s notice does not become your practice’s deadline.

If the requested period or entity is unclear, ask the named contact a precise question. Explain which wording needs clarification and retain the written response. If you need more time, request it early and retain any written approval. Continue working to the existing deadline until AUSTRAC confirms a change.

Before collecting client files, check that the response register captures every request and attachment. A missing attachment can change what the practice must supply.

Build the Compliance Evidence Pack

5. Create an evidence index against the response register. Give each document a reference and retain its original name, version and period. Record who holds it and which request it answers.

Use the notice to decide what belongs in the pack. The following records commonly help explain the practice’s compliance work.

Record group	What the evidence must make traceable
Risk assessment	The designated services and risks assessed, with the version that applied during the requested period
Approved program versions	The policies staff followed and the approval of changes
Governance records	Senior management approvals, oversight records and the compliance officer’s responsibilities
Staff training	Who received training, what it covered and evidence of completion
Customer due diligence	Identification, beneficial ownership, verification evidence and recorded risk decisions
Reporting records	Escalations, reporting decisions and lodgement evidence where applicable
Previous findings	Earlier reviews, corrective actions and evidence that changes work

Keep program development separate from the response exercise. The AML/CTF program guide explains risk assessment and program maintenance between reviews. For this response, show which approved policy applied to each record.

6. Reconcile a sample client file from service to decision. Match the designated service to the client and beneficial owners. Trace the recorded risk rating to its reasons and verification evidence. Follow ongoing review records through to any escalation and reporting decision.

Consider a fictional practice asked for evidence about a company client’s designated service. Its index links the service record to the company identification file and beneficial-owner checks. It then links the risk assessment to the staff decision and later review. The file contains a reporting decision but no record of who approved it.

Record that gap as found. Search the original correspondence and approval records, then distinguish any recovered evidence from a new explanation written during preparation. Keep the original file and add a dated correction with its author and reason. Never backdate an approval or edit a historical record to make a missing step appear complete.

If two files contain different risk ratings, compare their versions and the recorded reasons for the change. If an export loses the approval history, retrieve the source record. The pack is ready when each requested item has a traceable response or an explicit explanation of the missing evidence.

Work With the Auditor and Close Findings

7. Confirm the nominated auditor’s eligibility and authorisation before treating the appointment as settled. For an ordered audit, an officer, employee or agent of the entity is ineligible. The exclusion also covers those roles in another member of its reporting group.

AUSTRAC authorises an individual for the specific audit. Its nomination process requires a capability statement, a signed statutory declaration and a resume. Follow the actual notice’s directions and retain AUSTRAC’s written authorisation with the engagement records.

8. Arrange secure access to the agreed evidence and relevant staff. Confirm the auditor’s identity and use the delivery method agreed for the review. Keep sensitive reporting records within authorised access arrangements. Log each document supplied, its version, recipient and delivery acknowledgement.
9. Track questions and findings in the response register. Give each finding an accountable owner, a corrective action and a completion target. Attach evidence of the change and test whether the same defect remains in another relevant file.
10. Complete the required report and follow-up response. Check the report against the notice’s scope and format. Retain the submitted version and delivery confirmation, then track any additional AUSTRAC requirements separately.

An audit report records the auditor’s findings. A court-imposed civil penalty is a separate enforcement outcome. AUSTRAC’s consequences guidance explains its different responses to non-compliance.

Close a finding only when its evidence supports closure. A revised policy alone does not prove staff use it. For the fictional practice’s missing approval record, inspect a later applicable file for the recorded approval and confirm staff follow the revised step. Keep the original finding visible beside the corrective action and its verification result.

Your final check is against the notice: every required item has an owner and a recorded outcome, the required material reaches the stated recipient and follow-up work remains assigned. Retain the complete response history so the practice can show what it supplied and what changed.