Barritt Consulting

AML Governance Advisory

An AML governance review examines whether responsibility, reporting and escalation give decision-makers a clear view of financial crime risk and a practical way to respond. It focuses on oversight and decisions, rather than retesting each operational control or repeating the firm's risk assessment.

When governance needs a closer look

Senior leaders may receive regular AML reports yet lack clarity about who owns a decision, what a rising issue means, or when to escalate it. Changes in products, customers, teams or systems can expose gaps between formal responsibilities and daily decisions.

A review can examine how responsibilities are shared across the governing body, committees, senior management, compliance and the MLRO. It can test whether committee terms, reporting lines and escalation routes support timely challenge and follow-through. The relevant arrangements depend on the firm's structure, rules and risk profile.

Management information that supports decisions

Useful management information connects activity and exceptions to decisions. Depending on the firm's context, a discussion can consider alerts and backlogs, overdue actions, control changes, incidents, emerging risks and remediation ownership. Measures need clear definitions and context, and must reach people able to respond.

A governance review does not assume that more metrics mean stronger oversight. It looks for a clear path from signal to interpretation, challenge, decision, named owner and follow-up. Escalation arrangements should make it possible to raise material concerns promptly while recording how they were considered and resolved.

A focused, proportionate discussion

A first conversation can establish jurisdiction, regulatory context, the governance concern and the decision needed. If appropriate, inputs might include responsibility maps, committee terms, AML reporting packs and escalation procedures. Sensitive material should use an agreed access route.

The review can identify unclear responsibilities, gaps in reporting or escalation, and decisions for accountable leaders to resolve. The parties agree its depth and any written output before work begins. UK requirements vary by firm, and international work must account for local implementation of relevant standards.

Keep governance distinct from control testing

Governance concerns who oversees AML risk, what information reaches them and how decisions are tracked. A controls review examines operational processes; a firm-wide risk assessment evaluates exposure. These topics connect but answer different questions. A control failure or outdated risk assessment may need its own analysis alongside governance work.

Trevor Barritt provides independent advice on governance and oversight. An advisory engagement does not appoint him as the firm's MLRO or replace legal advice or regulatory decisions.

Common questions

What is the difference between an AML governance review and an AML controls review?

Governance looks at oversight, responsibilities, reporting, escalation and decision follow-through. A controls review examines how policies and operational processes work in practice. The scope can address both, but they answer different questions.

Does a governance review replace our AML risk assessment?

No. A risk assessment evaluates the firm's exposure to money laundering risk. Governance considers whether accountable people receive and use appropriate information to oversee that risk.