Audit season is here. How to have an awesome FinTech AML or operational audit?
Yana Afanasieva
Scaling compliance for FinTech & Crypto startups ?? Licensing (MICA, EMI), outsourced compliance/MLRO function ?? Founder of FinTech Compliance Pro Certification ? Worked for Lirium, Aza, PayPal, bitFlyer, Amazon ??
FinTech?companies experience external audit as an unpredictable emergency that can easily spiral out of control .?
The truth is that auditors have very little (if any) imagination and follow a very predictable routine, which is a?totally open secret but unfortunately so many FinTechs are simply too busy to pay attention.?
Audit is not an emergency. It is similar to the house renovation: either you prepare? in advance and learn to discipline your contractors, or your contractors will try to boss you around, guilt you, confuse you and abuse your time and budget.
What does it cost you if you don't know how to prepare for an audit?
Audit should be a routine process, where you feel 100% in control and well prepared.
One of the very common reasons for compliance project delays? is “we have to prepare for an audit” or “we are in the middle of the audit”.?
Indeed, many compliance teams?feel that they constantly have to craft long explanations for regulatory inspections or external auditors. Those audits are often taking away completely disproportionate time and other? precious resources.
And when these audits are over, you are often left? with a long list of audit findings (of which 99% you will find ridiculous, formalistic and completely irrelevant), but nevertheless you will have to spend time figuring out what to do about these findings and how to rectify the issues before the next audit, which is another waste of your management efforts.?
Why do I want the CEOs or MDs to stay out of the audit processes?
Let’s say you, as a FinTech CEO, would like to get a?favourable audit opinion in the shortest amount of time possible.
After receiving some initial questions and reviewing draft answers prepared by your team, you feel like the audit process is not going to go well, everything looks disturbing and you have an uncontrollable urge to jump in and start driving the conversation and educating everyone about where to focus or how the answers should be.
What’s a better strategy?
→ Let your compliance person lead the conversation and be a single point of contact for all audit communications. Regardless of what you think of them, most likely they have completed more audits in their professional lives compared to you, and have a better understanding of how satisfactory answers look like.
→ Ask your compliance team about the typical audit process and its various milestones, understand the role and the purpose of the engagement letter and the audit scope, the difference between findings and recommendations, how the exchange of information will look like, and what needs to be prepared in advance.
→ You can assist your team by managing down the cost (or ask your CFO to get involved) – and this is how you can make a difference:
领英推荐
? → When your audit reaches the phase of discussing the initial findings, you can also help your team by pushing back and understanding whether the auditors’ requests are really well grounded. Auditors make up stuff all the time, they need to see you defending your past choices and your policies and your processes, and then they will pull back.?
? → Sometimes (well, most of the times), when auditors make up stuff,? CEO can help by playing the dumbest person in the room and asking “na?ve” questions and making innocent comments, such as “Is it really required, why none of our competitors do it” ?or “Why do you think this is required, it makes no sense?” By doing so, you as a CEO will protect the professional standing of your team but at the same time this could be a very effective way of challenging the auditors without making them defensive. Since you are not a compliance professional, you are “just” being curious and asking questions for your personal education only, which is non-threatening for the auditors.
→ Agree with your compliance team in advance which mistakes and omissions you will let your auditors find quickly. You absolutely need to let them find small and easy mistakes (such as some policies not being updated or some dates missing), or they will keep digging.
So, what if I told you that it is possible to prepare for any regulator audit within 3-4 hour maximum??
That it is possible to know exactly what your audit outcome will be??
And that it is also entirely possible for the the audit findings list to be very short, sensible and you will?actually be able to rectify most issues during the audit and never think about it again?
In short, if you know how to prepare for the audit and?focus on the right things, it will not be a paralysing emergency. This is why I’ve decided to offer my Workshop on How to Prepare for Audits on demand!
This workshop and accompanying templates will teach you how to:?
Interested?
Or do you still want more information? Check out the agenda HERE. Looking forward to seeing you!