Introduction
Most compliance teams know the feeling: an examination notice lands, and suddenly everyone is pulling files, chasing signatures, and hoping the risk assessment is ready. That's scramble mode.
For Canadian reporting entities, the stakes are higher than a stressful week. FINTRAC conducted 294 formal examinations in fiscal year 2024-25, up from 123 the year before — more than double the volume, according to FINTRAC's 2024-25 Annual Report.
Audit readiness isn't just an IT or security exercise like SOC 2 or ISO 27001. For AML-regulated entities, it also means proving statutory compliance: current risk assessments, defensible governance, and evidence that controls actually work.
This guide covers what an audit readiness assessment is, why it matters for AML programs specifically, the four-stage process, what gets evaluated, common gaps, and how to build readiness that lasts year-round.
Key Takeaways
- Readiness assessments find control and documentation gaps before an external party does.
- For AML programs, readiness covers risk methodology, governance, and control testing — not just paperwork.
- A four-stage cycle (scope, map, test, remediate) turns readiness into a habit, not a scramble.
- Continuous readiness means gaps are identified and remediated on your own timeline rather than during a FINTRAC review.
What Is an Audit Readiness Assessment?
An audit readiness assessment is a structured internal review. It evaluates whether your controls, policies, documentation, and evidence are complete and consistent ahead of a formal audit or examination.
Think of it as a dry run. It's diagnostic, not binding. Nobody issues a formal opinion, and nobody faces a penalty based on its outcome. The real audit or FINTRAC examination is the one with consequences.
Compliance and audit readiness means your controls are documented and evidenced well enough to be explained to an outside examiner, auditor, or regulator. That's a different bar than "we have a policy for that." Policies on paper mean little if practice doesn't match them.
For Canadian reporting entities, readiness spans two related but distinct events:
- An independent AML effectiveness review: testing whether your program's design and operating effectiveness meet FINTRAC's requirements
- A FINTRAC examination: a regulator-led assessment with direct enforcement authority
The core purpose, in one line: find and fix the gaps before someone else does.
Why Audit Readiness Matters for Canadian AML Compliance Programs
Voluntary Certifications vs. Statutory Obligations
SOC 2 and ISO 27001 are valuable, but they're voluntary. Nobody fines you for skipping ISO certification.
AML effectiveness reviews and FINTRAC examinations are different. A documented effectiveness review is required at least every two years. A FINTRAC examination is regulator-led and is not on that same two-year clock.
| Obligation | Cadence | Nature |
|---|---|---|
| AML effectiveness review | At least every two years (PCMLTFR, section 156) | Statutory program element for reporting entities |
| FINTRAC examination | Risk-based selection; no universal two-year exam cycle | Regulator-led assessment when selected |
| SOC 2 / ISO 27001 (examples) | Entity-chosen | Voluntary certifications - not FINTRAC AML statutes |
Miss the mark on statutory AML duties, and exposure can include:
- Administrative monetary penalties
- Findings letters and, in certain cases, requested corrective action plans
- Public disclosure where FINTRAC publishes imposed penalties
Where Readiness Assessments Usually Find Trouble
Readiness assessments most often surface the same three weak spots:
- Outdated risk assessment methodology that no longer matches the entity's actual products, customers, or geography
- Ongoing monitoring that looks fine on paper but isn't consistently evidenced
- Governance documentation that hasn't kept pace with organizational change
Here's the part checklists miss: FINTRAC examiners and independent reviewers probe judgment and decision-making, not just whether a policy document exists. A generic, checklist-style readiness review confirms documents are present. It doesn't tell you whether your risk methodology is documented well enough to be explained to someone who has sat on the examiner's side of the table.
That examiner-side challenge is how AlphaDelta prepares clients for effectiveness reviews: advisors apply the same scrutiny used when building, defending, and examining AML programs, instead of walking a generic template.
The Readiness Assessment Process: Key Stages
A readiness assessment isn't a single afternoon of file-checking. It follows four distinct stages, each building on the last.
Stage 1 — Scope and Planning
Start by defining what event this readiness assessment supports: a FINTRAC examination, a mandated two-year effectiveness review, or internal quality assurance. Then identify the specific regulatory obligations in scope.
Scope drives everything downstream — get it wrong here, and you'll test the wrong things later.
Stage 2 — Control and Documentation Mapping
Map existing policies, risk assessments, and procedures against actual regulatory requirements. This step pinpoints where controls or evidence are:
- Missing entirely
- Thin — present but underdeveloped
- Misaligned with current obligations or business activity
Stage 3 — Testing and Evidence Evaluation
This is where readiness assessments earn their keep. Verify that controls actually operate as documented by sampling real records:
- Transaction monitoring alerts and their resolution
- Enhanced due diligence files for high-risk clients
- Training completion logs and content currency
Policy equals practice is an assumption, not a fact. Testing proves it one way or the other.
Stage 4 — Gap Remediation and Reporting
Before the formal audit or examination begins:
- Document every finding
- Prioritize findings by risk
- Assign each an owner and a deadline
- Brief senior management or the board
A finding without an owner and a date rarely gets fixed.
Mature compliance programs don't run this cycle once a year before a deadline. They run it continuously, throughout the year, as a standing operational discipline.
What an AML-Focused Readiness Assessment Evaluates
A readiness assessment worth its fee digs into three areas.
Risk assessment methodology and assumptions. Does it genuinely reflect your actual products, customer base, delivery channels, and geographic exposure — or is it a template that hasn't been meaningfully revisited since it was first drafted?
Governance and control design. Clear control ownership, defined escalation paths, and consistent reporting to senior management and the board. Vague ownership is one of the fastest ways to fail under scrutiny.
Evidence and testing quality. Transaction monitoring records, KYC/EDD documentation, training records, and independent testing results all need to be:
- Complete across the full period under review
- Current and reflective of how the program operates today
- Defensible when someone outside your organization starts asking questions
Skip any of these three, and you've got a readiness assessment that looks thorough but leaves real exposure untested.
Common Gaps Uncovered During Readiness Assessments
Across engagements, a handful of gaps show up again and again.
- Generic or templated risk assessments left unchanged as products, clients, or risk profile evolved
- Documentation-versus-reality mismatches, where policies exist but teams do not follow them day to day
- Unclear control ownership and uneven evidence retention, so you cannot prove controls ran across the full review period
None of these are exotic. They usually mean the program outgrew its documentation, or a review ran once and was never revisited. Readiness assessments surface these gaps while there is still time to fix them.
Building a Culture of Continuous Audit Readiness
Treating readiness as a pre-deadline sprint can leave the organization reacting rather than preparing. The better model is ongoing: periodic internal reviews, updated documentation throughout the year, and no scramble when the examination notice arrives.
Here's how to put that model into practice:
- Assign a readiness lead. Someone needs to track control owners, coordinate evidence collection, and serve as the point of contact with auditors, examiners, or independent reviewers.
- Stay current on regulatory developments between formal reviews. Resources like AlphaDelta's Daily Delta and Weekly Alpha briefings help compliance teams catch guidance changes and enforcement trends before they surface as findings.
- Bring in independent challenge periodically, not just before a scheduled review. Senior, independent AML advisory support can pressure-test risk assessments, controls, and testing approaches well ahead of an effectiveness review or anticipated FINTRAC examination.
Readiness built this way doesn't disappear the moment the review or examination ends. It just keeps running.
Frequently Asked Questions
What is compliance and audit readiness?
Compliance and examination preparation is the work of aligning controls, policies, and evidence so they can be explained clearly to an external auditor, examiner, or regulator. It is built through proactive internal review, not last-minute scrambling. It does not guarantee outcomes or examination results.
What are the 4 stages of audit?
The four stages are:
- Scoping and planning
- Control and documentation mapping
- Testing and evidence evaluation
- Gap remediation and reporting
These stages apply equally to internal readiness assessments and formal audits.
What is the difference between an audit and a readiness assessment?
A readiness assessment is an internal diagnostic dry run with no formal opinion attached. An audit or examination is the binding, external evaluation that carries real regulatory consequences.
How often should an AML effectiveness review be conducted in Canada?
Canadian AML legislation requires an effectiveness review at least every two years under PCMLTFR section 156. Schedule your readiness assessment well ahead of that deadline to leave time for remediation.
Who should conduct an audit readiness assessment?
Readiness assessments can be run internally, by your external auditor or examiner, or by an independent specialist. Independent senior review often catches issues an internal team is too close to see.
What happens if gaps are found during a FINTRAC examination?
Unaddressed gaps can lead to formal findings, corrective action requirements, or administrative monetary penalties. Pre-examination readiness assessments exist to surface and fix those issues before they become regulatory outcomes.
