These issues can surface during effectiveness reviews, examinations, or internal audit work. A required AML effectiveness review, FINTRAC examination, or internal audit hinges on two distinct questions: is the control properly designed, and did it actually operate as intended?
This article breaks down control design assessment and test of operating effectiveness, how both apply to Canadian AML compliance programs, and how to identify and address common control design deficiencies.
Key Takeaways
- Design assessment: if the control ran exactly as written, could it reasonably prevent or detect the mapped risk?
- Operating effectiveness: was that control performed consistently as designed across the full review period?
- Strong design with weak operation—or the reverse—both create regulatory exposure.
- Separately documenting design and operating conclusions is a defensible methodology used in effectiveness reviews; it is not a universal FINTRAC rule that every entity must document design versus operating effectiveness as separate statutory headings.
What Is Control Design Assessment in an AML Program?
Control design assessment is a point-in-time evaluation of whether an AML control, such as a transaction monitoring rule, an enhanced due diligence (EDD) trigger, or a sanctions screening step, is structured to address a specific, documented risk.
That is a different question from whether the control ran consistently. Design assessment asks: could this control work at all, if performed exactly as written? A control followed perfectly every time but never capable of catching the risk it claims to address is still a failed control.
Criteria Used to Assess Whether an AML Control Is Well Designed
- Risk alignment — maps directly to a risk in the entity's documented risk assessment, not a vague category like "fraud" or "high-risk clients"
- Clear ownership — names a role accountable for the control, not "compliance" or "the team"
- Defined trigger or frequency — states when the control runs (event-driven, daily, monthly), not "as needed"
- Adequate precision — defines what counts as an exception or red flag, not only "review and approve"
- Evidence retention — produces documentation that can be inspected independently in a review or examination
FINTRAC guidance reinforces this: generic, industry-template policies must be tailored to the reporting entity's business, with specific triggers, required information, timelines, and reporting methods—not boilerplate language.
How to Assess Control Design Effectiveness: A Step-by-Step Approach
Design assessment follows a structured sequence rather than a single document review:
- Confirm the underlying risk is documented - Trace the control back to a specific ML/TF risk identified in the risk assessment.
- Read the control procedure as written - Check it contains an owner, a trigger, and an evidence output.
- Perform a walkthrough - Trace a transaction or client file through the control from trigger to resolution.
- Inspect supporting documentation - Confirm policy, procedure, and system configuration match what the walkthrough showed.
- Document a clear conclusion - State whether the design is adequate, and flag gaps that need remediation before operating effectiveness testing begins.
This approach mirrors what independent reviewers use when assessing whether risk assessments, methodologies, and control frameworks reflect a reporting entity's regulatory obligations.
Most design gaps get missed when reviewers skip the walkthrough and land on a "looks fine" conclusion. Watch for:
- No named owner, trigger, or evidence output
- Procedure text that does not match system configuration
- Controls that cannot be traced to a documented ML/TF risk
Test of Operating Effectiveness: Confirming the Control Actually Worked
Once design is confirmed, the next question stands on its own: did the control actually run, consistently, over the review period?
Test of operating effectiveness is sample-based testing across a defined period, commonly since the last effectiveness review, confirming the control was performed as documented. In practice, that means pulling a representative sample of alerts, EDD files, or transaction reviews and checking each one against the documented control steps.
Example: Sampling high-risk clients onboarded during the period and verifying EDD was completed and approved on each selected file—not a single file pulled at random.
Key points:
- A control found to be well-designed but inconsistently operated typically points to training, resourcing, or monitoring gaps, not a redesign
- A defensible methodology documents a design conclusion and an operating effectiveness conclusion for material controls; FINTRAC does not prescribe that split as a standalone universal legal format
- FINTRAC's assessment manual describes a risk-based approach to sample sizes, pulling additional samples where initial results raise concerns
Why This Distinction Matters for FINTRAC Examinations
Under FINTRAC's examination approach, an AML effectiveness review must test whether the compliance program is:
- Current
- Appropriately designed
- Operating effectively
These are three related but separate findings, not one combined checkbox.
Skipping straight to operating effectiveness testing without confirming design first creates false assurance. A control can "operate consistently" for years while never being capable of catching the risk it's supposed to address. That's not a resourcing problem. It's a structural one, and no amount of consistent execution fixes it.
This is where senior-practitioner review adds value. AlphaDelta assesses whether a reporting entity's control design and testing approach reflect its actual regulatory obligations, products, and customer base—not just whether the documentation exists on paper.
Reporting entities preparing for a FINTRAC examination benefit from resolving design deficiencies proactively. Addressing design gaps before an examination is generally less disruptive than remediating them during an examination.
FINTRAC's 2024 enforcement notice against a Canadian exchange bank / MSB is a useful illustration. The bank had documented EDD measures, but that information wasn't being used in ongoing monitoring. FINTRAC reviewed 26 case files, including 17 high-risk relationships, and found 8 instances where prescribed ongoing monitoring wasn't conducted at all. The documentation existed. The control still failed.
Common AML Control Design Deficiencies and How to Avoid Them
Design deficiencies tend to fall into a few recurring patterns:
- No documented risk link - the control maps to an overly broad category ("suspicious activity") that can't be meaningfully tested
- No defined review criteria - a manager "reviews" alerts without documented thresholds for what triggers escalation
- Missing evidence retention - there's no way to demonstrate the control occurred during a review or examination
Avoid them by defining each control at design time:
- Link the control to a specific inherent risk and expected outcome
- Document decision criteria and escalation thresholds in the procedure
- Specify what evidence is retained, where it is stored, and for how long
Build design assessment into any material program change, not only the periodic effectiveness review. Catching a gap when a control is introduced costs far less than finding it two years later, or during a FINTRAC examination.
Frequently Asked Questions
How do you assess control design effectiveness?
Confirm the control maps to a documented risk, has clear ownership, a defined trigger, sufficient precision, and produces retrievable evidence. This is typically verified through a walkthrough, not sample testing.
What are the 7 internal control procedures?
Seven common internal control procedures are:
- Segregation of duties
- Authorization and approval
- Reconciliation
- Access restriction
- Documentation standards
- Independent verification
- Management review
AML controls such as EDD approval and alert escalation map directly onto these categories.
What are the 5 C's of internal audit?
Internal auditors commonly structure findings using condition, criteria, cause, consequence, and corrective action. This framework applies directly to documenting AML control deficiencies for a FINTRAC-facing review.
How often does an AML effectiveness review need to test control design?
Design should be reassessed whenever a control is introduced or materially changed, and revisited during each periodic effectiveness review (at least every two years under PCMLTFR) to confirm it still reflects current risk.
What happens if a control is well designed but fails operating effectiveness testing?
This typically points to an execution gap, such as training, resourcing, or monitoring, rather than a design flaw. Repeated failures across review periods, however, can signal that the design assumptions no longer hold.
Who should perform control design assessment for a Canadian reporting entity?
There is no prescribed FINTRAC role titled control-design assessor. The statutory effectiveness review may be carried out by an internal auditor, an external auditor, or by the entity itself if it has no auditor (PCMLTFR s.156(3)). Independent senior challenge is AlphaDelta's service model, and it matters most ahead of a FINTRAC examination.
