Free Advanced-CAMS-Audit Practice Test Questions and Answers (2026)

The Office of Foreign Assets Control (OFAC) issues two types of licenses to authorize transactions that would otherwise be prohibited by sanctions. A general license is a broad authorization for a particular category of transactions (e.g., personal remittances, humanitarian aid) published in the Code of Federal Regulations. It does not require a specific application. Conversely, a specific license is a written document issued by OFAC to a particular person or entity, authorizing a specific transaction or set of transactions in response to a formal, written application.

B. The distinction between license types is not based on whether the party is an individual or an entity; both can apply to either.
C. This is incorrect for the same reason as option B. The distinction is based on the scope and issuance process, not the type of party.
D. This option incorrectly reverses the definitions of general and specific licenses.

1. U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC). (n.d.). Frequently Asked Questions. FAQ #20. Retrieved from https://ofac.treasury.gov/faqs/20. "A specific license is a written document issued by OFAC to a particular person or entity... A general license is a provision in the regulations that authorizes a particular type of transaction for a class of persons without the need to apply for a license."

2. ACAMS Advanced CAMS-Audit Certification Study Guide, (2020). Chapter 2: Regulatory Requirements and International Standards, Section: Sanctions Compliance, p. 45. "General licenses authorize a particular type of transaction for a class of persons... Specific licenses are issued on a case-by-case basis..."

When a sanctions screening system fails to incorporate updated lists, a gap is created. The correct remedial action is a "lookback" review. This involves re-screening all transactions that occurred during the gap period against the specific sanctions lists that were in effect at that time but were missed. This process ensures that any transactions involving newly sanctioned parties during that period are identified. Using current lists would be inaccurate, as sanctions targets can change over time.

A. Re-screening against current lists is incorrect because it does not accurately reflect the sanctions that were in force at the time of the historical transactions.
B. This is a forward-looking control improvement to prevent future failures, but it does not address the need to identify transactions that may have already occurred during the gap.
D. This is a recommendation for ongoing process improvement and monitoring, not a corrective action to remediate the past failure.

1. The Wolfsberg Group, "Guidance on Sanctions Screening," 2019, Section 4.3 Lookbacks, p. 16. "A lookback is a review of past transactions or other customer data against sanctions lists that were in effect at the time of the activity... to determine whether there were any potential matches that were not previously identified."

2. Financial Action Task Force (FATF), "International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation," Recommendation 6, p. 13. This recommendation requires countries to implement targeted financial sanctions, which implies that failures in implementation must be remediated to ensure compliance.

When a financial institution outsources any part of its AML program, including the delivery of training, it retains ultimate responsibility for compliance. The institution cannot simply delegate this duty. A critical component of an outsourcing arrangement is a robust oversight and control framework. The auditor should identify the lack of controls to verify the appropriateness, quality, and effectiveness of the training delivered by the third party as a significant deficiency. The bank must ensure the outsourced training is tailored to its specific risks and meets regulatory standards.

A. The issue is not whether the outsourced provider's staff attend the bank's onboarding, but whether the bank properly oversees the services the provider delivers.
B. An institution can never simply "rely" on a third party; it must actively oversee, test, and verify the outsourced function to ensure it meets compliance obligations.
D. Logistical considerations like time zones and session formats are secondary to the primary requirement of ensuring the training's content and quality are adequate and verified.

1. The Wolfsberg Group, "Guidance on Outsourcing/Insourcing and the Sharing of Resources in the Context of Financial Crime Compliance," 2022, Section 3.2 Oversight and Monitoring, p. 6. "FIs should establish and maintain an appropriate oversight and monitoring framework over any outsourced FCC activities... to ensure that the service provider is performing the activities to the required standard."

2. Financial Action Task Force (FATF), "Guidance on Digital Identity," 2020, para. 96, p. 31. While focused on digital ID, the principle applies broadly: "The ultimate responsibility for meeting AML/CFT requirements remains with the regulated entity relying on the third party."

The conversation described is a classic example of root cause analysis. The audit has identified a symptom (an important control is not being performed), and the discussion with the operational manager aims to uncover the fundamental reason for this failure. The manager's response, citing a lack of adequate resources, points to a potential root cause. Identifying the root cause is critical for developing an effective and sustainable management action plan that addresses the underlying issue, rather than just fixing the immediate control deficiency.

A. This answer relates to sanctions licensing and is completely irrelevant to the audit finding discussion.
B. The discussion is about the result of an internal control test, not the test itself.
C. A sustainability assessment is a much broader evaluation of a program's long-term viability, not an analysis of a specific control failure.

1. ACAMS. (2023). Advanced CAMS-Audit Certification Study Guide. Chapter 4, "Reporting and Follow-Up." This chapter emphasizes that effective audit reporting goes beyond identifying issues to determine their root causes, ensuring that corrective actions are appropriate and lasting.

2. Protiviti. (2019). Getting to the Root of It: Performing an Effective Root Cause Analysis. Internal Audit and Financial Advisory White Paper. This paper defines root cause analysis in an audit context as the process of drilling down from a finding to its underlying cause, as depicted in the question's scenario.

The core responsibilities of internal audit, as defined by professional standards, are to provide independent assurance and advisory services. This includes evaluating the effectiveness of risk management processes (C) to ensure they are functioning as intended. Furthermore, by identifying control weaknesses, inefficiencies, and opportunities for enhancement, internal audit acts as a catalyst for improvement (D) within the organization's governance and control environment. These roles are fundamental to modern, value-added internal auditing.

A. Implementing controls is a management function. Internal audit must remain independent and cannot take on operational responsibilities, as this would impair their objectivity.
B. The board of directors and senior management are responsible for setting the organization's risk appetite, not the internal audit function.
E. Mitigating risk is the responsibility of management through the implementation of controls and processes. Audit's role is to assess the effectiveness of that mitigation.

1. The Institute of Internal Auditors (IIA). (2017). International Professional Practices Framework (IPPF). Standard 2120: Risk Management. "The internal audit activity must evaluate the effectiveness and contribute to the improvement of risk management processes."

2. The Institute of Internal Auditors (IIA). (2017). International Professional Practices Framework (IPPF). Core Principles for the Professional Practice of Internal Auditing. Principle: "Is insightful, proactive, and future-focused." This principle supports the role of being a catalyst for change and improvement.

3. ACAMS. (2021). Advanced CAMS-Audit Certification Study Guide. Chapter 1: The Role of Internal Audit. This chapter outlines the distinction between the assurance and advisory roles of audit versus the operational responsibilities of management.

For a foreign bank branch, ultimate oversight responsibility rests with the head office's board of directors or a designated committee thereof (e.g., the Audit Committee). Submitting an independent testing report to this body ensures the appropriate level of governance and independence. This reporting line bypasses the branch management being audited, ensuring that findings are reviewed by the ultimate governing authority responsible for the entire organization's risk and control framework. This is critical for holding branch management accountable and ensuring issues are addressed with enterprise-wide context.

A. A risk management committee is a management-level committee; a board committee provides a higher, more independent level of governance.
C. Reporting to a branch-level committee lacks independence, as it is part of the same management structure that is being audited.
D. Reporting to a committee headed by the branch's chief incumbent is a severe conflict of interest and completely undermines audit independence.

1. Basel Committee on Banking Supervision (BCBS). (2012). The internal audit function in banks. Bank for International Settlements. Section 21, p. 7, "The head of the internal audit function should report... to the audit committee." This principle applies to the entire banking group.

2. U.S. Federal Reserve System. (2008). Compliance Risk Management Programs and Oversight at Large Banking Organizations with Complex Compliance Profiles. Supervision and Regulation Letter SR 08-8. Attachment, p. 11, "The board of directors of the FBO [Foreign Banking Organization] has ultimate oversight responsibility for the combined U.S. operations of the FBO."

3. Wolfsberg Group. (2021). Guidance on Audits of the Financial Crime Compliance Programme. Section 3.1, "The Audit function should have a direct reporting line to the Board Audit Committee (BAC) or equivalent independent senior governance body."

To understand the key roles and responsibilities within an AML compliance program, an auditor should start with its governance structure. The designation of a qualified and empowered AML Compliance Officer is the cornerstone of this structure and a fundamental regulatory requirement globally. This individual is central to the program's operation. Reviewing this designation, the associated job description, and reporting lines is the most direct first step to understanding the allocation of compliance responsibilities within the financial institution.

B. List of high-risk customers subject to enhanced due diligence and the measures taken to mitigate the risks: This is an operational output of the program, which an auditor would review after understanding the program's governance and structure.
C. Names of politically exposed persons that are subject to ongoing monitoring: This is a specific, operational detail related to customer risk management, not the overall program governance.
D. List of suspicious transactions reported to the regulator: This is a result of the program's monitoring and reporting functions, not a foundational element of its structure and responsibilities.

1. ACAMS. (2023). Advanced CAMS-Audit Certification Study Guide. Chapter 1: The Pillars of an Effective AML/CFT Program. The designation of a compliance officer is presented as a foundational pillar of any AML program.

2. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation (The FATF Recommendations). Recommendation 18. This recommendation requires financial institutions to have an AML/CFT compliance function, including the appointment of a compliance officer at the management level.

3. Federal Financial Institutions Examination Council (FFIEC). (2020). Bank Secrecy Act/Anti-Money Laundering Examination Manual. Section: "BSA/AML Compliance Program Structure - Designation of a BSA Compliance Officer." This section identifies the designation as a minimum requirement for a BSA/AML compliance program.

Below-the-line (BTL) testing is specifically designed to verify that a transaction monitoring model's thresholds are not set too high, which could cause the system to miss potentially suspicious activity (i.e., create false negatives). This test involves analyzing a sample of transactions that did not generate an alert (they fell "below the line" of the threshold) to determine if any of them should have been flagged. This helps institutions fine-tune thresholds to achieve an appropriate balance between detecting risk and managing alert volumes.

A. Black-box configuration: This describes a system whose internal logic is not visible or understood, not a specific type of model test.
B. Above-the-line: This type of testing analyzes the population of alerts that were generated to assess their quality and identify potential false positives, not to find missed alerts.
C. Gap analysis: This is a broader review to identify missing controls or scenarios in the AML program, not a specific test of a model's threshold settings.

1. ACAMS Advanced CAMS-Audit Certification Study Guide, Chapter 4: "Auditing Specific AML/CFT Areas," Section on Testing and Tuning of Transaction Monitoring Systems. The guide describes below-the-line testing as a method to check for false negatives.

2. Deloitte, "AML model tuning and optimization: Striking the right balance" (2018), Page 3. This industry publication explains that "Below-the-line testing analyzes transactions that were not flagged as alerts to determine whether any of them should have been."

The universally accepted standard for an AML/CFT compliance program and its audit is the risk-based approach (RBA). This approach requires the financial institution, and by extension its auditors, to identify the highest compliance and money laundering risks and focus resources on those areas. When testing KYC files, an auditor using an RBA would ensure the sample is weighted towards higher-risk customers (e.g., Politically Exposed Persons, cash-intensive businesses) to verify that enhanced due diligence and other critical controls are working effectively where they matter most.

A. A horizontal approach tests a single control across multiple business units; it is a testing technique, not the overarching audit strategy.
B. "Full scope" describes the breadth of the audit (i.e., covering all required AML pillars) but does not define the methodological approach.
C. A vertical approach tests all controls for a single transaction or entity; it is a specific testing method, not the overall audit philosophy.

1. Financial Action Task Force (FATF). (2014, June). Guidance for a Risk-Based Approach: The Banking Sector. Paris: FATF/OECD. (Paragraphs 18-21).

2. ACAMS. (2023). Advanced CAMS-Audit Study Guide. Chapter 2: The Risk-Based AML Audit, Section on Applying the Risk-Based Approach.

3. Wolfsberg Group. (2006). Guidance on a Risk Based Approach for Managing Money Laundering Risks. Section 3: "The Role of the Audit Function."

An audit's primary role is to assess the effectiveness and adequacy of the AML/CFT control framework against the institution's specific risks. A coverage assessment directly addresses this by comparing the transaction monitoring (TM) rules with the institution's enterprise-wide money laundering and terrorist financing risk assessment. This fundamental step ensures the TM system is properly designed to detect suspicious activity relevant to the bank's products, services, clients, and geographies. It is a strategic recommendation that addresses the root cause of potential TM failures, rather than just symptoms like high false positives.

A. Switching off scenarios reduces risk coverage and may lead to missing actual suspicious activity, which is a significant compliance failure.
B. A risk-based approach requires different thresholds for different client risk levels; uniform thresholds are contrary to this core AML principle.
D. Training is important for alert disposition but does not fix underlying issues with the TM system's design, tuning, or risk coverage.

1. ACAMS. (2021). Advanced CAMS-Audit Certification Examination Study Guide, Chapter 3: AML Models and Systems, Section: "Auditing the Transaction Monitoring System," pp. 68-70. (Discusses the importance of assessing scenario coverage against the institution's risk profile).

2. The Wolfsberg Group. (2009). Wolfsberg Guidance on a Risk Based Approach for Managing Money Laundering Risks, Section 3.2: "Monitoring," p. 8. (Emphasizes that monitoring should be risk-based and tailored to the institution's specific risk factors).

3. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, Recommendation 10: Customer Due Diligence, Interpretive Note, para. 27. (Requires ongoing monitoring of the business relationship, which must be based on risk).

An effective AML/CFT program requires robust governance and oversight, which starts with the Board of Directors. The Board has ultimate responsibility for the institution's compliance. Therefore, they must receive AML training appropriate to their oversight role. A program that includes business, operations, compliance, and senior management but completely omits the Board of Directors is fundamentally incomplete and represents a significant governance deficiency that an auditor must report.

A. This is incomplete because it omits the Board of Directors, a critical component of the governance structure requiring AML training.
B. This is too broad; not all staff require the same level of training. More importantly, it fails to specifically mention the Board, whose training is a key indicator of program soundness.
D. The compliance officer's role is to ensure training occurs and is effective; they are not required to personally facilitate every session.

1. The Wolfsberg Group, "Anti-Money Laundering Principles for Private Banking," 2012 (updated 2014), Principle 11: Training, p. 11. "Training on AML/CFT should be provided to the Board of Directors... Training should be appropriate to the role of the individual."

2. Financial Action Task Force (FATF), "Guidance for a Risk-Based Approach for the Banking Sector," 2014, para. 41, p. 18. "Senior management should be informed of the institution’s AML/CFT policies and procedures... This includes the board of directors."

3. ACAMS Advanced CAMS-Audit Examination Study Guide (Illustrative Principle). The curriculum consistently emphasizes that a culture of compliance starts from the top, and the Board and senior management must receive regular, tailored AML training to fulfill their governance responsibilities.

An effective audit follow-up strategy is crucial for ensuring that identified deficiencies are remediated. This strategy must be structured to track progress systematically. The core components of such tracking are establishing a clear timeline for completion (target completion date) and a mechanism for monitoring progress against that timeline (status updates on remedial action). These elements create accountability and provide objective data for reporting to senior management and the board on the status of corrective actions.

A. Available resources and board of directors' commitment: These are enabling factors for remediation success, not the mechanics of the follow-up strategy itself, which focuses on tracking.
B. Responsible action owner and internal audit commitment to follow up: Assigning an owner is part of the initial action plan. The audit's commitment is an assumed professional responsibility, not a variable in the strategy design.
C. Reporting the breach and the regulatory response: This is a separate compliance or legal process that may run in parallel but is distinct from the internal audit follow-up on control deficiencies.

1. ACAMS. (2023). Advanced CAMS-Audit Certification Study Guide. Chapter 5: Audit Reporting and Follow-Up. This chapter details the process of tracking audit findings, emphasizing the importance of management action plans that include specific timelines and responsible parties for follow-up.

2. The Institute of Internal Auditors (IIA). (2017). International Standards for the Professional Practice of Internal Auditing (Standards). Standard 2500: Monitoring Progress. This standard mandates that a follow-up process be established to monitor and ensure that management actions have been effectively implemented.

3. Basel Committee on Banking Supervision (BCBS). (2012). The internal audit function in banks. p. 15, para. 51. The document states that the internal audit function must have a process to follow up on its findings and recommendations to ensure they are addressed.

When assessing controls for non-profit organizations (NPOs) vulnerable to terrorist financing (TF), an auditor must focus on fundamental AML/CFT control processes. Ongoing due diligence and transaction scrutiny (A) are critical for monitoring how funds are used and detecting deviations from the NPO's stated purpose. Verifying customer identity with reliable documents (D) is the foundational step of Customer Due Diligence (CDD) to ensure the NPO and its principals are legitimate. These two controls are essential for mitigating the risk of NPOs being used as conduits for TF.

B. This describes a TF risk typology (how abuse occurs), not a control measure that an FI implements and an auditor assesses.
C. This is another description of a TF methodology. The auditor's role is to test the controls designed to prevent or detect such diversion.
E. While cash activity may be reviewed during an audit, the aggregate volume is a data point, not a specific control for assessing TF adequacy.

1. Financial Action Task Force (FATF). (2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation – The FATF Recommendations. FATF, Paris, France. (Interpretive Note to Recommendation 10 - Customer Due Diligence, pp. 57-61).

2. Financial Action Task Force (FATF). (2015). Best Practices on Combating the Abuse of Non-Profit Organisations (Recommendation 8). FATF, Paris, France. (Section III, B. "Measures for Financial Institutions and DNFBPs", p. 13).

3. ACAMS. (2022). Advanced CAMS-Audit Certification Study Guide. Chapter 2: "Audit Universe and High-Risk Areas," Section on Non-Profit Organizations, discusses the importance of robust CDD and ongoing monitoring controls.

Considering KYC requirements a low priority and implementing them after a product launch represents the most significant risk because it is a fundamental, systemic failure at the governance and design level. This "compliance-by-afterthought" approach guarantees that the institution will onboard new clients without performing adequate due diligence from the outset. It exposes the organization to unmitigated and unknown risks, as high-risk customers can enter through this uncontrolled channel. This indicates a poor compliance culture and a breakdown in the "three lines of defense" model, making it a more severe issue than operational backlogs or integration problems.

B. While annual updates for sanctions lists are dangerously infrequent, the finding in A represents a complete failure to apply any KYC at product inception.
C. Lack of integration is a serious operational flaw, but it is often a symptom of the root cause described in option A.
D. Backlogs are an operational issue indicating a process is struggling, but option A indicates the process was not even designed or implemented correctly at the start.

1. ACAMS. (2021). Advanced CAMS-Audit Certification Examination Study Guide, Chapter 2: The Audit Process, Section: "Compliance by Design," p. 35. (Emphasizes the need to embed compliance requirements into the design of products and processes from the beginning).

2. Financial Action Task Force (FATF). (2012-2023). International Standards on Combating Money Laundering and the Financing of Terrorism & Proliferation, Recommendation 10: Customer Due Diligence. (Mandates that CDD measures be taken when establishing business relations).

3. Basel Committee on Banking Supervision. (2016). Sound management of risks related to money laundering and financing of terrorism, Guideline 3: "Group-wide AML/CFT programme," para. 20(d). (Requires policies for new products to assess and mitigate risks).

After testing and tuning parameters and thresholds, an independent model validation is the necessary final step. Model validation is a comprehensive process that assesses the model's conceptual soundness, reviews the tuning and testing process, and evaluates its outcomes to ensure it is functioning effectively and appropriately for its purpose. This provides an objective verification that the model is sound and fit for purpose before it is fully implemented or post-changes.

B. Audit continuous monitoring: This is an ongoing assurance activity performed by the audit function, not a final verification step of the model tuning process itself.
C. Data validation: This is a critical step that should be performed before and during the tuning process to ensure the data feeding the model is accurate and complete, not the final step after.
D. Regulatory approvals: While regulators expect sound model risk management, seeking their explicit approval is not a standard technical verification step in the model lifecycle.

1. Office of the Comptroller of the Currency (OCC), "Supervisory Guidance on Model Risk Management," OCC Bulletin 2011-12, April 4, 2011, Pages 12-14. This guidance defines model validation as "the set of processes and activities intended to verify that models are performing as expected" and describes it as a crucial, independent component of model risk management.

2. ACAMS Advanced CAMS-Audit Certification Study Guide, Chapter 4: "Auditing Specific AML/CFT Areas," Section on Transaction Monitoring Systems. The guide emphasizes the importance of independent validation as part of the model governance lifecycle.