Screening tools matter, but auditors judge the evidence trail more than the vendor logo. In our anti-money-laundering audit checks we ask three practical questions.
Was the customer screened at onboarding and on a defined refresh cycle?
If refresh only happens when someone remembers, the control is informal. We look for batch logs or case records that show who was screened and when.
How are potential matches disposed?
A closed alert without a short rationale is a soft finding; a closed alert that clearly confuses two similarly named parties without checking dates of birth is a hard one.
Can staff reproduce the decision?
If only one senior officer understands the screening queue, holiday coverage becomes a risk. We often recommend a second reviewer for true matches and a simple disposal taxonomy for false positives.