Regulation 21 Independent Audit FAQs [Part 3]

Should a Regulation 21 Independent audit screen staff and assess expertise and knowledge?

A Regulation 21 independent audit looks at skills, knowledge and expertise along with conduct and integrity of current employees. In practical terms this means evaluating the screening process for potential employees along with the performance of relevant employees currently at the firm. The audit will also look at qualifications and reference checks, for example original certificates of achievement particularly in relation to AML or risk management. This is along with credit checks and validating the practicing status of employees. You’ll also focus on annual competence declarations and appraisal procedures along with search engine checks for previous adverse conduct and checking the relevant registers for any disciplinary actions. Again, all checks that may be done on appointment might also be deemed appropriate to recheck during employment on a risk-sensitive basis.

Which members of staff should be considered for a Regulation 21 independent audit?

A relevant employee in the context of screening is someone whose work is relevant to your practice’s compliance with the regulations or someone who is otherwise capable of contributing to (1) the identification or mitigation of money laundering and terrorist financing risks to which your practice is subject or (2) the prevention and detection of money laundering and terrorist financing in relation to your practice. An inclusive approach should be adopted to screening as it will provide assurance that staff in a practice can adequately perform their duties and thus help the practice protect itself. From a business perspective it should also provide the benefit of allowing a practice to more fluidly transfer staff internally.

What can I expect once a HiveRisk external Regulation 21 independent audit has been completed?

You will receive a tailored report from the auditor outlining recommendations and highlighting issues which must be amended or updated to comply with regulator guidance. There will also be suggestions for best practice. These will be focused on matters which aren’t necessarily essential though for which the SRA might flag as needing attention. There will also be a more generalized list of suggestions for good practice which can help smooth over the firm’s overall compliance strategy though aren’t the requirement in the eyes of the regulator.

Further to this there will be a detailed breakdown of all outcomes focused on the areas which were covered in the audits, file reviews, staff interviews and policy controls and procedures. This will highlight specific strengths and weaknesses along with recommendations.

At what point in my firm’s growth should I consider a regulation 21 independent audit?

The regulation states audits should be carried out only where appropriate with regards to size and the nature of the business. Unfortunately this is somewhat ambiguous and has resulted in many smaller firms being caught unawares. The SRA has confirmed that there is no lower limit to the size of regulated firms in relation to abiding by the guidelines. This actually coincides with an increasing number of firms now being fined or sanctioned for breaches or for failing to meet required AML standards. With the SRA now acting in the role of AML supervisor they’ve reinforced the idea that regulators are stringently upholding AML standards and whilst larger firms covering a wide range of disciplines might be at greater risk it is still expected that R21 audits will be conducted and their recommendations put into place for all firms which fall within scope. Findings by the SRA reveal that many firms were relying on external accreditation schemes which in many instances do not address AML compliance. The bottom line is effectively this quote from a regulator “Most firms need to carry out an independent audit. If firms consider that they do not need to carry out an audit they will need to be able to justify this to us.” 

Anecdotally HiveRisk has worked with several small high street practices which deal with largely out of scope work. Whilst there was a small amount of estate agent administration work from local clients the SRA confirmed following a routine visit that it was happy with the firm’s explanation that they did not need a full audit. Though it should be noted that if your firm has a high volume of convincing then it is likely you will need given the inherent high risk nature of this work and independent AML audits.