Exam Readiness Scorecard

How to use the Exam Readiness Scorecard

Work through each of the seven input areas and answer based on your current documented reality, not where you expect to be by the next examination date. Examiners will look at evidence, so if a control exists in practice but is not formally documented, treat it as partial or incomplete for scoring purposes.

The seven areas you will assess:

• Enterprise AML risk assessment, Is there a current, written risk assessment that reflects your institution's business lines, products, customers, and geographies?
• Policies and procedures, Do your written P&Ps map explicitly to the regulations that apply to you, and have they been reviewed recently?
• Independent testing, Has an independent audit or third-party review of your AML program run within the last 12 to 18 months?
• Role-based training, Is training delivered to relevant staff, tracked by completion, and retained as evidence?
• SAR/STR documentation, Are suspicious activity decisions made promptly, documented with a clear rationale, and filed within required timeframes?
• Management information and board reporting, Is AML performance data reported regularly to senior management and the board, and is that reporting retained?
• Remediation of prior findings, If examiners or auditors identified deficiencies previously, is there a documented corrective action plan with measurable milestones?

For each area, select the option that most accurately reflects your current state. When in doubt, select the more conservative answer. Overestimating readiness does not help you prepare.

What the result means

Your score falls into an interpretation band that indicates where your program sits relative to examination expectations. A high score suggests your documented controls are comprehensive and current. A lower score identifies specific pillars where your program may draw scrutiny.

Treat the result as a prioritisation tool, not a guarantee. A score in the upper band means your documentation is strong across all seven areas; it does not mean an examination will find nothing. Examiners also assess transaction monitoring effectiveness, customer due diligence quality, and other factors not captured here.

If your score flags one or two specific areas, those are your remediation priorities before the next examination cycle. Document the gap, assign an owner, set a deadline, and track progress formally. That paper trail itself demonstrates a culture of compliance.

If the score flags four or more areas, consider a fuller gap assessment before committing to a remediation sequence, because dependencies between pillars matter. For example, weak risk assessment documentation will undermine the rationale for your monitoring thresholds and your training content.

Why this matters for compliance teams

Regulatory examinations of AML programs follow a consistent structure across most jurisdictions. Examiners review the same foundational pillars every time: governance, risk assessment, written controls, testing, training, suspicious activity reporting, and remediation of prior issues. This scorecard mirrors that structure directly.

The cost of arriving at an examination unprepared is concrete. Findings lead to matters requiring attention, corrective action plans, and in serious cases, formal enforcement actions that require board-level sign-off and public disclosure. The operational burden of managing a post-examination remediation program is significant, and the reputational impact can affect correspondent banking relationships and licensing.

A structured pre-examination review also helps MLROs and compliance officers have productive conversations with their boards and executive leadership. Rather than describing AML readiness in qualitative terms, a scored assessment creates a common reference point and makes resourcing conversations easier.

FluxForce built this tool because compliance teams often lack a quick, structured way to take stock before an examination cycle begins. It does not replace a formal gap analysis or legal review, but it gives you an honest starting point in minutes rather than weeks.