Independent Review Obligations for Accounting Firms
What AUSTRAC's independent review requirement means for accounting firms, how often it's due, and what a compliant review actually checks.
An independent review is a periodic, arms-length check on whether an accounting firm's AML/CTF Programme is actually working in practice — not just documented on paper — and the AML/CTF Act 2006 requires every Tranche 2 reporting entity to complete one, typically every one to three years depending on its own risk assessment.
What does an independent review actually check?
An independent review tests whether the AML/CTF Programme is followed day to day, not merely whether it exists. A reviewer typically examines: - Programme currency — whether the Part A and Part B documents still reflect the firm's actual services and client base - CDD file quality — a sample of client files checked against the programme's verification standard - SMR and TTR timeliness — whether reportable matters were lodged within statutory timeframes - Training records — whether staff completed AML/CTF training at the committed frequency
Who can conduct the review?
The reviewer must be independent of the compliance function being assessed — someone who didn't design or operate the programme under review. Smaller firms typically engage an external AML/CTF consultant; larger firms may use an internal audit function, provided it sits outside the AMLCO's reporting line. AUSTRAC doesn't accredit reviewers, but a firm should be able to justify the reviewer's independence if asked.
How often is an independent review required?
The AML/CTF Act 2006 doesn't fix a single interval — frequency is set out in the firm's own AML/CTF Programme and calibrated to its ML/TF risk rating. AUSTRAC's guidance points to a one- to three-year cycle for most Tranche 2 accounting firms, with higher-risk client bases sitting at the shorter end. Whatever interval the programme states becomes a commitment AUSTRAC can test.
What happens after the review?
- Findings are documented in a written report identifying gaps between the programme as designed and as operated
- A remediation plan is agreed, with an owner and deadline for each finding
- The AMLCO reports outcomes to the board or responsible partner
- The programme is updated where a provision no longer fits how the firm operates
- An unactioned finding left open for years signals the firm knew about a weakness and chose not to fix it — AUSTRAC treats that as worse than the original gap.
Key Takeaways
- Independent review tests whether the AML/CTF Programme is actually followed, not just whether it's written down
- The reviewer must sit outside the compliance function that designed and runs the programme
- Most accounting firms should plan for a review every one to three years, set by their own risk assessment
- Findings need a documented remediation plan — an open finding left unaddressed is worse than the original gap
- AMLify for accountants tracks the review due date and stores findings alongside the programme itself
Frequently Asked Questions
Q: Is an independent review the same as an AUSTRAC audit?
No. An independent review is an obligation the firm arranges and pays for itself. An AUSTRAC audit is a regulatory action AUSTRAC initiates and controls. A well-run review reduces the risk of adverse findings if AUSTRAC does examine the firm.
Q: Does a sole practitioner accounting firm still need one?
Yes. The obligation applies to any reporting entity with an AML/CTF Programme, regardless of size. A sole practitioner can engage an external consultant for a proportionate, lower-cost review instead of building an internal audit function.
Q: Can the AMLCO conduct the review themselves?
No. The AMLCO operates the programme day to day, so reviewing their own work wouldn't meet the independence requirement. They can coordinate the process and respond to findings, but the assessment must come from outside that reporting line.
Q: What happens if a firm has never completed one?
There's no grace period — the obligation has been live for every Tranche 2 accounting firm since 1 July 2026. Firms without a completed review should schedule one now, since it's one of the first things AUSTRAC checks in a supervision engagement.
This is general information only and not a substitute for legal advice.