Which entity may conduct Independent Testing according to the Pillars of BSA?

Which entity may conduct Independent Testing according to the Pillars of BSA?

• A. Internal audit department
• B. Compliance department
• C. Board of Directors
• D. Customers

Answer: (A)

Independent testing must come from an entity that is separate from the day-to-day BSA/AML operations so the review is objective. The internal audit department fits this role because its function is designed to be independent of management, with access to evidence, processes, and the authority to report findings up to the board or audit committee. This independence is what allows it to credibly assess whether controls, policies, and procedures are effective and being followed.

Compliance departments, while central to implementing controls, are part of management and may not provide the same level of impartial review. The board provides governance oversight but typically relies on reports from management and internal audit rather than performing the testing itself. Customers are external to the institution and do not conduct internal testing.

So, internal audit is the entity that may conduct Independent Testing in the Pillars of BSA.