Building a CDD sample that survives audit committee questions
How to weight customer files by risk band so sample results explain more than a random draw.
Random samples feel fair and often disappoint audit committees. When ninety percent of your book is low-risk retail remittance, a pure random draw barely touches the corridors that keep the MLRO awake.
Start from the risk assessment
Pull the segments named in your latest money-laundering risk assessment — nationality mixes, product types, delivery channels. Assign minimum counts to high-risk and medium-risk bands before filling the rest of the sample with low-risk files. Document the rule in one paragraph; external auditors will ask for it.
Keep the population honest
Exclude closed accounts only if your testing objective is live controls. If the question is “did onboarding work last year?”, closed files belong in the population. Mixing objectives mid-way produces findings nobody can interpret.
Record why a file was skipped
Corrupt scans, missing systems IDs, or legal holds happen. Log replacements with the original ID. Silent swaps are the fastest way to lose trust in the sample during fieldwork.
What we see in Hong Kong practice
Money service operators often under-sample walk-in high-value corridors because those files live in a separate cabinet. Name that cabinet in the population extract before day one of testing.