AML scope and assurance: start with the activity
Identify the relevant AML regime, then connect the business risk assessment to controls, case evidence and review.
Read guideGRC in context
Legal & notarial practices
Connect professional duties, client risk and matter evidence.
Begin with your actual activities.
Check the rules and supervisory arrangements for the precise practice and activity. A solicitor’s obligations and a notary’s arrangements are not interchangeable. Scope AML work, protect confidential and privileged material, control client money where applicable, record decisions and test continuity. Use references to evidence in these tools, not client files.
Scope of this starter pack
General organisational GRC for legal and notarial practices. Solicitor and notarial arrangements are not interchangeable. This route does not determine AML scope, professional compliance, privilege or client-money requirements; use evidence references rather than client files.
Your priorities
- Establish the precise practice, activity and supervisory context before selecting review criteria.
- Trace client and matter risks to the records and escalation decisions that support the work.
- Protect access to confidential evidence while checking continuity and incident responsibilities.
Questions to start with
- Which services are included in the scope assessment, and which professional or supervisory rules apply to each?
- Can a reviewer understand the risk and due-diligence decisions from a selected matter without relying on completion ticks?
- Where are exceptional or contradictory findings escalated, and who may approve the next step?
- How would the practice reach essential records and decision-makers if its case system or usual contact were unavailable?
Bring to the first review
- The activity, supervisor and applicability assessment used for the review.
- Business-risk and procedure references tied to the selected matter types.
- Restricted file references supporting risk, due diligence and exception decisions.
- Continuity or incident exercise findings and completed retest records.
Make the first meeting useful
- Confirm practice and activity boundaries, keeping solicitor and notarial arrangements distinct where relevant.
- Review a suitably selected matter through restricted evidence references, recording both conclusions and sample limits.
- Assign recurring control gaps and test the incident or continuity route for the affected work.
Relevant resources
Follow the evidence into the work.
UK GDPR accountability and DPIA triage
Connect data protection decisions to evidence, and identify when a project needs a data protection impact assessment.
Read guideTest controls and keep an evidence trail
Distinguish a policy being written from a control being designed well and operating consistently.
Read guideIncident and personal data breach escalation
Prepare a clear response route, assess harm and record the reasons for reporting or not reporting a personal data breach.
Read guideLeave the review with a useful record.
Identify the owner, the evidence you have, the gaps and the next decision. Keep the applicable source and scope beside any conclusion.