Perform Second Line Control Testing

Purpose

Test key controls independently of first-line operation and provide timely challenge, escalation and remediation.

Steps

1. Develop a risk-based testing plan using the control inventory, indicators, incidents, changes and prior results.
2. Define objective, population, sample, period, criteria, tester independence and required evidence.
3. Test design and operation separately and record exceptions without unsupported inference.
4. Include thematic coverage of key AML/CFT/CPF controls per the manual’s section 4.2:
   • onboarding approval controls by risk tier;
   • source of funds and source of wealth requirements;
   • sanctions screening coverage and tool governance;
   • false-positive closure rationale;
   • unresolved-alert stop controls;
   • internal escalation and case-classification processes;
   • UTR decisioning and reporting controls;
   • wallet or transaction tracing practices in escalated cases; and
   • periodic review cadence and file completeness by risk classification.
5. Validate exceptions with the control owner and assess severity, cause, scope and regulatory implications.
6. Document conclusion, finding, management response, owner and due date.
7. Escalate material failures and overdue actions through governance. Testing outcomes, remediation actions, and overdue items must be tracked and reported through the governance framework.
8. Perform follow-up testing before closure.
9. Report trends and repeat weaknesses to management and the Board.

Exceptions and Escalation

The control owner shall not perform the independent test. Missing evidence is treated as a failed assertion unless reliable alternative evidence is established.

Records

• Testing plan and methodology
• Population, sample and evidence
• Testing sheet and exceptions
• Finding and management response
• Follow-up and closure verification

Relationships

• Policy: POL-ICA-001 Internal Controls and Audit Manual
• Process: PRC-RSA-001 Resilience Systems and Assurance
• Control: CTRL-ICA-004 Ensure Second Line Control Testing Is Effective

Assurance

Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.

• Frequency: quarterly or risk-based

History

• 2026-07-26: Created from section 4.2 of the approved ICA Manual.