Pre-Audit Mock Reviews — How to Catch Findings Before AUSTRAC Does
An AUSTRAC compliance assessment is the most consequential interaction an Australian pub or club has with a federal regulator. The findings that come out of one shape the venue’s penalty exposure, its standing with state regulators, and its ability to operate normally for months afterwards. A pre-audit mock review is the deliberate simulation of that engagement, conducted privately first, so the venue knows what AUSTRAC would find before AUSTRAC arrives. Here is how it works and when to use it.
What a Pre-Audit Mock Review Is
A pre-audit mock review is a focused, structured exercise designed to mirror an AUSTRAC compliance assessment as closely as possible. The reviewer plays the role of the AUSTRAC compliance officer for the duration of the exercise; the venue responds as it would to a real assessment.
The output is a written report identifying everything the venue would likely be asked to fix in a real engagement, with priority and timing for remediation. The venue then has the option to address the findings in a controlled, non-public way before the regulator engages.
This is not the same as a half-day review or a full independent evaluation. A half-day review is triage. A full independent evaluation is the formal exercise the AML/CTF Act and AUSTRAC’s guidance contemplate. A pre-audit mock review is a deliberate AUSTRAC simulation, deeper than triage, narrower in some respects than a full evaluation, and tuned specifically to the regulator’s likely engagement pattern.
When to Run One
Trigger 1 — Active regulator engagement
The venue has had informal contact with AUSTRAC, has received a request for information, has been notified of an upcoming compliance assessment, or has had an incident that the regulator is aware of. Time is short and the venue needs to know its exposure.
Trigger 2 — Sector signal
AUSTRAC has signalled increased attention to the pub-and-club sector (which it has, since 2022). Other venues in similar circumstances have received enforcement action. The venue’s leadership wants to know how it would fare if the regulator’s attention turned to it.
Trigger 3 — Post-incident
An incident has occurred at the venue that may have AML/CTF implications — an SMR considered or filed in unusual circumstances, a breach of self-exclusion that escalated, a regulator-flagged transaction. The mock review tests whether the venue’s broader program would survive scrutiny prompted by the incident.
Trigger 4 — Ownership transition
The venue is being sold, or the parent group is undergoing M&A activity. Buyers want assurance about the AML/CTF posture; sellers want documented evidence of compliance health. A mock review provides both sides.
Trigger 5 — Major program change
The venue has implemented a new platform, restructured its compliance officer role, or rebuilt its program. The mock review tests whether the change has produced the operational improvement intended.
The Engagement Pattern
Pre-engagement document review
The venue provides the same documents AUSTRAC would request: the AML/CTF program (Part A and Part B), risk assessment, recent compliance reports, prior independent evaluation reports, training records, governance minutes, sample SMRs (with appropriate handling), policy documents. We review them off site.
On-site engagement (typically 2 to 5 days)
Compliance officer working sessions, floor observation, staff interviews, patron file testing across a defined window (typically 90 days), governance review, system architecture review, tipping-off control test. We work the way AUSTRAC works.
Patron file deep-dive
The defining test of an AUSTRAC compliance assessment. We pick five to ten patrons and ask the venue to produce the full file across the test window. The exercise reveals everything: are records connected, are decisions documented, can the venue reconstruct what it knew at the time of each significant interaction.
Scenario-based staff competence test
We walk staff through scenarios — what would you do if a patron showed structuring patterns; what is your escalation path if you suspect tipping-off; how would you handle a self-excluded patron attempting entry. The answers reveal whether training has produced retained competence.
Written report
Each finding categorised by severity, with recommended remediation, suggested timing, and a comparison to how AUSTRAC would likely respond to the same finding. The report is structured to allow the venue’s leadership to triage the response.
What the Mock Review Reveals
Across the mock reviews we have run, the findings cluster predictably. The most common, in roughly the order they emerge:
- The risk assessment is generic or stale.
- The patron file cannot be produced cleanly across the 90-day window.
- Risk tier is documented but not visible at the payout.
- PEP screening has drifted past validity for some patrons.
- SMR records sit in a system architecture that creates section 123 risk.
- Floor staff cannot articulate the escalation path under scenario pressure.
- Compliance officer time allocation is insufficient for the workload.
- Independent evaluation history is absent or out of date.
- Governance reporting cadence is inconsistent with what the program describes.
None of these findings are fatal individually. The pattern in aggregate is what makes them serious in a real AUSTRAC engagement. Mock reviews give the venue the chance to address the pattern before it becomes a disclosed regulatory matter.
What Happens After the Review
The venue receives the report and decides how to act. Three typical paths:
- Quick remediation. The findings are addressable in 4 to 8 weeks with focused effort. The compliance officer leads the remediation; the platform supports the changes; the program is updated and re-approved by the board.
- Project remediation. The findings are larger — new platform, program rewrite, additional resourcing, possibly an independent program redesign engagement with AML/CTF consultants. The mock review becomes the scoping document for a 3 to 6 month project.
- Voluntary disclosure. The findings include matters the venue feels should be self-disclosed to AUSTRAC (a missed SMR, an unfiled compliance report, a substantial program gap). This decision is taken with legal advice; the mock review provides the factual basis.
The mock review’s value is enabling the venue to choose its response on its own timeline rather than under the pressure of a real engagement.
Frequently Asked Questions
Will the mock review report be disclosed to AUSTRAC?
The report is the venue’s. AUSTRAC may ask to see it during a real compliance assessment. Where it has been used to drive genuine remediation, the report is helpful evidence of good-faith program management; where it has been ignored, AUSTRAC’s response is materially worse than it would be without the report.
How is this different from an independent evaluation?
An independent evaluation is the formal exercise the Act and guidance contemplate, conducted on a regular cadence. A pre-audit mock review is a tactical engagement triggered by specific circumstances. The two can be combined where appropriate.
How long does a mock review take?
Two to five days on site for a single venue, longer for multi-venue groups. Pre-engagement document review and post-engagement reporting add another two to three weeks.
Should we tell our staff we’re doing a mock review?
Generally yes for the compliance officer and senior management; no for floor staff. Floor staff scenario testing produces more accurate results when staff are not coached for the encounter.
Does our existing AML/CTF consultant do this?
Possibly — some consulting firms run pre-audit mock reviews. The independence test is whether the firm running the mock review is the same firm that wrote the program. Where it is, the conflict is real and the mock review’s value is diminished. RCA Group is independent of program design.
Pre-Audit Mock Review — Find Out Privately
RCA Group runs pre-audit mock reviews for Australian pubs, clubs, and RSLs. The same engagement AUSTRAC would run, conducted privately first.
References
- Anti-Money Laundering and Counter-Terrorism Financing Act 2006 (Cth) — legislation.gov.au
- AUSTRAC, Compliance assessments — austrac.gov.au
- AUSTRAC, Independent evaluation — austrac.gov.au
- AUSTRAC, Pubs and clubs guidance — austrac.gov.au