Which step should the auditor take next?

Suspicious activity report testing in the last three audits did not identify any metrics to indicate that volume vanes dramatically each month.

Which step should the auditor take next?
A . Assign to continuous monitoring.
B . Include the lack of metrics as a deficiency in the reporting.
C . Escalate the finding regarding the lack of metrics to the board of directors.
D . Review within the IT audit.

Answer: B

Explanation:

Deficiency in Reporting Metrics:

AML compliance frameworks require metrics to track trends and unusual patterns in suspicious activity reports (SARs). A lack of such metrics is a deficiency that undermines monitoring and oversight.

Why This is the Appropriate Step:

Identifying and documenting deficiencies ensures accountability and facilitates corrective action, aligning with AML audit standards.