What does an LFMC internal audit actually test?
The audit scope should reflect the activities and risks of the fund manager rather than simply copying the same checklist used for every financial institution.
For smaller fund managers, some of the areas we commonly consider are:
| Area | What the internal audit may actually test |
|---|---|
| AML/CFT | Sample KYC files, periodic reviews, screening, source of wealth, transaction monitoring where relevant and whether review deadlines were met |
| Risk management and internal controls | Whether the controls described in the firm’s policies are actually being performed and whether risks are being identified, monitored and reported |
| Technology risk management | Access controls, technology vendor oversight, cybersecurity governance, incident processes and evidence that management is actually reviewing technology risks |
| Business continuity management | Critical business services, recovery arrangements, testing and whether the required independent BCM audit has been completed |
| Outsourcing and third parties | Whether important service providers were assessed before appointment and continue to be monitored |
AML/CFT is often one of the most important areas because weaknesses in customer due diligence can expose the firm to significant regulatory and financial crime risk.
Technology risk is also becoming more important as fund managers become increasingly dependent on cloud platforms, external technology vendors and AI tools.
The scope should still remain proportionate. A five-person fund management company with a relatively small number of institutional investors should not automatically be audited in the same way as a bank with thousands of employees and millions of customer transactions.
How do you test whether a control is actually working?
A good internal audit does not simply confirm that a policy exists.
Suppose the fund manager’s technology risk policy says that senior management periodically reviews the performance and cybersecurity reports of its IT service provider.
The auditor should ask for evidence that the review happened. This could include emails, meeting records, management acknowledgements, vendor reports or other documentation showing that senior management actually received and considered the information.
If the vendor has been sending quarterly cybersecurity reports but nobody in management ever reads or acknowledges them, the control is not really operating.
The same principle applies to AML/CFT. If the firm’s procedures require customers to undergo periodic reviews within prescribed internal timelines, we may select a sample of actual customer files and check whether those reviews were completed on time.
We may also review how screening alerts were cleared. Recording an alert as a “false positive” is much less useful if nobody documented why the alert was considered false.
This is the difference between reviewing the design of a control and testing whether the control actually works.
One of the most common findings is simply that somebody forgot
Not every internal audit finding involves a major regulatory breach.
Quite often, a deadline was simply missed.
Smaller fund managers may not have sophisticated software reminding them whenever a policy, register, risk assessment or internal review is due. Someone writes an annual review requirement into a policy, the year passes, everyone gets busy and the review quietly slips through the cracks.
Then the auditor asks for evidence of the annual review.
Management sometimes responds by asking:
“Does MAS actually require us to review this every year?”
MAS may not have prescribed that exact annual frequency.
The problem is that the company prescribed it itself.
If your own policy says that a register or risk assessment will be reviewed annually, but the review repeatedly does not happen, that tells the auditor something about the effectiveness of the firm’s control environment.
There is a practical lesson here too. Do not fill your policies with unnecessarily ambitious controls simply because they sound impressive.
If you commit to a control in your procedures, make sure the business can actually perform it.
Why smaller fund managers need a proportionate audit
Proportionality matters greatly when auditing smaller financial institutions.
MAS’s fund management framework takes the scale, nature and complexity of the business into account, rather than expecting every regulated firm to build the same governance infrastructure.
A good auditor should therefore understand why a control exists before deciding that the client has failed to meet it.
A five-person LFMC cannot reasonably operate every control in exactly the same manner as a major financial institution with hundreds of employees.
That does not mean the small firm gets to ignore risk.
It means the auditor should ask whether the firm has implemented a reasonable alternative that still achieves the purpose of the control.
For example, a small manager may have much more direct senior-management oversight because the CEO and directors are personally involved in day-to-day operations. It may not need multiple layers of committees to achieve the same degree of oversight.
MAS’s Individual Accountability and Conduct guidelines allow firms to adapt the specific guidance to the nature, size and complexity of their business, while still achieving the five accountability and conduct outcomes. MAS may require particular measures where accountability or oversight gaps warrant them.[2] In practice, the auditor should assess whether the firm’s arrangements achieve those outcomes, rather than expect every small firm to have a bank’s committee structure.
The auditor should assess whether the arrangement works, rather than faulting the firm simply because its organisational chart does not look like a bank.
Proportionality does not mean ignoring the regulatory objective. It means achieving that objective in a way that makes sense for the size and risks of the business.
How often should an LFMC conduct an internal audit?
Paragraph 3.17 of the FMC guidelines calls for adequate, proportionate internal audit; it does not set one annual timetable for all areas. Paragraph 3.18 separately addresses annual audits.[1]
For smaller firms, our practical view is that a broader internal audit every two to three years can be reasonable depending on the size, risk profile, activities and pace of growth of the business.
That is a professional recommendation, not a universal MAS-mandated frequency.
A rapidly expanding fund manager with heavier compliance operations, more investors, more complex strategies or significant transaction activity may justify more frequent independent reviews.
Certain regulatory areas also have their own specific expectations.
Business continuity management is a good example. Under MAS’s BCM guidelines, an FI should audit its overall BCM framework and the BCM of each critical business service at least once every three years. The auditor should have relevant BCM expertise and be independent of the unit or function responsible for BCM.[3]
Higher-risk areas such as AML/CFT, transaction monitoring where applicable, technology risk or important risk-management controls may similarly deserve more frequent attention even where the firm does not perform a full enterprise-wide internal audit every year.
The audit frequency should therefore follow the risk.
Can an LFMC outsource its internal audit?
Yes.
MAS’s fund management framework allows internal audit to be performed by the firm’s own internal audit function, a head-office internal audit team or an outsourced third-party service provider.[1]
This is particularly useful for smaller fund managers that do not have sufficient scale to maintain a dedicated internal audit team.
The more important question is whether the auditor is competent and sufficiently experienced to understand the areas being reviewed.
For example, an auditor reviewing AML/CFT should understand customer due diligence, source of wealth, screening and applicable financial crime controls.
Someone reviewing technology risk governance should understand MAS expectations around technology, cybersecurity, access management and vendor oversight.
The person does not need to pretend to possess every specialist skill.
I am comfortable reviewing technology risk management governance, vendor oversight, access-control governance and the management controls surrounding cybersecurity. I would not represent myself as a penetration tester or technical cybersecurity engineer.
Knowing where specialist technical expertise is required is itself part of conducting the audit properly.
Does an internal auditor need to be an accounting firm?
Not necessarily.
Paragraph 3.17 permits third-party internal audit without prescribing a particular professional designation. That should not be confused with the separate annual audit requirements in paragraph 3.18.[1] Relevant expertise and any other applicable requirements still need to be assessed.
That makes sense when you consider what the work actually involves.
An internal audit may be checking whether AML reviews were performed, whether access controls work, whether outsourcing reviews happened, whether risk registers were updated, whether management received the reports it was supposed to receive and whether procedures written into the firm’s policies were actually followed.
There may be no accounting calculation involved at all.
What matters is whether the provider has the competence and relevant experience to review the subject matter properly.
We have received industry feedback that internal audit engagements with larger audit firms can cost S$10,000 or more depending on the scope and provider. Smaller fund managers therefore sometimes use boutique audit providers with leaner teams and a narrower scope.
The size of the audit firm’s brand does not determine whether an internal audit is useful.
A proportionate audit performed by an experienced reviewer may be far more useful to a small LFMC than an expensive exercise that applies a generic institutional checklist to every client.
What happens when the auditor finds a control failure?
Not every finding should be treated as equally serious.
A lower-level observation might identify weak documentation, an opportunity to make a process clearer or an improvement that would strengthen an otherwise functioning control.
A higher-level finding is different. It may involve an important control not being performed at all, repeated failure to comply with an internal procedure or a gap that creates meaningful regulatory or financial crime risk.
The audit report should therefore explain:
- What was tested
- What the auditor found
- Why it matters
- How serious the finding is
- What management has agreed to do
- When remediation should be completed
The process should not end when the final report is sent to management.
Someone should track the findings and confirm that agreed remediation has actually been completed.
Otherwise the internal audit simply becomes another document sitting in a folder.
Internal audit is ultimately a test of whether the company does what it says
This is probably the simplest way to understand the exercise.
During licensing, a fund manager puts together policies, risk frameworks and controls explaining how it intends to operate.
Internal audit comes back later and asks whether those controls survived contact with reality.
For smaller LFMCs, the review should be practical and proportionate. It should concentrate on risks that genuinely matter, test actual evidence rather than merely reading policies, and identify weaknesses before they turn into larger regulatory problems.
The objective is not to produce the longest internal audit report.
It is to give management an answer to a much more useful question:
Are our controls actually working?
Need an internal audit?
Advisors Assemble provides internal audit support for Singapore fund managers and other regulated financial institutions.
I have worked on more than 30 internal audit engagements across areas including AML/CFT, risk management, technology risk, business continuity, outsourcing and regulatory compliance.
Our approach for smaller regulated firms is straightforward. We identify the risks that actually matter, test whether important controls work in practice and apply the same principle of proportionality that runs through the MAS regulatory framework.
If you are planning an internal audit, review our internal audit scope and fees or discuss your fund manager’s audit requirements. We agree the scope and confirm independence before accepting an engagement. If AA conducts your internal audit, we cannot also act as your compliance adviser at the same time.
For a related practical guide, see our article on fund management compliance monitoring.
This guide provides general regulatory information and does not constitute advice on a particular firm’s internal audit obligations. The appropriate scope, frequency and audit arrangements depend on the firm’s licence, activities, size, complexity and applicable MAS requirements.
Reviewed on 17 October 2026.
Sources
- [1]
Monetary Authority of Singapore, Guidelines on Licensing and Conduct of Business for Fund Management Companies. Revised 3 September 2025; paragraphs 3.17–3.18.
- [2]
Monetary Authority of Singapore, Guidelines on Individual Accountability and Conduct. Introduction paragraphs 4–5.
- [3]
Monetary Authority of Singapore, Guidelines on Business Continuity Management. June 2022; paragraphs 8.1–8.3.