Every institution runs QA. Whether it's an internal second-line review, a Compliance sampling exercise, or an external auditor pulling files — someone is always going to look at your KYC file after you've moved on from it. The question is whether what they find matches what you actually did.
Most practitioners assume QA is looking for risk. Missing PEP flags, unresolved adverse media, undocumented SOW gaps. Those things matter. But in practice, the most common QA findings aren't about risk misidentification. They're about process invisibility. The reviewer can't tell whether the RM contacted the client or not. There's no record of whether a registry search was run. The file shows a conclusion — "client confirmed, risk assessed" — with nothing behind it to show how that conclusion was reached.
You can't prove a negative. If the outreach happened but the call report doesn't exist, QA has to treat it as if the outreach didn't happen. The file is the only evidence that counts.
This isn't a new problem. It's the oldest problem in KYC. And it keeps recurring because the practitioners who do the work tend to underestimate how invisible good process looks to someone reading the file six months later without the relationship context.
The Sequence That Gets Files Across QA
After sitting across from enough QA reviewers and external auditors, a pattern emerges in the files that hold up versus the ones that don't. It comes down to four things, in order. The order matters as much as the steps themselves.
The first step is client contact. Before anything else — before registry searches, before risk assessments, before documentation is assembled — the client is asked directly. This sounds obvious. In practice, it's skipped more often than it should be, usually because the RM assumes the answer, or assumes it's already on file from a previous cycle. It's not enough to know the answer. The file needs to show the client was asked and what they said.
The second step is independent verification. Registry sources — company registries, land registries, professional body databases — are not optional background checks. They're corroborating evidence that sits independently of what the client told you. Pull them. Screenshot them. Attach them with a date stamp. A verbal "I checked the registry" does not survive a QA review. The screenshot does.
The third step is the one most files get wrong. It's not about what the search returned — it's about documenting that the search happened at all, regardless of the result. A null result is still a result. "Registry search conducted on [date] — no adverse findings" is a documented step. An undated absence of findings is a gap.
The fourth step is where the risk assessment actually belongs — at the end of the process, not the beginning. Too many files show a risk conclusion that precedes the evidence. The rating is assigned, then the documentation is assembled to support it. QA reviewers recognise this pattern immediately. The evidence should inform the conclusion. When it runs the other way, the file reads as post-rationalisation rather than genuine assessment.
What Finding Severity Actually Means for Your Remediation Timeline
When a QA review does surface a finding, the severity classification isn't just administrative. It determines your remediation window and the escalation path. Understanding the difference between a Critical, Major, and Minor finding — and what each requires of you within what timeframe — is the difference between a controlled remediation and a finding that compounds.
Critical findings carry the shortest window and the highest escalation obligation. They typically involve a fundamental breakdown in a required control — not a documentation gap, but an actual failure to conduct a required step. Major findings are more common and usually relate to process gaps that are recoverable but require documented action within a defined period. Minor findings are the ones most practitioners dismiss too quickly — they accumulate, and a pattern of minor findings across multiple files reads as a systemic issue rather than isolated gaps.
The remediation response matters as much as the remediation itself. A finding that's addressed without a documented response — where the gap was closed but the closing wasn't recorded — remains open from a QA perspective. The cycle completes when the evidence of remediation is in the file, not when the underlying issue is resolved.