Auditor, QA reviewer and executive
The oversight roles: auditors read everything and act on nothing, QA reviewers test closures, executives see aggregate figures.
tocOn this page
Three roles oversee the AML programme rather than run it. The auditor tests it independently and can read almost everything, but can change nothing. The QA reviewer checks the quality of alert closures. The executive follows the programme through aggregate dashboards, with no access to individual cases. Each role is deliberately narrow, so that oversight never becomes a back door into investigation or reporting.
Auditor
The auditor role suits internal audit and, where your institution grants access, a regulator's examiner.
What you can do
- Read the Audit trail: recent audited activity (When, Module, Entity, Action, Principal) and Chain integrity, which re-verifies every module's hash chain each time you open the page.
- Run Regulator reviews: population, sample size and exceptions, with Record a finding and Concur.
- Read alerts and cases, including STR-restricted cases, for independent testing. You see the read-only view: "Read-only view: your role can review alerts and cases but not act on them."
- Read the STR and CTR registers on Reporting and the Reporting KPIs dashboard.
- Read rules, rule versions, backtests and rule performance.
- Read customers, accounts, risk ratings, EDD cases and the EWRA.
- Open every dashboard, including Operations & SLA, Customer risk and AI usage.
What you cannot do
- Act on anything: no claiming, closing, deciding, approving, proposing or editing.
- Change settings, lists, rules or models.
Note: Your reading is itself audited. Revealing a masked identifier, exporting a register or downloading a report is recorded under your name, like everyone else's.
QA reviewer
The QA reviewer is second-line quality assurance on alert work.
What you can do
- Review sampled alert closures on QA review (
/qa): Pass or Return for rework. A returned alert reopens with its history and shows "Returned by QA — rework" to the analyst. - Read alerts and cases (read-only view) and use Link analysis.
- See Rule performance and the dashboards, including Operations & SLA.
By default, 10% of closures are sampled, with at least one from every bulk batch. Your institution sets the share in the alert-work policy.
What you cannot do
- Close, claim or assign alerts, or work cases.
- QA a closure you made yourself (if you also hold an analyst role).
- See STR-restricted cases or STR material.
- Read customer profiles.
Executive
The executive role is for the board and senior management.
What you can do
- Open the aggregate dashboards: Executive overview, Transaction monitoring, Screening, Securities and My dashboard.
- Use the analytics pages: Analytics workspace and Pivot analytics, and view the Metric designer.
- Change the period, compare to the previous period and export figures. Every export is recorded under your name.
What you cannot do
- See any alert, case, customer or STR. Figures that would reveal STR activity are shown only to STR-privileged roles.
- Open Operations & SLA, which needs case access, or Customer risk, which needs customer access.
- Approve or change anything.
Tip: Build My dashboard with the widgets you check at every board meeting: select Customise, then Add a widget, then Save dashboard.
Where you work
| Page | Route | What for | Roles |
|---|---|---|---|
| Audit trail | /audit |
Audited activity and chain integrity | Auditor |
| Regulator reviews | /regulator/reviews |
Sample reviews and findings | Auditor |
| Reporting and Reporting KPIs | /reporting, /dashboards/reporting |
STR and CTR registers, filing KPIs | Auditor |
| Alerts & cases | /alerts |
Read-only queue and cases | Auditor, QA reviewer |
| QA review | /qa |
Sampled closures | QA reviewer |
| Customers | /customers |
Read-only profiles | Auditor |
| EWRA | /risk/ewra |
Enterprise-wide risk assessment | Auditor |
| Dashboards | /dashboards |
The dashboards your role can open | All three |
| Executive overview | /dashboards/executive |
Headline figures against the previous period | All three |
| Analytics workspace | /analytics |
Typology trends and the typology radar | All three |
What needs a second person
These roles are mostly checkers, not makers:
- The QA reviewer is the second person on an alert closure. You cannot review your own closure.
- The auditor makes no regulated changes, so nothing the auditor does needs approval. Record a finding and Concur are part of the review record.
- The executive approves nothing in FlowSentry.
Your first steps
- Sign in and enrol an authenticator app from the user menu under Security & MFA.
- Open Dashboards to see the gallery of dashboards your role can open.
- Auditors: open the Audit trail and confirm "chain intact", then start a Regulator reviews sample.
- QA reviewers: open QA review and work the oldest sampled closures first.
- Executives: open Executive overview, set the period to QTD and compare to the previous period.