Sampling high-risk KYC files without exhausting the vault

A full population review of every customer due diligence file is rarely feasible for mid-size books. Supervisors nonetheless expect high-risk and recently onboarded relationships to receive heavier attention. Risk-weighted sampling is how we reconcile those pressures during a KYC record verification audit.

Stratify before you draw

Start with the firm’s own risk tiers, then check whether the tags still match reality — a dormant “high” tag on a closed product line wastes vault time. Add a stratum for new corporates even if they sit in medium risk, because ownership evidence defects concentrate there.

Agree exclusions early

Files under active suspicious transaction review should usually sit outside the sample. So should accounts already scheduled for exit. Document those exclusions in the methodology note so later readers do not assume cherry-picking.

Vault logistics

On-site sampling in Central works when originals never leave the premises. Batch request lists the day before fieldwork; idle auditors waiting on a single clerk inflate fees without improving assurance. Remote image review is fine when certification stamps remain legible at screen resolution.