According to the ACAMS CAMS Study Guide, one of the key elements of an effective anti-money laundering (AML) program is ongoing training for all relevant staff. Training should cover the legal and regulatory obligations, the risks and red flags of money laundering and terrorist financing, the procedures and controls for customer due diligence and transaction monitoring, the reporting and record-keeping requirements, and the roles and responsibilities of the staff and the management. Training should also be tailored to the specific functions and needs of the staff, and should be updated regularly to reflect the changes in the AML environment and the FI's policies and procedures.
PEPs are considered high-risk customers for AML purposes, as they may abuse their positions of power and influence to commit or facilitate corruption, bribery, embezzlement, or other financial crimes. Therefore, it is essential that the FI's staff are aware of the definition and categories of PEPs, the sources and methods to identify and verify PEPs, the enhanced due diligence measures and ongoing monitoring that apply to PEPs, and the escalation and reporting procedures for suspicious activities involving PEPs .
If an internal audit reveals that a large group of employees do not know how to handle PEPs, this indicates a serious gap in the FI's AML training program, which could expose the FI to regulatory sanctions, reputational damage, and legal liabilities. Therefore, the next course of action that should be taken is to create a company-wide training program that covers the relevant aspects of PEPs, and to ensure that the training is delivered to all staff who deal with PEPs or have access to PEP-related information. The training should also be evaluated for its effectiveness and impact, and the results should be reported to the senior management and the board of directors.
References:
ACAMS CAMS Study Guide, 6th Edition, Chapter 2: Developing an Effective Anti-Money Laundering Program, page 51-52 ACAMS CAMS Study Guide, 6th Edition, Chapter 3: Conducting Customer Due Diligence, page 75-78 FATF Guidance: Politically Exposed Persons (Recommendations 12 and 22), June 2013, 1 ACAMS CAMS Study Guide, 6th Edition, Chapter 4: Conducting Ongoing Monitoring, page 97-98 Reference: https://www.acamstoday.org/all-politically-exposed-persons-are-local/

According to the Basel Committee on Banking Supervision guidelines, the internal audit function should evaluate the adequacy and effectiveness of the bank's compliance function and its compliance risk management framework1. This includes assessing the compliance risk inherent in the bank's activities, products, services, and systems, as well as the compliance policies, procedures, controls, and reporting mechanisms2. The internal audit function should also review the transactions and records of the bank to ensure compliance with applicable laws, regulations, and internal standards3.
The other statements are incorrect because:
B: An internal audit program of adequacy of the bank's compliance function should be established, but should not include review of transactions. This statement is false because the internal audit function should review the transactions and records of the bank to ensure compliance, as mentioned above3.
C: The compliance function and internal audit function should be combined. This statement is false because the compliance function and the internal audit function should be separate and independent from each other, to avoid conflicts of interest and ensure objectivity and credibility.
D: The auditors should not discuss internal audit findings with compliance management to maintain independence. This statement is false because the internal audit function should communicate and coordinate with the compliance function on a regular basis, to share information, insights, and recommendations, and to avoid duplication of work. However, the internal audit function should maintain its independence and report directly to the board of directors or the audit committee.
References:
1: The internal audit function in banks, Principle 10, p. 9
2: The internal audit function in banks, Principle 10, p. 10
3: The internal audit function in banks, Principle 10, p. 11
4: The internal audit function in banks, Principle 2, p. 4
5: The internal audit function in banks, Principle 10, p. 11

A deferred prosecution agreement (DPA) is a type of enforcement action that allows a financial institution to avoid criminal prosecution if it admits to wrongdoing, pays a fine, and agrees to remediate its AML program deficiencies within a specified period of time1. A cease and desist order (C&D) is another type of enforcement action that requires a financial institution to stop engaging in unsafe or unsound practices or violations of law, and to take corrective actions to address its AML program weaknesses2. Both of these actions are commonly used by regulators to address serious or systemic AML program failures by financial institutions, as evidenced by recent cases345.
References:
1: Deferred Prosecution Agreement - Wikipedia
2: FFIEC BSA/AML Appendices - Appendix R - Enforcement Guidance
3: FinCEN Announces $15 Million Civil Money Penalty against Bancredito International Bank for Willful Violations of the Bank Secrecy Act
4: Lessons From The Seven Largest AML Bank Fines In 2021
5: Fines for AML Compliance Failures - ACAMS Today