Evidence for your practice’s quality review.
APES 320 procedures and your AML/CTF due diligence, written out, confirmed, every change logged.
What they ask, and what you can show.
APES 320, Quality Management for Firms that provide Non-Assurance Services, has applied since 1 January 2023. From 1 July 2026, AML/CTF obligations apply to certain services accountants provide. Here is what each asks for, and what Entrilla keeps.
Documented policies and procedures
They ask APES 320 asks a firm to document its policies and procedures and communicate them to its people (paragraph 3.6), and to keep documentation that evidences how each element of its system operates (3.17).
In Entrilla Each procedure written out, confirmed by the people who run it, with the date and every change since.
Client acceptance and continuance
They ask Acceptance and continuance of client relationships and engagements is one of the seven elements in paragraph 3.5.
In Entrilla The acceptance routine as a process: who checks what, who signs the engagement letter, in which system.
AML/CTF customer due diligence
They ask AUSTRAC describes your AML/CTF policies as the procedures, systems and controls you use, kept up to date as your business and its risks change.
In Entrilla Your customer due diligence and escalation procedures, written out, confirmed by each person who runs them, every change logged.
Reviews of the program
They ask AUSTRAC requires internal reviews and independent evaluations of your AML/CTF program in certain circumstances, and at least once every three years.
In Entrilla A review date on each procedure: set it to yearly and the map shows Review due when it falls due.
Fictional example
New client due diligence.
A made-up process, each step described by role. In Entrilla, each step shows who confirmed it and when.
- Client manager: Confirms which services the client wants and which of them AUSTRAC regulates.
- Practice administrator: Collects and verifies the client’s identity documents.
- Client manager: Records the client’s risk rating in the practice management system.
- AML/CTF compliance officer: Reviews any medium or high rating and decides on enhanced due diligence.
- Partner: Signs the engagement letter once due diligence is complete.
What Entrilla keeps
The record, on every plan.
- Written procedures. Each process can carry a written procedure, drafted by the AI from the map or written by you, and printed from your browser.
- Sign-offs tied to a login. People confirm their steps signed in as themselves. Each step keeps their name and the date; only they or an editor can take it off.
- Review dates. Set a process to be re-checked every 3 months, 6 months or yearly. When it falls due, the map shows Review due.
- Every change logged. Edit a step and its sign-off drops until someone confirms it again. Edits, sign-offs, versions and locks are logged with the person and the time.
- Versions and lock. Name a version, compare it with today or bring it back. An admin can lock a process so nobody edits it.
- Export. One file holds every process, who confirmed each step and when, the versions, the written procedures and the activity log.
Questions
Questions about this review.
When did AML/CTF obligations start for accountants?
AUSTRAC says from 1 July 2026, for certain services accountants provide. Enrolment is due within 28 days of first providing one (29 July 2026 for firms already providing them). AUSTRAC’s “Check if you may be regulated” tool shows whether yours do.
Where do client identity documents go?
In your practice management or identity verification system. Entrilla holds the procedure: who does each step, in which system, who confirmed it and when.
Will this get us through a quality review?
Your reviewer decides that. Entrilla gives you evidence for it: each procedure as written, who confirmed each step and when, and the history of changes to them.