As a result of an audit, a policy exception was identified that had been approved...

The auditor should include the regulatory violation in the audit report and report it to the board of directors. This is because the auditor has the responsibility to report any findings of non-compliance or material weaknesses in the institution’s internal controls, policies, and procedures. The auditor should also provide recommendations for corrective actions and follow-up on their implementation. The board of directors has the ultimate oversight and accountability for the institution’s compliance program and should be informed of any significant issues or risks that may affect the institution’s reputation, operations, or regulatory status12.

1: CAMS Certification Package - 6th Edition | ACAMS, Chapter 6: Developing an Effective Anti-Money Laundering Program, p. 125-126 2: The Wolfsberg Group, The Wolfsberg Anti-Money Laundering Principles for Correspondent Banking, October 2014, p. 7, https://www.wolfsberg-principles.com/sites/default/files/wb/pdfs/Wolfsberg-Correspondent-Banking-Principles-2014.pdf