How to Launder Money: Why Auditors Need to Understand How Financial Crime Actually Works
Lessons for Internal Auditors, External Auditors, Fraud Examiners and AML Professionals from George Cottrell and Lawrence Burke Files
Auditors spend enormous amounts of time testing whether organizations comply with policies, regulations, and internal controls.
Money launderers have a different objective.
They look for ways around them.
That difference makes How to Launder Money: A Guide for Law Enforcement, Prosecutors and Policymakers, by George Cottrell and Lawrence Burke Files, particularly interesting for auditors.
Published by Biteback Publishing in February 2026, the book examines how illicit value moves through the financial system and challenges whether conventional anti-money-laundering controls are actually accomplishing their intended objectives. Its chapters address cash, gold, cryptocurrency, anonymity, legal entities, real estate, bribery, and other mechanisms through which financial crime can be concealed.
For auditors, the value of the book is not learning how to launder money.
It is learning to think more like the people who are trying to defeat the controls we audit.
That is a very different skill.
The Auditor's Problem: Compliance Does Not Necessarily Equal Effectiveness
One of the central arguments of the book is deliberately provocative: the authors contend that today's AML regulatory structure imposes substantial costs while failing to stop much of the underlying criminal activity. The book ultimately argues for more effective approaches to identifying actual financial crime rather than relying excessively on compliance processes.
Whether an auditor agrees with all of that criticism or not, the argument raises an excellent audit question:
Is the control actually reducing the risk, or are we merely proving that the control was performed?
This issue reaches far beyond AML.
Consider an auditor who determines:
100% of required AML training was completed.
Required customer documentation was obtained.
Transaction-monitoring reports were generated.
Alerts were reviewed.
Policies were updated.
Required certifications were signed.
The compliance results may look excellent.
But the auditor still needs to ask:
Is the AML program actually capable of identifying suspicious activity?
That is the difference between compliance auditing and control-effectiveness auditing.
Stop Auditing the Checklist and Start Auditing the Risk
This may be the most important lesson auditors can take from the book.
Suppose an AML program contains 50 required controls.
An auditor can spend weeks determining whether all 50 controls were performed.
That produces one kind of assurance.
A stronger auditor asks another question:
How would someone actually move illicit value through this organization?
Then:
Which controls would detect it?
Then:
Could those controls be circumvented?
That changes the audit methodology.
Instead of:
Policy → Requirement → Test → Compliance
the auditor begins thinking:
Objective → Threat → Method → Vulnerability → Control → Detection → Response
That is much closer to adversarial risk assessment.
Money Laundering Isn't Just About Cash
One reason the book should interest auditors is its broad treatment of the concept of money and value.
Its chapters specifically address gold, cash, cryptocurrency, anonymity, entities, and real estate, among other topics.
That matters because an inexperienced auditor may associate money laundering primarily with cash moving through banks.
The real audit question is broader:
How can value be stored, transferred, disguised, converted, or controlled?
Once auditors start thinking about value rather than merely currency, their risk assessment changes.
Assets and transactions that may deserve attention can include:
Cash
Securities
Digital assets
Real estate
Precious metals
Business entities
Loans
Receivables
Trade transactions
Ownership interests
The auditor needs to understand the economic substance of transactions, not merely their accounting classification.
Follow the Value
Auditors are taught to follow transactions through accounting systems.
Financial-crime auditing requires something more.
Follow the value.
Ask:
Where did it originate?
↓
Who controlled it?
↓
Where did it move?
↓
Did its form change?
↓
Who ultimately benefited?
↓
Does the transaction make economic sense?
This can reveal relationships that ordinary transaction testing misses.
A payment may be properly authorized.
The accounting may be correct.
The documentation may exist.
But the auditor still needs to understand:
Who is really receiving the economic benefit?
Legal Entities Deserve More Attention
One of the book's chapters addresses entities, management and escape.
That topic should immediately interest auditors.
A legal entity can have:
A legitimate registered name
A valid address
A bank account
Tax identification
Corporate documentation
and still leave unanswered the most important question:
Who actually controls or benefits from it?
That is why beneficial ownership and related-party analysis can become important.
When auditors encounter unusual vendors, customers, investments, intermediaries, consultants, or counterparties, they should consider questions such as:
Who owns the entity?
Who controls it?
Who are its officers?
When was it established?
Why was it selected?
Does it have a legitimate business purpose?
Are there undisclosed relationships?
Does the address make sense?
Are payments consistent with its apparent business?
This is where due diligence and auditing intersect.
Lawrence Burke Files Brings a Due-Diligence Perspective
Lawrence Burke Files' background makes the book especially relevant for auditors.
Files is described as an international financial investigator and due-diligence specialist who has handled matters in more than 130 countries. His professional work encompasses due diligence, AML, finance, risk management, and anti-corruption. He is also the author of Due Diligence for the Financial Professional.
That background brings an important perspective to auditing:
Do not limit your investigation to the information management gives you.
Management-provided information is evidence to evaluate.
It isn't necessarily the entire evidence universe.
Auditors performing higher-risk work may need to corroborate information through appropriate independent sources.
George Cottrell Brings a Very Different Perspective
The book is unusual because the two authors approach the subject from very different backgrounds.
The publisher describes George Cottrell as a British financier and political strategist who was arrested in 2016 on allegations connected with a money-laundering conspiracy; the book's official site says his U.S. prison term for wire fraud informs his perspective on financial crime.
That creates an unusual combination:
Financial investigator
Someone with direct experience of the criminal-justice side of financial crime
For auditors, the combination reinforces the value of examining a control system from both sides:
How was the control designed to work?
versus:
How would someone try to defeat it?
The second question is frequently missing from conventional auditing.
Think Like an Adversary
Cybersecurity professionals use concepts such as penetration testing and red teaming.
The basic principle can be applied to financial controls.
Instead of asking only:
“Does this control operate?”
ask:
“If I wanted to circumvent this control, where would I attack it?”
That doesn't require attempting criminal conduct.
It requires analyzing vulnerabilities.
For example: Control: New vendors require approval.
The conventional auditor tests whether approvals exist.
The adversarial auditor additionally asks:
Could a fictitious vendor obtain approval?
Could an employee control both sides of the process?
Could an existing vendor record be changed?
Could ownership relationships be concealed?
Does anyone independently validate the vendor?
Now the auditor is testing the control objective, not merely the evidence of approval.
Bribery and Corruption Belong in the Auditor's Risk Universe
The book devotes a chapter to bribery.
Auditors should recognize that corrupt payments rarely arrive in the general ledger labeled:
BRIBE EXPENSE — $250,000
They may appear as apparently legitimate business expenses.
That means auditors need to understand areas such as:
Consulting arrangements
Commissions
Agents
Intermediaries
Professional services
Unusual bonuses
Charitable contributions
Vendor payments
Related parties
Unexplained reimbursements
The key question becomes:
What is the economic substance of this payment?
That is a much better audit question than simply determining whether an invoice exists.
Real Estate Can Be a Financial-Crime Risk
The book also devotes a chapter to real estate.
Again, auditors should think in terms of value.
Real estate transactions can involve:
Large dollar amounts
Multiple legal entities
Complex ownership
Intermediaries
Financing
Cross-border participants
Auditors involved with financial institutions, investment organizations, insurance organizations, real estate companies, or high-net-worth clients should understand how those characteristics affect AML and fraud risk.
Cryptocurrency Expands the Audit Risk Universe
Cryptocurrency receives its own chapter as well.
Auditors increasingly need at least a working understanding of digital assets.
That does not mean every Internal Auditor needs to become a blockchain specialist.
It does mean the auditor should recognize when specialist knowledge is required.
Questions may include:
Does the organization accept digital assets?
Does it hold them?
Who controls the wallets?
How are transactions authorized?
What third parties are involved?
How are transactions monitored?
How are digital assets valued and accounted for?
What AML risks exist?
Ignoring cryptocurrency because it falls outside the auditor's traditional accounting background is no longer a sound risk-management strategy.
Anonymity Is an Audit Red Flag
The book's treatment of anonymity also has direct relevance to audit work.
An auditor should become increasingly skeptical as the answer to:
“Who is actually behind this transaction?”
becomes more difficult to determine.
Complexity isn't proof of wrongdoing.
Neither is privacy.
But unnecessary complexity can increase risk.
The auditor should understand why the structure exists.
AML Auditors Need to Look for Control Circumvention
An AML audit should not stop with determining whether policies exist.
The auditor should test whether the program can detect attempts to circumvent them.
Consider:
Customer Due Diligence
The auditor should not merely determine whether documentation was collected.
Ask whether the information is meaningful and appropriately validated.
Transaction Monitoring
Do not merely confirm that alerts were generated.
Ask whether the scenarios are capable of identifying relevant suspicious activity.
Alert Disposition
Do not merely confirm that alerts were closed.
Examine why they were closed.
Escalation
Determine whether genuinely suspicious activity reaches people with appropriate authority.
Training
Don't merely count completion certificates.
Ask whether personnel understand the red flags they are expected to identify.
That's a much more demanding audit.
Internal Auditors Should Look for Management Override
Financial criminals don't necessarily attack the strongest control.
They look for the weakest point.
Sometimes that weakness is human authority.
The auditor should therefore consider:
Who can override controls?
Who can suppress alerts?
Who can approve exceptions?
Who can change customer information?
Who can change vendor information?
Who can modify monitoring parameters?
Who reviews those actions?
The most sophisticated control environment can be undermined if a powerful individual can circumvent it without independent review.
External Auditors Can Learn From This Too
The book isn't only relevant to AML specialists.
Financial statement auditors should also think about how laundering and financial crime could affect:
Revenue
Cash
Related parties
Investments
Receivables
Real estate
Legal contingencies
Going concern
Fraud risk
Regulatory exposure
An external auditor doesn't conduct a criminal investigation simply because something unusual appears.
But unusual transactions can require heightened professional skepticism and additional procedures.
Use Data Analytics to Look for the Unexpected
Modern audit technology creates an important opportunity.
Rather than only sampling individual transactions, auditors can analyze populations for unusual characteristics.
For example:
Unusual Counterparty
Unusual Amount
Unusual Geography
Unusual Timing
Unusual Approval
Unusual Transaction Pattern
does not automatically equal money laundering.
But it may equal:
Ask another question.
That is often where good auditing begins.
AI Can Help Auditors Think More Broadly About AML Risk
AI can also assist with financial-crime auditing when used within appropriate confidentiality and governance requirements.
An auditor could use an approved AI environment to help:
Develop AML risk scenarios
Generate interview questions
Analyze policies
Compare procedures with regulatory requirements
Analyze large collections of narrative information
Identify inconsistencies
Develop potential red flags
Challenge preliminary conclusions
Summarize investigation materials
A particularly useful prompt might be:
“Act as a skeptical AML audit manager. Identify ways this control could fail to detect suspicious activity and develop audit procedures to determine whether those vulnerabilities exist.”
That is a much stronger use of AI than:
“Write me an AML audit program.”
Compliance Is Not the Same as Risk Reduction
This brings us back to the book's central challenge.
Cottrell and Files argue that existing AML regulation often imposes significant compliance burdens without stopping enough underlying criminal activity.
Auditors do not have to accept every policy conclusion in the book to benefit from that argument.
We should welcome the challenge.
Because every Internal Auditor should occasionally ask:
Are we auditing whether management complies with the control—or whether the control actually manages the risk?
Those are not always the same thing.
A Different Kind of Book for Auditors
How to Launder Money isn't a traditional auditing textbook.
That is precisely why it may be useful.
Its published table of contents moves through money itself, laundering, bribery, gold, cash, cryptocurrency, anonymity, entities, real estate, the development and consequences of AML laws, and ultimately recommendations for improvement.
That forces auditors to look at financial crime from outside the audit program.
And that perspective matters.
Auditors need to understand not only:
How controls are supposed to work.
They also need to understand:
How people try to get around them.
The Bottom Line for Auditors
The greatest value of How to Launder Money for an auditor is not its provocative title.
It is the mindset behind the subject.
Financial criminals are adaptive.
They look for gaps.
They exploit complexity.
They move value into different forms.
They use intermediaries.
They exploit weak due diligence.
And when controls change, they adapt.
Auditors therefore cannot rely solely upon yesterday's audit program.
A stronger financial-crime auditor thinks:
Understand the Business
↓
Understand How Value Moves
↓
Identify the Financial-Crime Risk
↓
Understand the Criminal's Potential Objective
↓
Identify Control Vulnerabilities
↓
Test the Controls
↓
Look for Circumvention
↓
Follow the Exceptions
↓
Evaluate Whether the Program Actually Reduces Risk
That is the larger lesson.
Don't simply audit the AML program. Audit whether the AML program can actually detect the behavior it was designed to stop.
For Internal Auditors, External Auditors, CFEs, AML professionals, compliance officers, and financial investigators, How to Launder Money provides a provocative way to challenge conventional thinking about financial-crime controls.
Comments