How should an auditor ensure that a financial institution (FI) has appropriate controls in place for AML risk mitigation?