An AML audit is an independent review of the design and effectiveness of AML controls, ensuring they operate as intended, not just on paper.