Governance, Risk, and Compliance Program Structure
What the domain tests
A compliance program is not a policy binder; it is a governance system with defined authority, independence, and reporting lines. Candidates must understand the three-lines model: the business owns risk (first line), compliance and risk functions set frameworks and challenge (second line), and internal audit provides independent assurance (third line). Know the roles of the board, its audit or compliance committee, the chief compliance officer (CCO), and senior management, and understand why the CCO should have direct access to the board and sufficient stature, resources, and independence from business units whose activities are being monitored.
Concepts to master
Tone at the top versus tone in the middle; risk appetite and tolerance statements; the compliance charter; governance committee structures; escalation protocols; resource and budget authority; and how program maturity models (typically descriptive, managed, defined, quantitative, optimizing) are used to sequence investment. Understand that a program's structure must be proportionate to the organization's size, complexity, and risk profile.
Traps
Questions often reward the answer that preserves independence and escalation over the one that is administratively convenient. Reporting the CCO to the general counsel or CFO can be acceptable only if independence and access are preserved; reporting to the head of sales is never acceptable. Another trap is confusing the board's oversight duty with management's operational duty. A third is treating a hotline or code of conduct as a complete program.
Worked example
If asked where a newly hired CCO should report, prefer the CEO or board committee with a dotted line to the audit committee, and reject any structure that places the CCO under a business unit the CCO monitors. Rule of thumb: whoever can override the compliance decision must not be the person the CCO reports to.
Exam focus
Expect questions on committee charters, quorum, minutes, and the distinction between oversight and execution.