Compliance Program Governance and Structure
What the domain tests
Governance questions ask who owns the compliance program, how authority flows, and how independence is protected. Candidates must know the elements of an effective program: board-level oversight, a designated compliance officer with direct access to the governing body, a compliance committee, written authority and reporting lines, adequate resources, and documented accountability. Understand the difference between the governing body (sets tone, approves program, receives reporting) and management (operates the program day to day).
Concepts to master
- Tone at the top versus tone in the middle: senior commitment means little if middle managers override controls.
- Independence and conflicts: the compliance officer should not report to the function being monitored (for example, the CFO or general counsel) in a way that compromises objectivity.
- Three lines model: business operations own risk, compliance and risk functions advise and monitor, internal audit provides independent assurance.
- Program charters, committee terms of reference, escalation protocols, and board reporting cadence.
Traps
Questions often present a plausible structure that fails on independence or on access. A compliance officer who reports only to the COO, or who lacks a direct channel to the board, is a classic wrong answer. Another trap is confusing "having a policy" with "having governance" - governance requires authority, resources, and reporting, not just documents. Watch for answers that give the board operational duties; oversight is not management.
Rule of thumb
Ask three questions of any structure: Who has authority? To whom do they report? Can they be overruled by the people they monitor? If the answer to the last is yes, the structure is deficient.
Worked example
A firm places its compliance head under the CFO with dotted-line reporting to the audit committee. A question asks for the best improvement. The strongest answer is a direct, unfettered reporting line to the board or a board committee, with the CFO relationship removed or clearly subordinate - not more frequent meetings or a bigger budget.