The CCO Who Reports to the CFO
Riverbend Community Bank ($1.4 billion in assets, 14 branches across two states) hired its first dedicated chief compliance officer fourteen months ago. The CCO reports to the CFO, who also chairs the pricing committee and owns the lending P&L. Compliance staffing is the CCO plus two analysts, one of whom spends roughly half her time reconciling vendor invoices for the operations group. The board's Audit and Risk Committee meets quarterly; the compliance update is a 30-slide metrics deck prepared by the CFO, and the last three sets of minutes record no questions or follow-up items. Internal audit is outsourced and last performed a compliance audit 22 months ago; the current engagement letter scopes only branch cash counts and wire testing. In March the bank launched a HELOC with a promotional rate without a product risk assessment, and marketing reviewed the disclosure after the landing page went live. The most recent examination produced two Matters Requiring Attention -- CIP documentation and adverse action notices -- both logged as management committed, with target dates that have already slipped once.
1. Identify the governance weaknesses in this structure and explain why each one matters for the bank's compliance risk profile.
Read the worked answer
Independence of the compliance function. The CCO reports to an executive who owns revenue and pricing decisions. A compliance officer cannot credibly challenge a pricing or product decision when their performance rating and budget sit with the person making it. The common-market expectation is a direct reporting line to the board or a board committee, with only administrative reporting to the CEO. That structural fix is the highest-value change here.
Board oversight is passive. Quarterly meetings with no recorded questions and a CFO-authored deck mean the committee is receiving information, not exercising judgment. Oversight requires visible challenge, follow-up items, and documented resolution. Minutes are the examiner's evidence.
Resourcing is mismatched to risk. Two-and-a-half FTEs across 14 branches and two states, with an analyst diverted to invoice reconciliation, is difficult to defend against any benchmark of compliance staff per billion in assets. The invoice work also signals the function is treated as a cost center to be borrowed from.
Third line of defense is hollow. A 22-month gap and an audit scope limited to cash counts and wires leaves deposit, lending, and BSA controls untested. Compliance audit should be risk-based, annual at minimum for high-risk areas, and scoped by the audit committee, not by the business.
Change management failed. Launching a HELOC without a product risk assessment, with marketing review after go-live, is exactly the sequence that produces UDAAP and disclosure findings.
MRA slippage. Slipped remediation dates without escalation indicate no accountability mechanism. Every MRA needs an owner, a credible date, and a monthly status report to the committee.
2. The CFO resists the CCO's request to meet with the Audit and Risk Committee without management present. How should the CCO proceed, and what should the board reporting package contain?
Read the worked answer
On the meeting. Direct, unfettered access to the audit committee is a defining feature of an effective compliance function and is routinely expected by examiners. The CCO should not treat this as negotiable. Practically:
- Put the request and the CFO's objection in writing -- a short email to the CFO summarizing what was asked and why, so the record is contemporaneous rather than reconstructed later.
- Escalate to the CEO and then to the committee chair, framing the issue as governance rather than personality: the committee needs an unfiltered view of compliance risk to discharge its duties.
- Request a standing executive session at each quarterly meeting, with a written summary of what was discussed.
- If access is still blocked, send a memorandum directly to the committee chair describing the compliance risks and the constraint, and consider whether the constraint itself is a governance deficiency the bank should self-identify to its examiner.
On the reporting package. Replace the 30-slide deck with a one-page dashboard plus a two-page narrative:
- Compliance risk appetite versus actual, by risk stripe.
- Issue and MRA inventory with aging, owner, and revised dates; anything past due highlighted.
- Key risk indicators with trigger thresholds -- complaint volume and themes, Reg E dispute timeliness, HMDA and fair lending metrics, SAR and alert backlog, CTR timeliness, third-party review currency.
- Regulatory change log: what changed, what it touches, who owns implementation, status.
- Emerging risk and a specific ask of the committee each quarter.
The test of the package is whether a director could use it to ask one informed question.
3. The CCO is asked to sign off on the internal audit plan that keeps the current narrow scope. What is the appropriate response, and what ethical obligations apply?
Read the worked answer
The CCO should decline to endorse a scope that leaves material compliance risk untested, and should say so in writing. Signing off would create a record that the compliance function accepted an inadequate control environment -- precisely the record an examiner or a plaintiff would use later.
The obligation runs to the board, not to the executive who requested the plan. A compliance officer's professional duty is to report accurately on the state of the control environment and not to lend their name to an assessment they do not believe. Practical steps:
- Submit a written risk-based audit scope proposal: deposit regulations (Reg DD, Reg E, Reg CC), lending (Reg B, Reg Z, HMDA, flood), BSA/AML, privacy and third-party oversight, with frequency tied to inherent risk and prior findings.
- Note explicitly that the 22-month gap already constitutes a self-identified deficiency and should be in the issue log.
- Ask the audit committee to approve the scope, since audit scope is properly a committee decision.
- Document the disagreement and the escalation path taken.
If the CCO is directed to sign anyway, a written memo to the committee chair recording the objection is the appropriate minimum. Silence is the failure mode here, not conflict. A compliance officer who is overruled and documents it has preserved both the bank's position and their own; one who quietly acquiesces has converted a governance problem into a credibility problem.