Compliance Program Management and Governance: Board Oversight and the Three Lines
This domain tests how a community bank builds a compliance program that is board-approved, risk-based, and operating day to day. Expect questions on governance, the compliance officer’s authority, the three lines of defense, training, monitoring, audit, issue escalation, and board reporting.
Core program elements
- A written, board-approved compliance program tied to the bank’s risk assessment, with policies, procedures, training, monitoring, and independent audit.
- A compliance officer with sufficient authority, resources, and access to the board or a board committee.
- The three lines: business units own risk and controls; compliance advises, monitors, and reports; internal audit provides independent assurance.
- Board oversight includes approving the program and risk appetite, receiving meaningful reporting, and documenting challenge and corrective action.
- Change management: new products, vendors, channels, and regulations require compliance review before launch and after implementation.
Worked example
A bank plans remote deposit capture through a fintech vendor. Compliance joins the new-product committee before launch, not after. The risk assessment identifies funds availability, error resolution, duplicate-deposit controls, information security, and BSA monitoring. Business lines draft procedures and own the controls; compliance sets monitoring; the board committee approves the residual risk; internal audit later tests design and operating effectiveness. Reasoning: compliance advises and monitors, but the business owns the risk, and audit must remain independent. If the project launches without a compliance review, the weakness is a governance failure even if no consumer harm occurs.
Traps that cost marks
- Calling compliance monitoring “audit.” Monitoring is management’s ongoing testing; audit is independent assurance.
- Assuming board delegation removes board responsibility. The board may delegate work but cannot abdicate oversight.
- Treating a policy manual as a program. Examiners look for risk assessment, training, monitoring, reporting, and issue resolution.
- Missing evidence in board minutes: approval, challenge, risk acceptance, and follow-up should be documented.
- Letting the compliance officer sit under a business line without escalation authority or direct board access.
Exam focus
Link every program element to risk and evidence. A strong answer names who owns the control, how it is tested, what is reported, and how exceptions are resolved.