Compliance Program Governance and Administration
What is tested
Governance is about authority, independence, and accountability at the top of the program. Know the board's and senior management's oversight role, the compliance officer's stature and resources, the compliance committee's charter and cross-functional make-up, and how responsibilities map to the three lines of defense: the business owns and manages risk, compliance advises and monitors, and internal audit provides independent assurance.
Concepts to name
FSGO Element 2 (oversight by high-level personnel, due care in delegating authority) and the DOJ's emphasis on commitment by senior and middle management. Vocabulary that shows up: dotted-line reporting, audit committee, tone at the top versus tone at the middle, cultural carriers, and empowerment of the compliance function (authority, direct access, adequate resources, independence from revenue pressure).
Traps
Questions reward precision over absolutes. The compliance officer need not be a lawyer, need not be full-time in a small organization, and need not report directly to the board - but must have direct, unfiltered access to it. Board oversight does not mean the board reviews individual hotline reports. Independence is more often eroded by conflicting operational duties (the CCO who also approves sales contracts) than by the reporting line itself.
Rule of thumb
Apply the access–authority–adequacy test. Access: can the CCO reach the board? Authority: does a charter give the function power to set standards and escalate? Adequacy: are budget, headcount, and data available? If any leg is missing, the element is weak no matter how good the code looks.
Worked example
A compliance officer reports to the CFO, has no board contact, and spends 60% of their time approving marketing spend. The governance fix is not a bigger training budget; it is a written charter, a dotted line to the audit committee, and removal of the conflicting approval duty.