Compliance Program Design, Governance, and Internal Controls
Program architecture
An effective compliance program is risk-based and built on governance, written standards, training, monitoring, and response. Candidates should understand board and senior-management oversight, a compliance officer with sufficient authority and access, and clear allocation of responsibilities. The three lines model is a useful lens: business units own risk, compliance and risk functions advise and monitor, and internal audit provides independent assurance. Policies and procedures must be current, communicated, and actually followed. Third-party relationships need due diligence and contract controls. Incentives, discipline, and confidential reporting channels reinforce culture.
Traps
Watch for equating a policy manual with a program; placing compliance under the function it monitors; confusing the second and third lines; designing controls without linking them to risk; and assuming training completion proves understanding. Questions may test independence, escalation, and documentation. Beware one-size-fits-all answers that ignore size, geography, and risk profile.
Worked example
A firm's compliance team reports to the sales head and also audits sales conduct. This is a structural conflict: monitoring should be independent of the activity monitored, and assurance should sit in a separate function. Rule of thumb: ask who owns the risk, who monitors it, and who independently tests it; if the same person answers all three, independence is compromised.