Compliance Function
What the exam tests
The compliance function domain tests how a company identifies, monitors and evidences compliance, and who is accountable. Expect questions on the compliance officer, statutory certifications, the compliance programme and the distinction between the three lines.
Core rules and concepts
- Compliance means conforming to applicable laws, regulations, standards and internal policies. Compliance risk is the risk of sanctions, loss or reputational damage from failure.
- Programme elements: board-approved compliance policy and charter; independent, resourced compliance function; compliance risk assessment; obligations register and compliance calendar; policies and procedures; training; monitoring and testing; issue and breach management; management reporting; whistleblowing; records.
- Indian anchors: s.203 requires prescribed companies, including every listed company, to appoint a whole-time company secretary as KMP. s.204 requires secretarial audit for listed companies and other prescribed companies. LODR Regulation 6 requires a compliance officer; Regulation 27(2) requires an annual compliance certificate; Regulation 24A requires an annual secretarial compliance report from a practising company secretary within 60 days of the financial year end; Regulation 17(8) requires CEO and CFO certification.
- Independence: the compliance officer should report to the board or audit committee on compliance matters and have access to the chair.
- Three lines: business units own compliance; the compliance function sets frameworks and challenges; internal audit independently assures.
- Horizon scanning tracks regulatory change; RegTech can automate mapping and evidence.
Worked example
A listed company's financial year ends on 31 March. Its annual secretarial compliance report under Regulation 24A is due by 30 May. The compliance officer discovers a related-party transaction that was not placed before the audit committee. The correct response is to escalate immediately, place the transaction before the committee, assess disclosure and rectify the process; waiting for the annual report would compound the breach. Reasoning: the obligation is continuing, and the certification cannot be given while a known material breach is unresolved.
Traps that cost marks
- Treating compliance as only the compliance officer's job.
- Confusing the Regulation 24A report with the s.204 secretarial audit report.
- Assuming a compliance certificate guarantees compliance.
- Ignoring the distinction between advisory compliance and independent assurance.