98% training completion, but staff cannot find the speak-up channel
Metroline Retail Bank has 3,000 employees and 120 branches. Its new compliance e-learning has a 98% completion rate, and all policies are on the intranet. A whistleblowing hotline is managed by an HR generalist who also handles the bank's grievance cases. In the last 18 months the hotline received three reports. A pulse survey found that 41% of frontline staff could not name a speak-up channel and 28% feared retaliation. Third-party onboarding covers 210 vendors through a self-declared questionnaire; no responses are sampled or verified. One vendor recently handled customer data without a data-processing agreement. New products are reviewed by a committee where compliance attends only at final sign-off. Branch managers say compliance 'slows us down,' and several keep local workarounds in spreadsheets. The compliance officer wants to know whether the CMS is actually implemented or only documented.
1. Assess the implementation gap at Metroline. Which elements of support and operation are weakest, and why does high training completion not demonstrate effectiveness?
Read the worked answer
The evidence points to documentation and awareness activity rather than effective operation. Training completion measures attendance, not competence or behaviour. If 41% cannot name a channel and 28% fear retaliation, communication and awareness have not produced the intended capability, and the speak-up system is not trusted. The hotline's placement in HR alongside grievances creates a conflict of interest and may suppress reports; three reports in 18 months for a 3,000-person bank is a warning sign, not proof of good behaviour. Third-party management is a self-declaration with no verification, so it is not a control. Compliance involvement only at final product sign-off means risks are not considered at design stage. Local spreadsheets are uncontrolled workarounds that undermine operational control. The weakest areas are competence and awareness, communication, operational planning and control, outsourced processes, and integration into business processes. Leadership should also be tested: do managers reinforce compliance or tolerate workarounds?
2. Design practical controls and evidence for speak-up, third-party management and new-product approval. Explain how each control would be tested.
Read the worked answer
Speak-up: establish an independently managed channel with multiple routes, a published non-retaliation policy, a triage and investigation procedure, confidentiality safeguards, and reporting to the audit committee. Test by sending a test report, auditing case files for timeliness and outcomes, surveying staff on trust, and checking that reporters are not disadvantaged. Third-party management: risk-tier vendors, require evidence for high-risk vendors such as security certifications and sampled questionnaires, mandate data-processing clauses, and set annual review and exit plans. Test by sampling 20 vendors across tiers, tracing contract clauses, and attempting to onboard a fictitious high-risk vendor. New-product approval: add a compliance risk assessment gate at concept stage, with sign-off before pilot, and record decisions. Test by selecting three recent launches and checking whether compliance risk was assessed before design freeze.
3. How should the compliance officer address the culture and workaround issues without simply issuing more policies?
Read the worked answer
Culture is shaped by what leaders do, not by policy volume. The compliance officer should present the survey and hotline data to the executive committee and board without blame, and ask leaders to model speak-up behaviour. Practical actions include: remove the conflict of interest from the hotline; publicise non-retaliation and demonstrate consequences for retaliation; train managers to respond to concerns; run facilitated sessions in branches to surface workarounds; replace uncontrolled spreadsheets with approved tools or, where risk is low, formally accept and monitor them; and change incentives so branch managers are recognised for early risk escalation. The compliance officer should also measure trust and reporting over time, not just policy acknowledgements. More policies would likely increase cynicism unless paired with visible leadership action and removal of real barriers.