Compliance Program Governance, Risk Management, and Ethics
This domain tests whether a compliance function actually works: who owns it, how risk is measured, how third parties are controlled, and what happens when commercial pressure collides with legal duties. Questions often present a conflict and ask what the compliance officer must do.
Program governance
- Board and senior management own the program; compliance needs authority, independence, and resources.
- Core elements: written policies, a designated compliance officer, training, independent testing, customer due diligence, and a documented risk assessment.
- The three lines of defense model separates the business, the compliance function, and internal audit.
Risk management
- A risk assessment should be dynamic, covering products, customers, geographies, channels, and counterparties.
- New product and new market reviews should occur before launch, not after an incident.
- Third-party and vendor risk covers custodians, analytics providers, and banking partners.
- Key risk categories: money laundering, sanctions, fraud, custody, cyber, liquidity, and model risk.
Ethics and conduct
Conflicts of interest, off-channel communications, gifts, and pressure to soften findings are recurring themes. Whistleblowing channels and escalation to the audit committee protect both the firm and the individual. Tone at the top is judged by decisions, not statements.
Worked example
A compliance officer identifies suspicious activity involving a client that generates significant revenue. A senior manager asks for the SAR filing to be delayed until after a funding round. The officer must not delay a legally required filing; SAR decisions are made on suspicion, not on business convenience. The officer should document the request, escalate to the board or audit committee, and file on time. Retaliation against the officer is itself a governance failure.
Traps
- Confusing a business sign-off with genuine independent challenge.
- Treating the risk assessment as a one-time document.
- Allowing revenue pressure to influence a SAR or sanctions decision.