Compliance Roles and Responsibilities
This domain tests who owns compliance, how independence works, and how responsibilities are allocated across the board, management, business units, compliance, and audit.
Three lines model
- First line: business units own the risks they take and must comply in day-to-day activity.
- Second line: the compliance function advises, monitors, and challenges; it does not execute business transactions.
- Third line: internal audit provides independent assurance to the board.
The board sets the tone and approves the compliance framework. Senior management implements it. The compliance officer should have direct access to the board or audit committee, adequate resources, and protection from retaliation.
Worked example
A sales head asks the compliance officer to waive KYC for a high-revenue client. The compliance officer declines, documents the request, and escalates to the board compliance committee. Reasoning: the first line may propose a commercial solution, but the second line cannot approve a regulatory breach; only the board can accept a documented risk decision within policy.
Traps that cost marks
- Saying compliance alone owns all compliance risk.
- Reporting the compliance officer to the business head rather than the board committee.
- Confusing the MLRO's STR duty with the compliance officer's broader monitoring role.
- Assuming 'compliance is everyone's job' removes individual accountability.
Clear terms of reference, delegated authority, and escalation paths are examinable specifics, not optional good practice.