Independence of the Compliance Function: A Critical Component of the Three Lines Model
Ellen McCarthy, Head of Compliance at Computershare, opines on the IIA’s recent updates to its three lines of defense model, positing that they fail to recognize the importance of the independence of the compliance function.
The Institute of Internal Auditors (IIA) last month issued a new three lines model, updating its “Three Lines of Defense” model to set forth the IIA’s “latest understanding of governance and risk management.” Below, I have set out my personal view along that, while the new model applies flexibility and a principles-based approach (a very positive development), the chief shortcoming of the model is that it overlooks the criticality of the independence of the compliance function.
Independence of Compliance: What does it mean?
The Basel Committee on Banking Supervision (BCBS), a 45-member global group of banking regulators and central banks, has published what many consider the most cogent description of compliance function independence. Members of this group include:
- Board of Governors of the Federal Reserve System
- Office of the Comptroller of the Currency
- Federal Deposit Insurance Corporation
- Federal Reserve Bank of New York in the United States
- Prudential Regulation Authority
- Bank of England in the United Kingdom
- European Central Bank
- Swiss Financial Market Supervisory Authority
- Bank of Japan
According to the BCBS, independence is a core principle of compliance and consists of four elements:
- The compliance function should have a formal status within the organization – documented within a policy and widely communicated throughout – that gives compliance “appropriate standing, authority and independence.”
- The organization should appoint an executive with overall responsibility for overseeing the organization’s management of compliance risk and supervision of other compliance function staff members, but without direct business line responsibilities.
- Compliance function staff members should preferably “perform only compliance responsibilities.” Conflicts of interest, whether actual or perceived, between competing compliance and non-compliance responsibilities may compromise independence.
- The compliance function should have direct access to the governing body, as well as the right to obtain any information and contact any personnel of the organization necessary to carry out its compliance responsibilities.
What does it look like in practice?
In practice, organizations achieve the four elements of independence by:
- Implementing a written compliance framework that is approved by the governing body and establishes a distinct and empowered compliance function.
- Naming a Chief Compliance Officer (CCO) with a functional reporting line to a committee of the governing body that is comprised entirely of non-executive (outside) directors, in order to ensure autonomy.
- Ensuring that the CCO and staff members of the compliance function do not perform business responsibilities.
- Allowing the compliance function unfiltered access to information needed to carry out its oversight role.
Why It’s So Critical
Under the three lines model, the business units or “first line” own the various business risks, as well as the obligation to comply with external regulatory requirements – laws, rules and regulations – and internal policy.
The second-line roles, including the compliance function, provide oversight to the business units in managing their risks and compliance obligations.
Globally, in banking and financial services as well as in the health care sector, regulators recognize the criticality of independence to effective oversight by the compliance function. Even in nonregulated industries, compliance function independence is commonly considered a best practice area.
In North America, regulators and other governmental agencies have made it clear that the compliance function must be independent, autonomous and of equal stature with other functions in the organization (i.e., having a seat at the executive table). Groups in support of this structure include:
- S. Department of Justice (DOJ)
- Securities and Exchange Commission (SEC)
- Office of the Comptroller of the Currency (OCC)
- Financial Crimes Enforcement Network (FinCEN)
- Federal Financial Institutions Examination Council (FFIEC)
- Office of the Superintendent of Financial Institutions (OSFI) in Canada
Recent Guidance Highlights the Criticality of Independence
Most recently, in July 2020, the DOJ and SEC updated their joint “Foreign Corrupt Practices Act (FCPA) Resource Guide,” incorporating a separate June 2020 DOJ update to its “Evaluation of Corporate Compliance Programs” guidance. The updated DOJ/SEC guidance added further nuance to the concept of compliance function independence: that an organization should consider its system of internal controls as separate and distinct from its standalone corporate compliance program, although the two may overlap.
Practically speaking, this latest nuance makes perfect sense if we go back to the concept of a first line (the business units) that is responsible for managing their compliance and other risks, and that needs a system of internal controls to do so. In this scenario, the independent (second line) compliance function, through its separate compliance program, provides oversight, support and advice to the first line. Rounding out the picture, on the third line, is the internal audit function, which performs an independent assurance role.
In my opinion, the three lines model will only work if both the compliance function and internal audit have independence.
Meet the team of industry experts behind ComsureFind out more
Keep up to date with the very latest news from ComsureFind out more
View our latest imagery from our news and workFind out more
Think we can help you and your business? Chat to us todayGet In Touch
As well as owning and publishing Comsure's copyrighted works, Comsure wishes to use the copyright-protected works of others. To do so, Comsure is applying for exemptions in the UK copyright law. There are certain very specific situations where Comsure is permitted to do so without seeking permission from the owner. These exemptions are in the copyright sections of the Copyright, Designs and Patents Act 1988 (as amended)[www.gov.UK/government/publications/copyright-acts-and-related-laws]. Many situations allow for Comsure to apply for exemptions. These include 1] Non-commercial research and private study, 2] Criticism, review and reporting of current events, 3] the copying of works in any medium as long as the use is to illustrate a point. 4] no posting is for commercial purposes [payment]. (for a full list of exemptions, please read here www.gov.uk/guidance/exceptions-to-copyright]. Concerning the exceptions, Comsure will acknowledge the work of the source author by providing a link to the source material. Comsure claims no ownership of non-Comsure content. The non-Comsure articles posted on the Comsure website are deemed important, relevant, and newsworthy to a Comsure audience (e.g. regulated financial services and professional firms [DNFSBs]). Comsure does not wish to take any credit for the publication, and the publication can be read in full in its original form if you click the articles link that always accompanies the news item. Also, Comsure does not seek any payment for highlighting these important articles. If you want any article removed, Comsure will automatically do so on a reasonable request if you email email@example.com.