No Result
View All Result
SUBSCRIBE | NO FEES, NO PAYWALLS
MANAGE MY SUBSCRIPTION
NEWSLETTER
Corporate Compliance Insights
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe
No Result
View All Result
Corporate Compliance Insights
Home Compliance

Independence of the Compliance Function: A Critical Component of the Three Lines Model

Where the IIA’s New Model Falls Short

by Ellen McCarthy
August 28, 2020
in Compliance, Featured, Internal Audit
illustration of businesswoman with superhero shadow

Ellen McCarthy, Head of Compliance at Computershare, opines on the IIA’s recent updates to its three lines of defense model, positing that they fail to recognize the importance of the independence of the compliance function.

The Institute of Internal Auditors (IIA) last month issued a new three lines model, updating its “Three Lines of Defense” model to set forth the IIA’s “latest understanding of governance and risk management.” Below, I have set out my personal view along that, while the new model applies flexibility and a principles-based approach (a very positive development), the chief shortcoming of the model is that it overlooks the criticality of the independence of the compliance function.

Independence of Compliance: What does it mean?

The Basel Committee on Banking Supervision (BCBS), a 45-member global group of banking regulators and central banks, has published what many consider the most cogent description of compliance function independence. Members of this group include:

  • Board of Governors of the Federal Reserve System
  • Office of the Comptroller of the Currency
  • Federal Deposit Insurance Corporation
  • Federal Reserve Bank of New York in the United States
  • Prudential Regulation Authority
  • Bank of England in the United Kingdom
  • European Central Bank
  • Swiss Financial Market Supervisory Authority
  • Bank of Japan

According to the BCBS, independence is a core principle of compliance and consists of four elements:

  1. The compliance function should have a formal status within the organization – documented within a policy and widely communicated throughout – that gives compliance “appropriate standing, authority and independence.”
  2. The organization should appoint an executive with overall responsibility for overseeing the organization’s management of compliance risk and supervision of other compliance function staff members, but without direct business line responsibilities.
  3. Compliance function staff members should preferably “perform only compliance responsibilities.” Conflicts of interest, whether actual or perceived, between competing compliance and non-compliance responsibilities may compromise independence.
  4. The compliance function should have direct access to the governing body, as well as the right to obtain any information and contact any personnel of the organization necessary to carry out its compliance responsibilities.

What does it look like in practice?

In practice, organizations achieve the four elements of independence by:

  • Implementing a written compliance framework that is approved by the governing body and establishes a distinct and empowered compliance function.
  • Naming a Chief Compliance Officer (CCO) with a functional reporting line to a committee of the governing body that is comprised entirely of non-executive (outside) directors, in order to ensure autonomy.
  • Ensuring that the CCO and staff members of the compliance function do not perform business responsibilities.
  • Allowing the compliance function unfiltered access to information needed to carry out its oversight role.

Why It’s So Critical

Under the three lines model, the business units or “first line” own the various business risks, as well as the obligation to comply with external regulatory requirements – laws, rules and regulations – and internal policy.

The second-line roles, including the compliance function, provide oversight to the business units in managing their risks and compliance obligations.

Globally, in banking and financial services as well as in the health care sector, regulators recognize the criticality of independence to effective oversight by the compliance function. Even in nonregulated industries, compliance function independence is commonly considered a best practice area.

In North America, regulators and other governmental agencies have made it clear that the compliance function must be independent, autonomous and of equal stature with other functions in the organization (i.e., having a seat at the executive table). Groups in support of this structure include:

  • S. Department of Justice (DOJ)
  • Securities and Exchange Commission (SEC)
  • Office of the Comptroller of the Currency (OCC)
  • Financial Crimes Enforcement Network (FinCEN)
  • Federal Financial Institutions Examination Council (FFIEC)
  • Office of the Superintendent of Financial Institutions (OSFI) in Canada

Recent Guidance Highlights the Criticality of Independence

Most recently, in July 2020, the DOJ and SEC updated their joint “Foreign Corrupt Practices Act (FCPA) Resource Guide,” incorporating a separate June 2020 DOJ update to its “Evaluation of Corporate Compliance Programs”  guidance. The updated DOJ/SEC guidance added further nuance to the concept of compliance function independence: that an organization should consider its system of internal controls as separate and distinct from its standalone corporate compliance program, although the two may overlap.

Practically speaking, this latest nuance makes perfect sense if we go back to the concept of a first line (the business units) that is responsible for managing their compliance and other risks, and that needs a system of internal controls to do so. In this scenario, the independent (second line) compliance function, through its separate compliance program, provides oversight, support and advice to the first line. Rounding out the picture, on the third line, is the internal audit function, which performs an independent assurance role.

In my opinion, the three lines model will only work if both the compliance function and internal audit have independence.


Previous Post

4 Ways to Fight U.S. Stimulus Fund Fraud During a Pandemic “Perfect Storm”

Next Post

OCC Issues Guidance on Safekeeping, Custody of Cryptocurrency

Ellen McCarthy

Ellen McCarthy

Ellen McCarthy is Head of Compliance in the U.S. at Computershare. Her background includes serving as Executive Vice President and Chief Risk & Compliance Officer of the American Stock Transfer & Trust Company (AST). There, she directed all corporate compliance and risk functions throughout North America for AST and its affiliated operating entities, including CST Trust Company, Donlin Recano and D. F. King. Prior to joining AST, Ellen held Senior Counsel roles with the New York Stock Exchange (NYSE)/Financial Industry Regulatory Authority (FINRA) Enforcement Department. Ellen earned a J.D. from St. John’s University and a B.A., summa cum laude, from St. Joseph’s College, where she was class valedictorian. She is admitted to practice before the U.S. Supreme Court and is a Bar Member of the State of New York.

Related Posts

Fox_DOJ Speeches_f

Analysis of Recent DOJ Statements

by Corporate Compliance Insights
March 23, 2023

DOJ leaders provide insight into agency's plans. Analysis of Recent Statements DOJ Shaping the Future of Corporate Criminal Enforcement What’s...

Fox_2023 ECCP Update_f

2023 Evaluation of Corporate Compliance Programs

by Corporate Compliance Insights
March 23, 2023

Keeping up with 2023 changes to DOJ guidelines. Additions, Deletions & Changes From 2020 2023 Evaluation of Corporate Compliance Programs...

encompass update

Encompass Launches pKYC Maturity Model

by Corporate Compliance Insights
March 22, 2023

KYC automation platform Encompass has unveiled a new perpetual Know Your Customer (pKYC) maturity model designed to help banks improve...

consilio onna partnership

Consilio, Onna Seek to Streamline eDiscovery for Cloud Apps

by Corporate Compliance Insights
March 22, 2023

Legal technology provider Consilio has launched a new platform, Sightline Collect, powered by data management supplier Onna. The platform is...

Next Post
OCC Issues Guidance on Safekeeping, Custody of Cryptocurrency

OCC Issues Guidance on Safekeeping, Custody of Cryptocurrency

Compliance Job Interview Q&A

Jump to a Topic

AML Anti-Bribery Anti-Corruption Artificial Intelligence (AI) Automation Banking Board of Directors Board Risk Oversight Business Continuity Planning California Consumer Privacy Act (CCPA) Code of Conduct Communications Management Corporate Culture COVID-19 Cryptocurrency Culture of Ethics Cybercrime Cyber Risk Data Analytics Data Breach Data Governance DOJ Download Due Diligence Enterprise Risk Management (ERM) ESG FCPA Enforcement Actions Financial Crime Financial Crimes Enforcement Network (FinCEN) GDPR HIPAA Know Your Customer (KYC) Machine Learning Monitoring RegTech Reputation Risk Risk Assessment SEC Social Media Risk Supply Chain Technology Third Party Risk Management Tone at the Top Training Whistleblowing
No Result
View All Result

Privacy Policy

Founded in 2010, CCI is the web’s premier global independent news source for compliance, ethics, risk and information security. 

Got a news tip? Get in touch. Want a weekly round-up in your inbox? Sign up for free. No subscription fees, no paywalls. 

Follow Us

Browse Topics:

  • CCI Press
  • Compliance
  • Compliance Podcasts
  • Cybersecurity
  • Data Privacy
  • eBooks Published by CCI
  • Ethics
  • FCPA
  • Featured
  • Financial Services
  • Fraud
  • Governance
  • GRC Vendor News
  • HR Compliance
  • Internal Audit
  • Leadership and Career
  • On Demand Webinars
  • Opinion
  • Resource Library
  • Risk
  • Uncategorized
  • Videos
  • Webinars
  • Well-Being
  • Whitepapers

© 2022 Corporate Compliance Insights

No Result
View All Result
  • Home
  • About
    • About CCI
    • Writing for CCI
    • NEW: CCI Press – Book Publishing
    • Advertise With Us
  • Explore Topics
    • See All Articles
    • Compliance
    • Ethics
    • Risk
    • FCPA
    • Governance
    • Fraud
    • Internal Audit
    • HR Compliance
    • Cybersecurity
    • Data Privacy
    • Financial Services
    • Well-Being at Work
    • Leadership and Career
    • Opinion
  • Vendor News
  • Career Connection
  • Events
    • Calendar
    • Submit an Event
  • Library
    • Whitepapers & Reports
    • eBooks
    • CCI Press & Compliance Bookshelf
  • Podcasts
  • Videos
  • Subscribe

© 2022 Corporate Compliance Insights

Welcome to CCI. This site uses cookies. Please click OK to accept. Privacy Policy
Cookie settingsACCEPT
Manage consent

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
CookieDurationDescription
cookielawinfo-checbox-analytics11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checbox-functional11 monthsThe cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checbox-others11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-necessary11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-performance11 monthsThis cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy11 monthsThe cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytics
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.
Others
Other uncategorized cookies are those that are being analyzed and have not been classified into a category as yet.
SAVE & ACCEPT