Compliance Study_complet - pwc

26 © PricewaterhouseCoopers - Protecting the brand, May 2005
Police officer
Monitoring compliance with policies and procedures
“Three line of control approach:
• Business unit - execution of controls
• Group compliance - oversight of monitoring
and testing
• Group audit - independent assurance”
Over 95% of respondents indicated that Compliance was responsible for monitoring adherence to policies and procedures,
often working closely with internal audit. However, in a few cases - generally where compliance functions were less
developed - this was the sole responsibility of internal audit. In some European countries, however, where explicit
requirements for compliance functions were relatively recent, less emphasis was placed on Compliance’s role with regards to
compliance monitoring (the primary emphasis being advice to business).
Monitoring day-to-day business transactions (suspicious transactions, employee dealing, etc.) was often an intrinsic
part of local compliance staff responsibility. These compliance staff might be simultaneously responsible for oversight of
monitoring and testing at the business unit level, potentially creating tensions and confusion about the differentiation
between the roles. Regular reporting was both to local management, and through the compliance network.
Where appropriate technological infrastructures were in place, Group Compliance backed up this “real-time”
monitoring (e.g. with global trading position monitoring). Group compliance also undertook special monitoring visits,
sometimes in conjunction with internal audit and legal. One European respondent carried out three to four wider “theme”
reviews per annum into specific risk areas. A North American respondent indicated that internal audit undertook some 20 to
30 special reviews into compliance on an annual basis. More broadly, Compliance collaborated closely with internal audit to
monitor compliance, often providing advice to internal audit as to what should be covered in its annual audit plan. However,
although the roles of compliance and internal audit were sometimes clarified through compliance charters or service level
agreements (SLAs), some respondents mentioned also the blurring of lines between the two functions, and the fact that
senior management and business did not always understand the differences between their roles. Others stressed frequent
communication as a means to avoid overlap between Compliance and internal audit.
Compliance’s ability to comprehensively prepare its monitoring plan was dependent on its awareness of both past
events, and future regulatory and business developments. Where Compliance was not involved directly in new business
initiatives, respondents indicated that both business and internal audit kept Compliance informed of potential compliance
risks emerging from new business in the majority of cases (see p. 33).
Taking corrective measures
Business line management was deemed responsible, in the main, for the rectification of compliance breaches and
weaknesses, although, this was seen as Compliance’s responsibility in a number of cases. In leading organisations,