I was formerly employed by a large bank (6.5 years) and I recently joined a mid-sized bank as a Senior Compliance Analyst on a compliance testing team. My experience has been to test controls (designed to mitigate risk). Testing schedules were granular, quarterly and rarely changed (even though the content tested did). In my new role, the testing is done (IMO) more like an audit. The test schedule will list an item like "Consumer loans - HMDA" but there are various consumer loan products and various LOBs within the bank that have those products. I think they are doing audit work, not so much compliance monitoring/testing. Any opinions? Does anyone have solid definitions of the two functions that might help differentiate who shoudl be doing what?

It's a hard question to answer without understanding the actual charter of the compliance department in your institution and how it relates to the charter of the audit department.

Agreed. You cannot simply compare tasks. This may be the only auditing done on regs.

Sadly, I don't know that they have charters.

Well, without knowledge of all audit and testing schedules it is hard to comment. There are many variations of this theme.

I can tell you what I do know... Audit is doing the same exact reviews that Compliance is doing. Audit first, then Compliance. It doesn't seem useful. We're moving toward a GRC system and I think that will definitely help foster change.


Thanks for your help and Happy Friday

This is IMO a very good question and one that many of us struggle with. I am currently developing a revised monitoring program at a new bank - but I come from a testing background that is more like an audit function. There is not much guidance on what is right or wrong, enough or not enough etc...

No, I turned here because I couldn't find a solid answer, but maybe the answer is that there isn't one answer. I'd love it other's chimmed in on what their experience has been, what worked and what didn't.

Thanks! Do you know of any resources for exploring the different variations?

I was frustrated by what little I could find.

-There is a topic under General Discussion from July of 2013 called Compliance Testing vs. Audit vs. QC, what's the difference?

-The FDIC Compliance Manual from June 2009 has a blurb about monitoring on page II-2.3 (We are an FRB regulated bank, but I figured anything helps)

Plus, I had some information of my own from monitoring at my other bank. Not much out there. I would appreciate anything else someone is willing to share!

Compliance can do follow-up testing to audits. If an audit issue comes into play then compliance may want to follow-up to be certain regulatory issue is satified by doing compliance testing. You will have certain areas where compliance monitoring is required. In audit there is requirement for audit to do ACH annual audit where compliance would not do that testing. It is how your bank addresses audit and compliance processes.