We are currently restructuring our "who does what" in regards to security and compliance. We now have one officer that covers both areas, a Safety and Security Specialist and a Compliance Specialist. Does anyone have a list of what is security and what is compliance?

Ok maybe my question isn't clear. Let me rephrase. Does your security person cover only the Bank Protection act, or do they take care of things like Identity Theft, SARs, etc.

My Security Dept worked closely on BSA/AML matters--we developed the expertise and monitored the legal/regulatory environment, but the Security Officer was charged with conducting all SAR-related investigations and filing the SARs. We also worked together on Regs CC and E (usually with Compliance playing defense!)

We do not have a Security Department, but our Reg. VP of Operations is our BSA/AML Officer who oversees Bank Protection Act etc. I as the Compliance Officer work's very closely with her. She also assist's me with the oversight of the deposit compliance. I depend on her expertise and knowledge with all the requirements under BSA. Regarding USAPA being incorporated into BSA, we work side by side including in-house counsel.

We too are doing some re-organizing. In the past Security Officer basically stuck to Bank Protection Act. Compliance picked up ID Theft, SARs, BSA and of course all the consumer protection regs. If I had my way, we'd divide responsibility 3 ways. Compliance, Security, Operations. Compliance would cover consumer protection regs. Security would handle Bank Protection Regs, ID Theft SARs and Operations would end up with dormant acocunts, BSA, and just about anything else that would come up with a Safety and Soundness exam . However, I am pretty used to NOT getting my way and I don't see this happening. Compliance (me) is a staff of 1 for 4 separately charterd banks. We are in the process of merging the 4 banks under one charter. Anyway, it appears mgmt is going to assign more of the security duties and operational duties to compliance. "Poor, poor, pitiful me".

At the institution that I work for our job titles pretty much sum up our job duties. The Compliance Officer (me) oversees 3 other Compliance Regulators. Our Security Officer has 1 Security Regulator. Basically, us Compliance people do anything that has to do with Compliance. Security people make sure the building is secure and what not. They also take care of SARs from the stand point that the Security Officer files them and his employee does any type of research that may be necessary. Whenever there is a question as to who does what, we just put our heads together and figure out a plan. Usually the Security Officer and his employee enforce the programs and policies that the Compliance Officer (myself) and my employees make. Hope that helps. Good luck. I helped start our program 10 years ago...its been a long way coming!

I just wanted to Thank "Anon" for the info. It really does help to know what else happens at other institutions!

DITTO!!!

Michelle, you didn't say it was fair game to toss Operations into the mix. When I first became a compliance officer in 1981, I reported to the senior operations officer and was in a peer group including all the servicing managers, branch ops & security. It was great! I was a department of 1, but they all had armies of people, so when staff meeting discussions turned to compliance, I got to beg for their help. With our boss chairing the meeting, what could they say but yes? Actually, we worked out a very good system that cast servicing managers in the role of compliance QC for the portfolios they serviced. I showed them what their clerks needed to look for & they made it happen. Most of my time was spent working with Marketing and the business managers during the product design stage where I could exert the most influence on our course of action.

To tell you the truth, anything was fair game. I juat wanted an idea of what other people were doing. I'm new to bank security and I'm not always sure where my job ends and compliance or operations starts.

Thanks for replying.

Michelle M:

Thanks for starting a great thread -- and I'd like to add my opinion . . .

"Security" is the evolutionary process through which we provide a safe and secure environment for our employees to work within -- and for our customers to conduct business within. There's no one "right" way to accomplish the Security Department's goals -- and a Security Program should be customized to suit the institution's individual needs. From my viewpoint, the primary responsibilities -- and activities -- of the Security Department involve issues relating to:
- Safety;
- Image;
- Documentation;
- Prevention;
- Enforcement;
- Investigation;
- Prosecution; and
- Recovery and profit.

The Security Officer should also be the manager of the business unit -- the Security Department -- within the institution. The Security Officer should also become proficient regarding these processes:
- Prevention;
- Identification;
- Apprehension;
- Prosecution; and
- Recovery.

It's always been my preference to divide the security-related tasks up this way:
- The Security Officer is responsible for performing security and safety-related tasks, including conducting ALL investigations;
- The Auditor is responsible for verifying the facts discivered by the Security Officer, documenting investigations and recommending changes to policies, procedures and internal controls;
- The Human Resources Manager is responsible for validating the facts discovered by the Security Officer if an employee is involved, representing the institution in institution-employee relations matters; and
- The Compliance Officer is responsible for ensuring that the Security Officer, the Auditor and the Human Resources Manager have complied with all rules, laws and regulations.

I recognize that this scenario may earn me the wrath of any of the afore-mentioned professionals . . .

Dana, Thank you for your insite. We're a small bank and have just centralized these functions so we're not always clear on who should take over what.

I am Security Officer and Compliance Officer. I am and was also do CRA/HMDA/BSA/Year 2000/Privacy/USA Patroit's Act/CIP/and choosing carpet and paint colors on the third floor addition.....

Needless to say, not only do I have a hard time drawing the line but so does my CEO.....

We have one person who is Safety, Security, & Compliance Officer, who has one Compliance Specialist and one Safety & Security Specialist. So it's really the specialist that are trying to sort out who does what.

Kathy, I just had a sheriff deliver a subpoena to the office and he handed it to me.

I asked if he wanted my title and he said no. He marked it down as PIC. Person In Charge.

I quickly added it to my job title list. Never know when you might need that one!

Right Michelle.......I'm getting to like all the titles...I just don't care much for the responsibility that goes along with them.........

But I must say, that after the last Compliance examination, the Examiner hit managment hard with...."poor compliance and security girl" she can't be all things to all people. They then allowed me to have 2 new employees to train. Well, I am very appreciative, but you know training takes time................ They are great people and one day my working life will be easy.....Right??????????????

I have the same situation with a part timer helping me. She also has receptionist duties.
Everytime I have her scheduled for something, they need her at the phones! Training is taking
4-ever! Now "management" has asked her to "help" in the loan department too!

She won't be back to help me until June, if I'm lucky!

Truthfully by the time you get the two trained you will probably need two more, and then have to train them, and then need two more...... Doesn't it always seem as soon as the people you have are trained there's enough work for more people?

I myself can not imagine having to train anyone on my compliance position, but I'm afraid it will happen....sooner than later!

Anybody want to offer a guess why I chose my handle?
You get three, but the first two don't count.
Security, compliance (deposit side only thank God!), and audit. No staff whatsoever. No budget whatsoever. I'm actually very grateful that my boss deals w/ installation of surveillance & alarm systems and the related contracts as part of "facilities management," even if he often doesn't look at things the way I would.
And Manny Ramirez makes $20 million a year for hitting baseballs. But I get the joy of making a positive contribution to society and having many fine people such as yourselves with whom to work. No offense but I'd just like to have one year at $20 mil if it's not asking too much.
End of whine. (sigh) TGIF.

I hear you. I'd even be willing to take $1 million for 1 year, because I probably couldn't hit more than 5% of what he does.

I'm glad to hear your handle has nothing to do with gambling

Our security officer is responsible for branch security which covers BPA. (security over premises, money, ATMs) She also investigates fraud, kiting suspects, fishy error resolution claims on debit and ATM cards, etc. She occasionally files SARs. Our operations manager is responsible for CTRs and SARs filed by tellers or new account personnal. Compliance does compliance audits for 26 different regs. (does not monitor) Monitoring is done by personnel under the supervision of the Operations manager.

Thank you, I think we'll be delagating responsibilities in a similar fashion.

Everyone - your responses have been really helpful in the who does what mess, and yes, compliance is usually the "everything else" person.