I think this really varies by bank. We're a $750 million 2-bank holding company, and we look at the functions that should be independent of management - compliance, internal audit, and loan review. We rolled them together into a risk management department with reporting to the Audit Committee of the corporate board. So now I serve as risk management officer and I do internal compliance audits each year; a loan review officer reports to me & is responsible for that whole program; and we outsource the internal audit function & I manage those relationships.
_________________________
Opinions are Bartman's, not those of my employer. "A noble spirit embiggens the smallest man."