I'm the banks Internal Auditor and have recently been asked to also be the bank's compliance officer. I would welcome the challenge, but at the same time want to do what's best for the bank. I know in some banks the same person fills both positions. However, I seem to recall one examiner stressing the fact there is a big difference between auditing for compliance and monitoring for compliance. What's the best way to keep the two separate in a set-up that's being considered. Are there any IA/Compliance officers out there that can help me?

I am addressing this as well in a previous post as I have the same dilemma! There's alot to be careful in not stepping over boundaries. As I find out more information I will let you know and would appreciate if you could do the same.

In my opinion, I would be concerned with losing your independence. I have not seen this particular role combined. At a previous bank, we had combined Audit, Compliance, Information Security, and Fraud into one department and the regulators did not like it at all. The only option I had was to state in my audit reports of those areas that I was not independent of the area under audit. If it were me, I would choose - Auditor or Compliance Officer, not both. Good Luck!

One approach you might consider is contracting for an outside audit firm to perform compliance audits. That's obviously more expensive than you're wearing both hats yourself, but I agree that would compromise your independence.

I was the combined CO/IA for two different banks for over 15 years. It worked because they were both small banks, one regulated by the Fed and one by the OTS. However, it is getting harder to justify the independence as compliance becomes more important. I really had to be careful and step back from the CO duties as I performed audits and vice versa. That meant writing myself up for things that I had missed - inadequate policies, etc.

It is not an ideal situation but it can be done, but only if your regulators agree with it.

It is similar to balancing on a sword. Whether you can get away with it depends on balance and whether or not your regulators wish to give you a shove. Some smaller banks can get away with it a for a period of time, if you structure it correctly. The compliance officer is just a resource for management (similar to the audit department) that may help them formulate compliance policies and procedures, but not be responsible for the policies or procedures that management wishes to implement or any day-today operations. If you are a large bank, this is not going to fly. I would run your proposed structure past your EIC and get some input. Better that then surprising them and have it noted in your next ROE.

This is what I have been hearing from a lot of people. So long as you are not writing policy and procedure and are not directly involved in training, you can be independent. I am at a small bank and we are looking to keep the day to day compliance with the department managers with me overseeing them. It was also recommended to me that I let my external auditors read my job description and see if there were any issues.

I audit mostly smaller community banks and I see this a lot. As long as you are not responsible for the policies and procedures and just have an advisory/consultative role you should be fine. So far from the reports I've seen from their regulators they have not had a problem with it.

I would also recommend having external auditors come in on a periodic basis to do reviews of BSA/OFAC, Compliance, Directors Exam, etc.

Thanks to all for your input. We currently have state examiners on site, and we have decided to consult with them on this issue.

Good idea. Just make sure you consult with the EIC or higher.