When establishing a compliance department, who should the employees report to?

When establishing a compliance department, who should the employees report to? Who should have oversight to the review/audit their work? Should we have an audit committee or should there be a separate committee? If a separate committee is established, would it need to include at least one board member? I am trying to define the difference between a compliance officer that has direct involvement in the implementation of policy and procedures, reporting (i.e., also serves as the CRA officer) and conducting reviews. I see the audit department as having a responsibility to audit the compliance department's work. We are a small bank just crossing the half billion mark. Staffing is an issue and most employees wear multiple hats.