Compliance Function: How It Is Structured and What It Must Do

A compliance function is the arrangement inside a registered firm that makes one named person answerable for whether the firm is actually meeting its regulatory obligations. The arrangement has four working parts: a named officer, a reporting line that does not run through the activity being checked, a plan of checks written before the year starts, and a written record of what was found and what was decided.

Underneath all four parts sits one problem, and it is structural rather than moral. Picture a household where the same person does the shopping and keeps the account book. Nobody is dishonest on any single day. Yet at the end of the month nobody in that household can say with certainty what was spent. The only person who could check is the person who would have to report themselves. Now move that shape into a registered firm. Sooner or later the honest answer and the comfortable answer point in different directions. So the person answering whether a client was treated as the rulebook requires cannot be the person whose targets, appraisal and increment depend on that answer being yes.

Every structural feature of a compliance function is an answer to that one problem, so the arrangement matters far more than the seniority, the title or the diligence of the person sitting in the seat. The obligation to have such a function at all is an Indian one, set out in the Indian rulebook named below and read at its source.

Sarvodaya Capital Advisors Private Limited, an invented nine person firm in an unnamed Indian city, is the worked case: two founders, three people producing research, two in advisory, one compliance officer and one in operations. Kamala Ravindran founded it and is proposed as its principal officer. Devaki Suresh is the compliance officer. Nirmal Achari produces the research. Harish Vaze sits on the board as a non executive director. The Bhoite household, one salary and two dependants with a home loan running, is the advisory client whose file turns up in the year's checks. Every figure below is a number Sarvodaya chose for itself, never a threshold the rulebook sets.

What is a compliance function, and what is it for?

A compliance functionThe arrangement inside a firm that is answerable for whether the firm's regulatory obligations are actually being met. is not a department, a software licence or a folder of policies. A compliance function is an arrangement that produces one thing: an answer, backed by evidence, to whether the firm is doing what its registration obliges it to do. Notice the shape of that question. The question is not what the rule says, and not whether the rule is fair or convenient. Somebody else settles the meaning of the instrument. The function begins after the meaning is settled and asks the flatter, harder question of whether the firm is meeting it in practice, on ordinary days, in ordinary files, when nobody is watching.

The function is answerable for whether obligations are met, never for what the obligations say, and that single boundary decides most of the arguments a small firm has about what its compliance officer is for. Sarvodaya Capital Advisors Private Limited has nine people and no compliance department, and it never will have one. The firm has instead one person carrying the answerability, a line she reports along, a plan of what she will look at, and a record of what she found. The four things are the function. A larger firm with forty people in compliance has exactly the same four things, drawn larger.

Think about why all four are needed rather than one. A named person with no plan looks at whatever landed on her desk. A plan with no independent line produces findings that get talked out of existence in a corridor. A line and a plan with no record leave a year of work that cannot be shown to anybody who asks. And a record produced by nobody in particular is a stack of paper with no author standing behind it. The four parts fail together. The drawing below therefore shows what each removal costs rather than what each part contributes.

Who appoints the compliance officer, and why is the appointment a named one?

The compliance officerThe single individual a firm names as carrying responsibility for compliance, so that the responsibility has one address rather than being spread across everybody. is appointed by the firm's board, and the appointment names a person rather than describing a post. Naming a person sounds like a formality and is the opposite of one. Consider what shared responsibility does in ordinary life. If four flatmates are responsible for the electricity bill, the bill is late roughly every second month, and not one of the four has done anything wrong. Responsibility spread evenly is responsibility with no address. Naming one person gives the duty an address, and an address is what makes it possible to ask a question and get an answer rather than a discussion.

Naming an individual converts a duty the whole firm holds vaguely into a duty one person holds specifically, and that specific form is the only one in which a duty can be discharged, checked or failed. At Sarvodaya Capital Advisors Private Limited the board named Devaki Suresh. The board recorded the appointment in its own minutes, told the staff who she was, and put her name into the file the firm keeps for its registration. Kamala Ravindran, the founder, is proposed as the principal officer in the application. Principal officer and compliance officer are two different jobs held by two different people. Sarvodaya made that split deliberately, in a firm small enough that it could easily have doubled the two up.

Two further things follow from a named appointment, and both are practical. The first is that the person has to be reachable. A regulator writing to a firm writes to somebody, and a name with no working address is not an appointment. The second is that leaving becomes an event. When a named officer resigns, the firm has a gap it can see. A responsibility with no name on it drifts quietly into the hands of nobody in particular, and nobody notices the day it goes. Whether the officer must hold a particular certification is a separate matter and is covered elsewhere. A person, not a post, carries the answer.

Why does the reporting line matter more than the job description?

One point carries more weight than any other. The reporting lineWho a person formally answers to inside a firm, which decides who appraises them, who sets their targets and who can quietly bury what they say. decides whether the function is independent, and no job description, however carefully written, can substitute for it. Read the two arrangements in the drawing below side by side. Both use identical geometry, with exactly one thing changed.

On the left, Devaki Suresh reports to the board through Harish Vaze, the non executive director. She checks the advisory and research activity, so the arrow of the check points into the business while the arrow of her reporting points past the business to the board. On the right is the arrangement Sarvodaya could easily have adopted instead, in which the compliance officer reports to the head of advisory. The check still points at the advisory work. But so now does her appraisal, her increment and her next promotion.

When the reporting line runs into the activity being checked, the officer has to choose between the honest answer and her own interests every time she finds something, and an arrangement that repeatedly asks a person to choose against themselves is not a control at all. The reporting line is therefore what anybody assessing whether a function is real reads first. Watch what it does to the question in the room. In the first arrangement, the question a finding raises is what to do about it. In the second, the question is whether to write it down.

What does the function plan before the year even starts?

The monitoring planThe written list, drawn up in advance, of what a compliance function intends to check during the period ahead. is a list of what will be checked, written before the period it covers. Writing the list first is the entire point. A plan written after something has gone wrong is a reaction, and a reaction only ever looks where somebody has already pointed. A plan written first commits the firm to looking in places nobody currently suspects. Looking where nobody suspects is the only way anything unsuspected is ever found.

Devaki Suresh writes Sarvodaya's plan in the first week of the year and takes it to Harish Vaze before it runs. The plan lists fourteen checks, a number Sarvodaya chose for itself rather than one any rulebook sets: five on the duties Sarvodaya owes the people it advises, three on the research Nirmal Achari produces, three on the registers and records the firm keeps, two on its people, and one on complaints. Five plus three plus three plus two plus one is fourteen, and the arithmetic matters because a plan whose parts do not add up to its own total has already stopped being a document anybody relies on.

An investigation goes where the trouble is; a function goes where it said in advance it would go. Writing the plan before anything is found is what separates the two. Follow the year in the drawing. The plan sits at the left, closed and dated, before the first check runs. Then fourteen checks run across the months. Eleven of them find nothing. A check that finds nothing is not a wasted check but a documented answer. Three of them find something. At the end, a report carries what was planned, what was done, what was found and what was decided to the board.

Here is the plan itself, set out the way Devaki Suresh keeps it. Read the right hand column as a commitment rather than a description. Every row is a promise to look whether or not anybody is worried.

What is the difference between monitoring and testing?

Monitoring and testing get used interchangeably in ordinary speech, and the two are not the same activity at all. Monitoring is watching the business as it runs: sitting near the advisory desk, reading what comes past, noticing what people mention. TestingPulling a sample of actual records and checking each one against the requirement, rather than watching for problems to surface on their own. is pulling a sample of actual records and checking each one against the requirement, whether or not anything about that sample has ever attracted attention.

The everyday version is a school bag. A parent who watches their child pack every evening is monitoring, and will catch whatever happens in front of them. A parent who empties the bag on a Sunday and lays out everything inside it is testing, and that is the only one of the two who finds the note from three weeks ago. Neither parent is more diligent. One method can only find what surfaced, and the other goes and looks.

Monitoring can only ever surface what somebody had already noticed, so a monitoring plan without any testing in it will finish the year clean and will have proved nothing. Sarvodaya's client agreement file holds 148 records. Devaki Suresh could spend the year alongside the advisory desk and end up looking at the three records that came up in conversation. Or she could pull twenty records from the whole file, chosen without regard to whether anybody was worried about them, and read each one against the written list of everything an agreement must carry. The drawing shows both years, over the same 148 records.

One more distinction inside testing decides how the sample is read. A test asks a fixed question of every record in the sample, and the question is settled before the first file is opened. Devaki Suresh does not read twenty agreements to see whether anything strikes her. She reads twenty agreements against a written list of what an agreement must carry, and records each one as met or not met. A test can therefore be repeated by somebody else and reach the same answer, and a test leaves a record that means something a year later.

What did one year at Sarvodaya Capital Advisors actually look like?

The year, worked. Every figure below is what one small firm chose to do rather than what any rulebook requires. Five of the fourteen checks ran against the largest populations and are worked in full here; the other nine ran the same way against smaller ones.

Read the third column before the fourth. Ninety one records were opened, read against a written requirement and marked met or not met: twenty plus twenty plus twelve plus nine plus thirty. Three came back not met. Three exceptions from ninety one tested records at a nine person firm is an ordinary working year, and a year that tests ninety one records and reports nothing is the year worth asking about. Notice also that the certification check tested all nine people rather than a sample. When the population is nine, sampling buys nothing.

Two of the three exceptions never left the firm. The first came out of the client agreement check: one agreement in the sample of twenty had been signed on time but was filed nine days later, so on the day the check ran the file was incomplete. Devaki Suresh recorded it, Kamala Ravindran agreed a change so agreements are filed in the same week they are signed, and the register row was closed with the new process attached to it. The second came out of the certification check. Two certifications lapsed in the same month, both having been taken in the same week when Sarvodaya was being set up. How long a certification stays valid is set in the rulebook and read there. A register caught the clash, and a memory would not have.

The third exception is the one that matters, and it is different in kind. The Bhoite household, Sarvodaya's advisory client with one salary, two dependants and a home loan running, had a life event during the year. Advice went out to them on the day. The updated risk profile record was completed two days after the advice, not before it. Nothing was lost, nobody complained, and the household is perfectly happy. A duty owed to a person was still not met in the order it should have been met, and the missed order is the finding that left the room.

For completeness, the registers the plan reviewed produced their own picture of the year. The rule change register logged 11 entries: 7 were circulars issued after the last consolidation, 3 required a change to a written process inside Sarvodaya, and 1 required a communication to every client. The enforcement update log recorded 6 orders read during the year, of which 2 named a duty Sarvodaya also carries. The complaint register held 4 complaints, of which 3 were closed at the firm and 1 was escalated to the regulator's grievance route. Of the 148 clients whose risk profiles were recorded, 12 were profiled again after a life event and 4 of those 12 came out in a different category from before.

What happens when the function finds something?

An exceptionA finding that something did not meet a requirement, recorded as such rather than as an opinion about how well the firm is doing. travels a fixed route, and the route is the same whether the finding is trivial or serious. The finding is recorded with a date. The finding is then assessed against the requirement rather than against how anybody feels about it. Something is actioned, meaning a change is made rather than an intention expressed. Then the row is closed, with the evidence of the change attached to it.

The route never varies by how embarrassing a finding is. A fixed route is precisely what stops a small firm quietly deciding that this particular finding is not really a finding. The discipline is in the fourth step. A row that is closed with a promise attached is not closed, it is postponed, and postponed rows are where a compliance record starts to drift away from the firm it describes. Devaki Suresh closes the agreement filing row only once she has seen agreements filed the same week for a run of new clients, and the evidence of that sits in the row.

When does a finding stop being internal?

EscalationTaking a finding to a level above the person or team whose activity produced it, so that it can no longer be settled by the people it concerns. is decided by what the finding touches, not by how large it looks, how much money is involved, or how awkward the conversation would be. The escalation test has to be written down before the year runs, for the same reason the plan does: a line drawn in the moment is a line drawn by whoever is most uncomfortable.

A paperwork step missed inside the firm and a duty owed to a client that was not met are different in kind rather than different in size, and only the first kind can be closed inside the room where it happened. Look at Sarvodaya's two examples side by side. An agreement filed nine days after signature is entirely internal: the client signed, the client has their copy, nothing owed to them went undone. Advice reaching the Bhoite household before their risk profile record was complete is not internal at all. The order of those two steps is the protection the household was owed. The first is closed by Devaki Suresh and Kamala Ravindran between them. The second is recorded, and then carried to Harish Vaze on the board.

What is a compliance function not?

Three jobs get folded into this one seat in small firms, and each folding costs something. A compliance function is not the legal function. A compliance function is not the audit function. And a compliance function is not the conscience of the business. Calling it the conscience is the most flattering of the three mistakes and the most damaging.

Start with legal. When a new circular lands, somebody has to work out what it means. The meaning turns on the words, on what else the instrument says and sometimes on how a similar wording has been read before. Working out the meaning is a legal reading. The compliance question begins only once the meaning is settled, and it is flatter: is this firm doing that. Sarvodaya has no lawyer among its nine people, so it buys the reading in when a reading is genuinely needed. Sarvodaya never treats Devaki Suresh's view of what a circular means as the firm's settled interpretation. Treating one view that way would quietly make one person both the author and the checker of the standard she is checking against.

Audit asks a third question again: not what the rule means and not whether the firm met it, but whether the controls that were supposed to ensure it actually work. Internal audit and internal financial controls come from company law and are covered where company law is taught. Legal asks what the instrument means, compliance asks whether the firm is meeting it, and audit asks whether the machinery meant to ensure it functions, and a firm that runs all three questions through one person gets a confident answer to none of them.

The third mistake is subtler and needs naming. A compliance function is not the firm's conscience, and treating it that way lets everybody else put theirs down. When the advisory desk starts saying that compliance will catch anything wrong, the duty has quietly moved from the person doing the work to the person checking a sample of it, and a sample was never designed to carry that weight. Sarvodaya's rule is stated plainly to all nine people: the duty is owed by whoever does the work, and the function checks whether it was met.

What does a report with no exceptions actually signal?

The report is how the function reaches the boardThe body of directors a registered firm's compliance reporting ultimately reaches, sitting above the business activity being checked., and its content is fixed by what the function did: what was planned, what was completed, what was found, what was decided, and what remains open. How often it must go, and to whom, is set out in the rulebook and read there. The harder skill is reading one when it arrives.

A report showing no exceptions is not evidence that a firm complied; it is evidence about the checking, and the first question it should raise is how many records were actually tested. The specimen below carries a number on two lines and a word on a third, and the line that would show whether any of it means anything has been left blank. A firm reading that report at a board meeting will hear the word none and feel reassured. The blank line is the only line worth discussing.

What record does the function leave, and who reads it?

Everything above produces one thing that outlives the year: a record. The record has five parts, and the five are always the same. The plan, dated before the period it covers. The completed checks, showing what was tested and how much of it. The exceptions, in the words of the person who found them. The decisions, showing what changed. And the dates, running through all four so the order can be reconstructed by somebody who was not there.

An inspection reads the function's own record before it asks the firm a single question. The record is the only thing that can tell a function that ran from a firm that describes one. Think about why the order of reading works that way. Anybody can describe a diligent year in a meeting. Nobody can produce, after the fact, a plan dated before the year with fourteen rows on it, a set of tested samples with the population sizes recorded, three exceptions written in the language of the day they were found, and decisions dated after the findings rather than before them. The record is hard to fabricate precisely because it is a sequence of dated small things.

Sarvodaya's record inventory holds 7 categories of record, and the firm generates around 1,480 filed records in a year across all seven. The compliance function's own record is one of those categories. How long each category must be kept is a separate matter, set in the rulebook and covered separately.

How does somebody outside the firm use any of this?

Four different readers use a compliance function, and none of them reads it the way the firm does. An inspection reads the record first, as above, and its opening question is usually the flattest one available: show me the plan and its date. A client reads it without ever seeing it. When the Bhoite household asks why a form has to be completed before a conversation about their home loan can turn into advice, the answer is a duty the function checks, and the household experiences the function as an inconvenience that is actually a protection.

A bank or a platform doing diligence before working with Sarvodaya reads two things and stops: who the compliance officer is, and who that person reports to. An outsider assessing a firm can learn more from the reporting line in two minutes than from a compliance manual in two hours. The manual describes intentions; the line describes incentives. Reading the line before the manual is a habit worth borrowing. Handed a policy document by any organisation, a reader learns most by establishing who the person enforcing it answers to before reading a word of it.

The fourth reader is somebody joining the firm. A person taking a job at a nine person advisory firm can ask three questions at interview and know a great deal: who is the compliance officer, who does that person report to, and may I see the shape of last year's monitoring plan. A firm that answers all three easily has a function. A firm that finds the third question strange has a title and a description. A title and a description are a different thing entirely.

Sarvodaya Capital Advisors Private Limited, Kamala Ravindran, Devaki Suresh, Nirmal Achari, Harish Vaze and the Bhoite household are invented.
Educational material. Not advice on any investment, tax, budget or market position.