What it means
Day to day, the department maintains the policy library, runs training, screens customers and transactions, investigates incidents and files regulatory returns. In the three-lines model it sits in the second line of defence: the business owns the risk, compliance sets the rules and checks them, and internal audit independently tests whether both are working.
The commercial case is easier to make than it once was. Penalties, licence conditions, lost tenders and the management time consumed by a regulatory investigation typically cost far more than the salaries of the people who would have prevented the problem.
Independence is what makes the function credible. The head of compliance normally reports to the chief executive or a board committee rather than to a revenue-generating unit, and their pay is not tied to sales, because a compliance officer who can be overruled by the person they are policing is decorative.
Budgets are usually justified with two simple measures: compliance cost as a share of revenue, and compliance cost per employee. Boards also track leading indicators such as training completion rates, overdue policy reviews, breach reports raised internally and time taken to close remediation actions.
Two boundaries cause confusion. Compliance is not the legal team, which advises on what the law says and defends the company, and it is not internal audit, which tests the controls compliance relies on, so all three exist side by side in regulated firms.
In practice
Real-world examples.
Example
A payments fintech applying for an electronic money licence builds a compliance department before it processes a single transaction, because the regulator will not grant authorisation without named, qualified officers. The team of four covers financial crime, conduct and reporting, and its existence is a condition of the licence rather than an optional overhead.
Example
A pharmaceutical company's compliance department reviews every proposed payment to a healthcare professional against its transparency rules. When a regional sales manager proposes a speaker fee far above the going rate, the review stops the payment, and the incident is logged and reported to the audit committee.
Example
A manufacturer selling into forty countries gives its compliance team ownership of export controls and sanctions screening. Before each shipment, the team checks the customer, the end use and the destination, and a blocked order to an intermediary in a sanctioned jurisdiction is escalated the same day.
Formula
Calculation
Compliance cost ratio = total compliance department cost / operating revenue x 100. Compliance cost per employee = total compliance department cost / total headcount.
A mid-sized bank has operating revenue of $240,000,000 and 1,200 employees. Its compliance department has 18 staff at a fully loaded average cost of $140,000 each, spends $600,000 on screening and monitoring technology, and pays $380,000 to external advisers for regulatory change work.
Staff cost = 18 x $140,000 = $2,520,000
Total cost = $2,520,000 + $600,000 + $380,000 = $3,500,000
Compliance cost ratio = $3,500,000 / $240,000,000 x 100 = 1.46%
Cost per employee = $3,500,000 / 1,200 = $2,917
The bank can now compare that 1.46% against its own history and against the scale of the risk: a single enforcement action running to several million dollars would wipe out more than a year of the entire department's cost.Case study
Seen in the real world.
Kestrel Savings Bank is a fictional retail bank presented here as an illustrative example. It ran a compliance team of six people costing about $850,000 a year against revenue of $95,000,000, or 0.89% of revenue, and had comfortably passed several light-touch inspections.
A thematic review by its regulator found that customer due diligence files were incomplete on roughly a third of the accounts sampled, and that the compliance team had flagged the gap twice without anyone acting. The bank agreed a remediation plan costing $2,400,000 as a one-off, and expanded the department from six people to fourteen, taking annual cost to $1,900,000, or 2.0% of revenue.
Two years later, internally raised breach reports had risen from 41 to a lower and far better-quality nine, because the routine failures had been fixed and only genuine issues were being escalated. The chief executive's summary to the board was blunt: the bank had paid roughly three years of extra compliance budget in a single remediation bill to avoid spending one.
Watch out
Common mistakes.
- Treating compliance as a pure cost centre to be minimised. The relevant comparison is not the department's budget against zero, but its budget against the cost of the failures it prevents.
- Having compliance report to the head of sales or operations. Any reporting line into a revenue-generating function destroys the independence that makes the role work.
- Confusing compliance with internal audit. Compliance designs and operates controls, internal audit tests them, and one team cannot credibly do both.
Questions
People also ask.
What size should a compliance department be?
It depends on regulatory intensity rather than company size, so a small licensed payments firm may need more compliance staff than a much larger unregulated manufacturer.
Who does the compliance department actually report to?
In most regulated firms the head of compliance reports to the chief executive with a direct, unfiltered line to the board or its audit and risk committee.
Is compliance the same as risk management?
No, risk management covers the full spectrum of business risks including credit, market and operational risk, while compliance focuses on legal and regulatory obligations.
From the founder's library
Take it further with the book.
Build your financial confidence beyond this definition. Shihan's full-length guide, Accounting Fundamentals, takes the same plain-English approach and turns it into a complete, practical playbook for non-finance managers, business owners and students - with chapter-end quiz answers and presentation slides included.
25% off with code MMHQ25, applied at checkout. Priced in USD - checkout may show the equivalent in your local currency.
View the book and save 25%