Are Risk, Compliance, Internal Audit, and Business Functions Operating with Clearly Defined Responsibilities and Effective Escalation Procedures?

Most control failures are not caused by lack of policies. They are caused by confusion about who owns the risk, who oversees it, who assures it — and who speaks up when something goes wrong.

When responsibilities blur, issues fall between the cracks. Business units assume Compliance approved it. Compliance assumes the business owns it. Risk reports it, but no one acts. Internal Audit finds it two years later.

The governance test is simple: Could every employee answer — for my area, who does what for risk, and where do I escalate fast when I see a problem?

If not, accountability is theoretical.

Why This Matters Now

Regulators, examiners, and boards no longer accept vague ownership. For financial institutions and other highly regulated organizations, unclear roles lead directly to:

• Regulatory findings

• Delayed escalation of credit deterioration, fraud, cyber incidents and third-party failures

• Duplication in low-risk areas and gaps in high-risk areas

• A culture where people see issues but do not raise them

  
  

Clear roles do not create bureaucracy. They create speed, ownership, and safety.

The Model That Should Govern: Three Lines With No Gaps

Leading practice is the Three Lines Model, adapted to your size and complexity:

Line	Who	Core Responsibility	Owns Risk?
1st Line: Business and Operations	Lending, deposits, branches, operations, IT, product, marketing	Own and manage risk day-to-day. Design and execute controls, follow policies, identify issues, remediate within appetite	Yes — owns the risk and the control
2nd Line: Risk and Compliance	Enterprise Risk, Credit Risk, Compliance, AML, Model Risk, Information Security oversight	Set standards, provide independent oversight and challenge, aggregate risk, advise, monitor appetite and KRIs, report to committees	No — oversees and challenges, does not own the business decision
3rd Line: Internal Audit	Internal Audit	Independent assurance to the Board/Audit Committee that 1st and 2nd lines work as designed	No — assures, does not design or operate controls

Support functions — Legal, HR, Finance — enable all three lines but do not replace them.

Common failure: The 2nd line becomes a second 1st line, approving transactions, cleaning alerts, or operating processes. That destroys independence and hides ownership. The rule: Risk and Compliance can advise, review, and challenge. The business decides and owns the outcome within appetite.

6 Signs Responsibilities Are Unclear

1. Two answers to “who owns this?” Ask who owns model performance, complaint remediation, vendor performance, or data quality and you get different names.

2. Risk and Compliance are approvers, not challengers. They are signing off on loans, new accounts, marketing, or wires instead of setting criteria and testing compliance.

3. Issues are reported but not owned. Risk committees review dashboards, but action items have no single owner, deadline, or funding

4. Audit is consulted on design, then audits its own advice. Loss of independence that examiners will criticize.

5. Escalation depends on relationships. Star performers bypass controls, and staff escalate to their manager’s friend rather than through a defined path.

6. Charters and job descriptions are stale. Committee charters, RACI  (Responsible, Accountable, Consulted, Informed) charts, and policy ownership statements have not been updated for new products, AI tools, conversions, or reorganizations.

If two or more apply, you have a design problem, not a people problem.

What Clearly Defined Responsibilities Look Like

1. Documented in plain language

For each material risk — credit, liquidity, interest rate, AML, fraud, cyber, third-party, data, model, resilience — define:

• Risk owner in the 1st line

• Policy and standard owner in the 2nd line

• Oversight committee

• Key controls and who performs them

• Key metrics, limits, and appetite

• Assurance provider and frequency

Use a one-page RACI for each domain:

• Responsible: Does the work

• Accountable: One owner for the outcome

• Consulted: Provides input before action

• Informed: Notified after action

There can be many Responsible parties, but only one Accountable owner.

2. Charters that differentiate

• Business charters: Own risk, operate controls, self-identify and remediate issues, attest to control effectiveness

• Risk/Compliance charters: Independence, authority to challenge and escalate to the Board, no operational ownership, direct access to Risk Committee

• Audit charter: Independence, objectivity, unrestricted access, reports functionally to Audit Committee, no management responsibilities

Review charters annually. If management can edit Audit’s scope or budget without Audit Committee approval, independence is impaired.

3. Independence protected in practice

• Chief Risk Officer and Chief Compliance Officer have direct, unfiltered access to Risk Committee and Board, with executive sessions without management present

• Chief Audit Executive reports functionally to Audit Committee, administratively to CEO — never to Chief Financial Officer, Chief Risk Officer, or General Counsel for audit conclusions

• Compensation for 2nd and 3rd line is not tied to business volume or revenue they oversee

• Staffing and budgets for Risk, Compliance, and Audit are tied to risk profile and growth, not just cost targets

What Effective Escalation Looks Like

Clear ownership without fast escalation still fails. Issues must move up quickly, with protection for those who raise them.

An effective escalation framework includes:

1.       Clear triggers — no judgment required

Staff should not have to decide if something is “big enough.” Define automatic escalation for:

• Breach or near-breach of risk appetite, limits, or concentration caps

• Fraud, cyber, or privacy incident above a threshold, or any customer-harm event

• AML alert backlogs or SAR filing delays

• Control failure, reconciliation break, vendor outage, or failed change

• Repeat complaints, examiner or audit high-rated finding

• Any direction to bypass policy or control

2. Clear paths and timelines

• Who to notify, in what order, within how many hours — business owner to Risk/Compliance to executive to committee to Board/regulator if required

• 24-hour rule for high-risk events to Risk/Compliance and executive leadership; same-day to committee chairs for material events; full Board notification per policy

• After-hours and processor/vendor incident contacts tested quarterly

• Documentation standard: what happened, impact, containment, customer impact, root cause hypothesis, next update time

3. Multiple channels

• Chain of command, Risk/Compliance hotline, HR/whistleblower line, and anonymous reporting

• Explicit non-retaliation statement, lived by leadership and tracked by the Board

• No “escalation by email only” — require acknowledgment and tracking to closure

4. Tracking to resolution, not just reporting Every escalation gets a ticket, owner, due date, and validation of remediation. The Risk Committee reviews aging, repeat escalations, and overrides. Internal Audit periodically tests those escalations actually resulted in control fixes.

Reporting without remediation is just documentation of failure.

How Committees Make This Work

Confusion at the staff level usually mirrors confusion at the committee level.

Leading practice:

• Board: Approves risk appetite, holds management accountable, ensures 2nd and 3rd line independence and resources

• Risk Committee: Oversees enterprise, credit, liquidity, market, operational, compliance, AML, fraud, technology, and third-party risk; reviews Key Risk Indictors (KRIs), appetite breaches, and remediation

• Audit Committee: Oversees Internal Audit independence and plan, financial reporting, issue validation, whistleblower program, and coordination with external auditors/examiners

• Compliance Committee (or Risk sub-committee): Deep dive on financial crime, fair lending, complaints, and regulatory change

• Management committees (Asset and Liability Committee (ALCO), Credit, Operations/IT, New Product): Own 1st-line decisions within appetite; escalate breaches and new risks up

Joint Audit-Risk sessions at least annually prevent the classic gap: Risk sees emerging risk, Audit audits past risk, and neither connects them.

Questions Every Board Should Ask This Year

• For our top 8-12 risks, who is the single accountable owner, and where is it documented?

• Where are Risk and Compliance operating controls instead of overseeing them, and what is the plan to return ownership to the business?

• How do Chief Risk Officer (CRO), Compliance Officer, and Chief Audit Executive (CAE) escalate to the Board without management filtering, and when did they last use it?

• What must be escalated in 24 hours, to whom, and how do we know staff understand it?

• How many overrides, policy exceptions, and limit breaches occurred, who approved them, and did they cluster in one person, unit, or partner?

• What issues were self-identified by the 1st line vs. found by 2nd line, Audit, or examiners? A low self-identification rate signals weak ownership or fear of speaking up.

• When was the last test of our escalation and incident playbooks — including core processor, cyber, and fraud scenarios?

• Do whistleblower and complaint trends show trust in escalation, or fear of retaliation?

Action Checklist: From Confusion to Clarity

• This quarter: Approve updated charters for Risk, Compliance/AML, and Audit; approve a one-page RACI for top risks; confirm direct Board access and executive sessions

• Next 90 days: Publish simple escalation one-pagers by risk area with triggers, contacts, and timelines; train all managers; test with a tabletop

• Quarterly: Review appetite breaches, overrides, aging escalations, self-identification rate, repeat findings, and 2nd-line independence indicators — not just dashboards

• Annually: Independent assessment of the three-lines design after any new product, core conversion, AI deployment, merger, or reorganization.

Bottom Line

High-performing institutions do not rely on heroes to catch problems. They rely on clarity. The business owns risk. Risk and Compliance set the bar and challenge honestly. Internal Audit tells the Board the truth without fear. And every person knows how to escalate fast — and trusts they will be heard.