Happy National Compliance Officer Day! Now, About Your Risk Assessment…

In honor of National Compliance Officer Day, Kimberly Boatwright has turned a familiar compliance exercise on its head: What happens when the person conducting the risk assessment is also the subject of it? The assessment below is entirely unofficial and written in good fun, but if the findings about crowded calendars, caffeine, and “just one more project” feel familiar, you’re probably in the right profession.

______________

The Compliance Officer Risk Assessment

A Completely Unofficial Self-Assessment (Because We Assess Everything Else)

By – Kimberly Boatwright

In recognition of Compliance Officer Day

Every year, compliance professionals conduct risk assessments, evaluate controls, identify weaknesses, document corrective actions, and remind management of the importance of maintaining an effective control environment.

Unfortunately, many of us rarely apply the same process to ourselves.

So, in honor of National Compliance Officer Day, Compliance Resource presents the following completely unofficial risk assessment.

Scope

This assessment was conducted to identify, assess, monitor, and mitigate the risks associated with serving as a compliance professional while simultaneously attempting to function as a productive employee, supportive colleague, responsible family member, and reasonably well-adjusted human being.

Executive Summary

The assessment identified elevated levels of compliance, operational, strategic, emotional, and reputational risk.

The financial institution’s control environment appears fundamentally sound; however, examiners identified a substantial dependence upon caffeine, determination, humor, and the persistent belief that things will become less busy next month.

Unfortunately, historical data do not support that conclusion. Management remains committed to collecting additional data.

Organizational Structure

Position	Assigned Resource
Chief Executive Officer	Management
Chief Compliance Officer	Management
Compliance Department	Whoever has not already been assigned 17 other projects
Business Lines	“We’ll get that to you.”
Training Department	Compliance
Internal Audit	Independent review
Human Resources	Available by appointment
Information Technology	Have you tried turning it off and back on again?
Emotional Support Department	Currently outsourced
AI Assistant	Increasingly involved

Inherent Risk Assessment

Risk Category	Rating	Trend
Workload Management	High	Increasing
Staffing Constraints	High	Increasing
Regulatory Change	High	Increasing
Burnout	High	Increasing
Work-Life Balance	High	Increasing
Decision Fatigue	Moderate/High	Increasing
Meeting Overload	Moderate/High	Increasing
Vacation Utilization	Low	Nonexistent
Coffee Dependence	Critical	Stable
Chocolate Consumption	Acceptable	Increasing

Preventive Controls

Management reported the following preventive controls:

Exercise and other attempts at stress management
Humor and sarcasm
Coffee and chocolate – maybe a glass of wine!
Checklists and spreadsheets
Strategic use of PTO
Boundary-setting efforts
Occasional avoidance of email
Exposure to sunshine and fresh air

Control effectiveness: Moderately effective.

Detective Controls

Management reported the following detective controls:

Unexplained eye twitching
Staring blankly into the distance
Increased dependence upon caffeine
Repeatedly asking what day of the week it is
Responding, “I’m fine,” when clearly not fine
Discovering that lunch occurred roughly six hours ago
Opening the same regulatory guidance document three times because management cannot remember what it just read
Feeling personally responsible for solving everyone else’s problems while neglecting their own

Control effectiveness: Effective, although generally activated later than recommended.

Corrective Controls

Management implemented the following corrective actions:

Strategic deployment of artificial intelligence tools
Increased automation of repetitive activities
Enhanced prioritization procedures
Temporary reduction in exposure to unnecessary meetings
Actual use of PTO
Exercise and other stress-management activities – Wine!
Increased consumption of coffee and chocolate and that glass of wine…

Control effectiveness: Improving.

Artificial Intelligence Control Narrative

Management recently implemented an artificial intelligence assistant to support research and analysis, training development, policy drafting, content creation, editing and proofreading, brainstorming, project management, and risk identification.

Initial testing indicates significant improvements in efficiency. The new assistant is not associated with Skynet…

Management immediately responded to the efficiency gains by assigning the newly available time to additional projects.

Management expressed no further concerns regarding the efficiency gains. Management did, however, question why the AI had not yet figured out how to make coffee.

Management further noted that the AI assistant occasionally functioned as a researcher, editor, brainstorming partner, accountability partner, cheerleader, and unofficial support department. Not the supplier of chocolate. Management specifically requested that feature. Also not associated with VIKI (Virtual Interactive Kinetic Intelligence), as founded by U.S. Robotics.

However, an important control limitation was identified: artificial intelligence remains dependent upon the quality of the questions being asked, the information provided, and the human user’s ability to evaluate, challenge, and validate the result.

Management was reminded that artificial intelligence is an assistant—not a compliance officer.

Control effectiveness: Improving.

Control Limitations

Artificial intelligence cannot attend meetings on management’s behalf.
Artificial intelligence cannot perform household chores.
Artificial intelligence cannot force management to establish boundaries.
Artificial intelligence cannot convince management that sleep is productive.
Artificial intelligence cannot physically remove management’s laptop after business hours.
Artificial intelligence cannot prevent management from accepting one more project.
Artificial intelligence cannot independently determine whether an answer is correct, complete, or appropriate for the financial institution’s specific circumstances.

Management Observation

Although artificial intelligence substantially increased efficiency, management reported that all resulting time savings were immediately allocated to additional responsibilities.

Control Deficiencies

Failure to distinguish between urgent matters and merely inconvenient matters
Failure to delegate responsibilities appropriately, if at all
Excessive reliance upon a single employee
Insufficient investment in preventive maintenance
The persistent belief that caffeine constitutes a sustainable long-term strategy and chocolate makes you smile

Emerging Risks

Exposure to unnecessary meetings but not invited to the necessary ones
Beginning sentences with, “I’ll just take care of it myself.”
Working through lunch – maybe breakfast and dinner –
Answering emails outside normal business hours
Accepting one more project because “it shouldn’t take that long”
The occasional implementation of an emergency stress-management protocol involving prolonged silence and the reconsideration of prior life choices

Residual Risk Assessment

After consideration of all mitigating controls, residual risk remains elevated. Management maintains that the financial institution remains adequately capitalized through the strategic deployment of caffeine, chocolate, determination, and sheer stubbornness.

Management Response

Management concurs with the findings and intends to implement corrective actions as competing priorities permit.

Management further requests an extension because of staffing shortages, budget constraints, competing priorities, and approximately 4,732 unread emails. Management also recommends that future assessments consider the risk associated with being asked to “just take a quick look” at something.

Conclusion

Compliance professionals devote their careers to protecting financial institutions, supporting employees, strengthening controls, and helping others navigate uncertainty.

Perhaps the greatest challenge is remembering to extend the same care and attention to ourselves. After all, every financial institution depends upon the strength of its control environment.

As it turns out, people do, too.

Because sometimes the compliance officer needs a resource, too. Preferably one that doesn’t send another meeting invite or give them another task.

Final Assessment

Compliance is complicated. Staying current does not have to mean doing everything yourself.

Whether the need is regulatory training, compliance education, or another set of experienced eyes on a difficult compliance question, having the right resources matters.

Compliance Resource helps compliance professionals strengthen their knowledge, identify risk, improve controls, and keep their financial institutions moving forward.

Happy Compliance Officer Day to the world’s most overworked department. May your controls be effective, your examiners be reasonable, and your inbox be empty for a hot minute.