Academic literature is limited on how to coordinate the compliance and operational risk functions in organisations. The functional overlap between these two functions in financial institutions, such as banks, may result in oversight gaps or unintentional duplication. This paper describes a study on the overlap between these two functions in the second line of risk and control defence. A number of documents were analysed including relevant Basel Committee documents; South African banking legislation and regulations; integrated annual results, risk and capital reports of the four largest South African (the Big Four) banks; as well as internal operational risk and compliance documents of one of the Big Four banks. Based on this study, regulatory and practice based guidelines are proposed, which may be used to improve the efficiency of the compliance and operational risk functions in banks.

Academic literature is limited on how to coordinate the compliance and operational risk functions in organisations. The functional overlap between these two functions in financial institutions, such as banks, may result in oversight gaps or unintentional duplication. This paper describes a study on the overlap between these two functions in the second line of risk and control defence. A number of documents were analysed including relevant Basel Committee documents; South African banking legislation and regulations; integrated annual results, risk and capital reports of the four largest South African (the Big Four) banks; as well as internal operational risk and compliance documents of one of the Big Four banks. Based on this study, regulatory and practice based guidelines are proposed, which may be used to improve the efficiency of the compliance and operational risk functions in banks.

Submitted by JOSIANE SANTOS DE OLIVEIRA (josianeso) on 2018-10-09T16:58:19Z No. of bitstreams: 1 Adriano de Oliveira Martins_.pdf: 580495 bytes, checksum: 56629584efa4a6ad597e26746b67a946 (MD5) / Made available in DSpace on 2018-10-09T16:58:19Z (GMT). No. of bitstreams: 1 Adriano de Oliveira Martins_.pdf: 580495 bytes, checksum: 56629584efa4a6ad597e26746b67a946 (MD5) Previous issue date: 2018-06-28 / Nenhuma / De acordo com uma pesquisa Maturidade do Compliance no Brasil, realizada pela KPMG em 2016, as empresas em geral possuem um baixo nível de maturidade em gestão de riscos de compliance. Apesar da importância do tema, segundo a pesquisa, apenas 58% das empresas afirmam possuir mecanismos para gestão de risco de compliance, enquanto outros 42% informam desconhecê-los. Dentre as estruturas classificadas pela pesquisa, que são dedicadas ao tema de compliance, 36% afirmam não possuir autonomia e independência para exercer suas funções, consideradas uma boa prática de governança. Ainda segundo a pesquisa, 52% não possuem recursos adequados. O Instituto Brasileiro de Governança Corporativa – IBGC, entende risco como possibilidade de ‘algo não dar certo’, mas seu conceito atual envolve a quantificação e qualificação da incerteza, no que diz respeito às ‘perdas’ como aos ‘ganhos’ e o rumo dos acontecimentos planejados. O objetivo deste estudo é identificar os principais entraves que fazem com que o grau de maturidade das empresas brasileiras no tema compliance, seja baixo. Para tanto, foram entrevistados em profundidade, alguns conselheiros de administração e fiscal e, com base na literatura disponível e pelos resultados das recentes pesquisas sobre maturidade de risco de compliance no Brasil, foi possível compreender alguns dos principais aspectos que fazem com que estas empresas, tenham este resultado. Os resultados apontam principalmente para: Crença de que os riscos, em especial de compliance, não irão se materializar; Exigências relacionadas com o tema compliance, não se aplicam em suas empresas; Posicionamento reativo quanto ao cumprimento das normas; Conflito de interesses pessoais; Crescente preocupação quanto à formação dos conselheiros em governança corporativa de forma reativa; Desconhecimento pleno das responsabilidades e impactos de ser um conselheiro; Aumento da exposição à riscos, renúncia do posicionamento em assembleias; Autoproteção, quebra de independência; Uso das estruturas internas de compliance, para a proteção e atendimento das necessidades do controlador e atendimento às conformidades apenas para manter as aparências. / According to a Compliance Maturity research in Brazil, conducted by KPMG in 2016, companies generally have a low level of maturity in compliance risk management. Despite the importance of the topic, only 58% of companies claim to have compliance risk management mechanisms, while another 42% report not knowing them. Among the structures dedicated to the subject, 36% affirm that they do not have autonomy and independence to perform their functions, considered a governance good practice. Still, according to research, 52% do not have adequate resources. The Brazilian Institute of Corporate Governance (IBGC) understands risk as a possibility of 'something going wrong', but the current concept involves the quantification and qualification of uncertainty as 'losses' and 'gains' and the direction of planned events. The objective of this study is to identify the main obstacles that make the degree of maturity of the Brazilian companies in the subject of compliance to be low. For which, were interviewed in depth, some administration and supervisory advisers and, based on the available literature and the results of the recent research on risk maturity of compliance in Brazil, was possible to understand some of the main aspects that cause these companies to have this result. The results point mainly to: Belief that risks, especially compliance, will not materialize; Requirements related to the subject of compliance, do not apply in their companies; Reactive positioning regarding compliance with standards; Conflict of personal interests; Growing concern as well as the formation of directors in corporate governance in a reactive way; Lack of full knowledge of the responsibilities and impacts of being an advisor board; Increasing exposure to risks, resignation of positions in assemblies; Self-protection, breach of independence; Use of internal compliance structures, self-protection to meeting the needs of the main controller and attendance to conformities just to keep up appearances.

The Basel Committee on Banking Supervision has defined operational risk, legal risk and compliance risk. However, the definitions might not be adequate for countries with a hybrid legal system, such as South Africa. This study aims to provide a practical solution to the problems faced by countries with a hybrid legal system wishing to comply with the Basel Committee’s standards. It is argued that compliance, compliance risk and regulatory risk should all be viewed as constituent components of legal risk, and in turn necessarily also of operational risk in a hybrid legal system. Legal risk is a wide concept which includes all aspects of a legal system, while compliance risk is a narrower concept which only includes the codified aspects of a legal system. Legal risk therefore includes compliance risk. However, the opposite is not true as compliance risk does not include legal risk, and the two concepts are decidedly shown not to be synonymous in a mixed legal system. / Thesis (PhD (Law))--North-West University, Potchefstroom Campus, 2013.

The Basel Committee on Banking Supervision has defined operational risk, legal risk and compliance risk. However, the definitions might not be adequate for countries with a hybrid legal system, such as South Africa. This study aims to provide a practical solution to the problems faced by countries with a hybrid legal system wishing to comply with the Basel Committee’s standards. It is argued that compliance, compliance risk and regulatory risk should all be viewed as constituent components of legal risk, and in turn necessarily also of operational risk in a hybrid legal system. Legal risk is a wide concept which includes all aspects of a legal system, while compliance risk is a narrower concept which only includes the codified aspects of a legal system. Legal risk therefore includes compliance risk. However, the opposite is not true as compliance risk does not include legal risk, and the two concepts are decidedly shown not to be synonymous in a mixed legal system. / Thesis (PhD (Law))--North-West University, Potchefstroom Campus, 2013.

The dilemma of money laundering is an undeniable problem faced by many institutions all over the world. Due to its prevalence, the need for organisations to deal with the problem has become a global priority, regardless of the size of the financial institutions. Despite the compliance AML efforts undertaken by various institutions, AML compliance appears to be a daunting challenge, the question posed by this research is whether there is a need for independent anti-money laundering (AML) compliance reviews, given the invasive nature of money laundering in financial institutions. Secondly, the research addresses the question of who is well positioned to perform the independent AML compliance reviews. In addressing the second question, the research will discuss why internal audit is an invaluable resource in terms of risk management processes and the reasons why they are an integral part of the AML solution. / Dissertation (MPhil)--University of Pretoria, 2013. / gm2014 / Auditing / unrestricted

The purpose of this dissertation is to provide its readers with a detailed and comprehensive look at the institute of duty of care, business judgment rule and related civil and partly also criminal liability of members of (not only) statutory bodies of capital business companies, and in this respect also to introduce an internal compliance program as one of the main instruments of good and effective corporate governance. The main objective of this dissertation is therefore to verify or refute the hypothesis whether, and if so in what particular form, can an internal compliance program be seen as an institute helping members of statutory bodies of capital business companies in fulfilling specific requirements and obligations of their duty to carry out the statutory function with due (managerial) care. The existence (implementation) of an internal compliance program is quite commonly connected with so called regulated markets and also with individual business corporations whose ownership structure extends the boundaries of the Czech Republic (typically British or American business corporations seated in the Czech Republic). But what about a wide neutral zone of Czech business corporations, i.e. especially small and medium-sized capital business companies? Shall these implement an internal compliance program as well? And, if so, on what grounds and with what benefits?