Risk & Compliance
When controls slip through cracks, governance catches them
Compliance failures cluster where accountability is unclear. The Three Lines of Defense model assigns ownership across first-line operations, second-line oversight, and third-line audit—eliminating duplicated effort, closing gaps, and reducing regulatory findings by a quarter to two-fifths within 18 months.
A compliance governance structure assigns clear accountability for risk management and control execution across three layers: first-line business units owning operational risks, second-line compliance and risk functions providing oversight, and third-line internal audit delivering independent assurance. This separation prevents the duplication and gaps that occur when roles overlap or remain undefined. Organizations adopting this model typically reduce regulatory findings and enforcement actions by 25-40% within 18 months.
The benchmarks
| Metric | Minimum | Strong | World-class |
|---|---|---|---|
| Control Design Completeness Against Risk UniversePercentage of identified enterprise risks that have corresponding designed controls mapped and documented in the control framework. | 70-80% | 85-92% | 94-98% |
| Control Implementation Deployment TimeAverage elapsed calendar days from control design approval to full operational deployment and evidence collection across all control environments. | 120-180 | 60-90 | 21-45 |
| Control Design Defect DensityNumber of control design gaps, logic errors, or unintended control interactions identified during testing or post-implementation review per 100 controls implemented. | 8-15 | 3-6 | 0-2 |
World-class organizations achieve 94-98% control design completeness against their identified risk universe, compared to a minimum floor of 70-80%. This gap widens as risk complexity increases; firms with immature governance tend to design controls against visible risks while missing emerging exposures. Deployment speed shows an even steeper gradient: world-class teams move from design to live control in 21-45 days, while minimum performers take 120-180 days. This difference reflects the compounding effect of clear accountability—when ownership is ambiguous, every control waits for decisions. Defect density in design (0-2 flaws per control in world-class firms versus 8-15 in minimum performers) suggests that governance clarity also improves quality: when roles are defined and peer review disciplines are enforced, errors surface before deployment.
Industry-Specific Benchmarks
These ranges are cross-industry. The figures differ materially by sector and company size.
Find benchmarks for your industry →Behind the numbers
The difference between strong and world-class governance structures lies in how accountability is operationalized, not merely stated. Middle-tier organizations often have a Three Lines model documented in policy but lack the enforcement mechanisms that make it real. Second-line functions, for instance, may hold oversight authority on paper while lacking the seniority, access to data, or executive sponsorship to exercise it. First-line business units continue to operate independently because consequences for non-compliance remain unclear. The result: controls deploy slowly, gaps persist, and regulators encounter the same issues repeatedly.
World-class structures embed governance into workflow, not governance manuals. Authority matrices are live documents tied to system access and decision gates. Second-line compliance teams have standing in product development, vendor approval, and incentive design—not as observers but as required participants. First-line units understand which risks they own and which triggers require escalation. Performance metrics for business leaders include compliance execution, not compliance avoidance. The difference in control defect density—world-class firms catch design flaws before deployment while others catch them during audit—traces directly to this operational rigor.
Third-line audit independence also separates tiers, though it is often overlooked. Strong governance structures maintain audit as separate from risk and compliance functions, with direct board reporting. This independence allows audit to spot control drift and second-line blindness that self-assessment cannot detect. Firms treating audit as part of a unified "compliance department" sacrifice the detection function that independent assurance provides, leading to regulatory surprises and slower issue remediation.
What leading organizations do
Three Lines of Defense: Who owns what
The Three Lines of Defense separates compliance and risk responsibilities into distinct accountability layers. The first line—business units and operational owners—manages risk-taking and embeds controls into daily work. The second line—compliance, risk management, and quality functions—monitors whether first-line controls are functioning and escalates deterioration. The third line—internal audit—assesses whether first and second lines are performing their roles and provides independent assurance to the board.
This structure works because it prevents the two failures that plague unstructured governance: enforcement gaps and overlapped effort. When accountability is fuzzy, controls fall through cracks because each function assumes another owns it. When boundaries are undefined, multiple teams build similar controls, creating waste and creating confusion about which version to follow. The Three Lines model is explicit about ownership—the business unit executes the control, the compliance team verifies it is operating, audit confirms both are functioning—so gaps and duplicates become visible.
Implementing this model requires more than an organizational chart. It means defining decision rights: which issues require second-line approval before first-line action, which deteriorations trigger escalation to third line, and which findings go to the board. It means giving second-line teams sufficient seniority and data access to perform oversight (a compliance function without system access or a seat at product design meetings is not a second line in practice). It means setting performance expectations for first-line leaders that include compliance execution, not just business results. The roadmap for establishing this structure runs in three phases: defining and communicating roles, embedding them into workflow and decision processes, and creating the performance and data visibility needed to sustain them.
Leading Practice Report
Full detail: Three Lines of Defense Model
The full report covers:
- Expected benefits
- Core principles
- Key success factors
- Key metrics
- Risks and mitigations
- Implementation roadmap
Conduct risk: Building accountability into culture and compensation
Conduct risk—the risk of employee misconduct, conflicts of interest, sales practice violations, and ethical breaches—has become one of the highest-impact compliance exposures for financial services firms. Regulators do not treat these as isolated incidents; they see patterns that reflect organizational culture, incentive misalignment, and weak monitoring. Fines and customer redress for conduct failures now regularly exceed those for operational or market risks.
A structured conduct risk program assigns accountability for ethical behavior throughout the organization rather than treating it as a compliance department function. It begins with clear escalation triggers: complaint patterns, sales compensation outcomes that diverge from customer benefit, unexplained employee turnover in specific roles. It includes proactive monitoring—event data analysis that identifies which teams, products, or incentive structures correlate with higher misconduct—not just reactive investigation of complaints. Critically, it ties compensation and performance evaluation to conduct outcomes, so that business leaders face personal consequences for culture failures, not just regulatory ones.
The mechanism by which this reduces risk is straightforward: when accountability is clear and costs are visible, behavior changes faster than detection alone can achieve. When a sales team knows that margin spikes that exceed peer performance by a material margin will trigger a conduct review, not a bonus, the incentive to cut corners diminishes. When HR and compliance jointly own turnover analysis in high-risk roles, patterns of bullying or coerced sales practices surface early. The program requires investment—training, whistleblower infrastructure, culture surveys, and data integration—but the payoff is substantial: organizations typically reduce conduct incidents by 20-35% within the first year.
Leading Practice Report
Full detail: Conduct Risk and Ethical Culture Assessment Program
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Third-party governance: Accountability extends outside the organization
Financial services firms increasingly rely on external vendors—cloud providers, payment processors, data analytics firms, compliance technology vendors—to execute critical functions. Regulators now hold institutions accountable for third-party failures, meaning vendor risk is institutional risk. A governance framework for third-party relationships assigns clear accountability for assessment, ongoing monitoring, and escalation.
The framework begins with risk-based due diligence before engagement. A vendor managing customer data or executing regulated activities faces a different assessment standard than a vendor supplying office supplies. This differentiation prevents the waste of rigorous vetting on low-risk relationships while ensuring critical vendors receive appropriate scrutiny. The assessment examines capability, financial stability, data security, and regulatory compliance posture. Contracts for material vendors include audit rights, performance standards, and clear breach consequences.
Ongoing monitoring is the part most organizations underexecute. It requires defined ownership: a specific individual or function accountable for annual reassessment, performance monitoring, and incident notification. When that accountability is unclear, vendors drift undetected—a data security update is missed, financial performance deteriorates, regulatory issues emerge. The governance model specifies who owns vendor surveillance for each critical relationship and what triggers escalation to senior management or the board. This is particularly important for vendors in multiple locations or operating across multiple business units within the firm, where no single team has full visibility. Organizations with structured third-party governance reduce vendor-related operational incidents by 25-40% and regulatory penalties tied to vendor failures by 30-50%.
Leading Practice Report
Full detail: Third-Party and Vendor Risk Management Framework
Benefits, core principles, success factors, metrics, risks and the implementation roadmap.
Get the full report →Getting started
- Map your current compliance and risk responsibilities against the Three Lines framework: identify which functions own first-line controls, which provide second-line oversight, and which deliver third-line assurance. You will find overlaps, gaps, and ambiguities.
- For the largest compliance gaps or highest-impact risks, define the specific owner for each control and the escalation path if it deteriorates. Write this into authority matrices, not just job descriptions.
- Identify which second-line functions lack the data access, seniority, or decision authority to perform real oversight. Address the most critical limitations first—a compliance team cannot oversee controls it cannot see.
Ask Kepler how to operationalize governance structure in your specific regulatory context or how to assess whether your current model is executing as designed.
Start free with Ask Kepler →Curious how Ask Kepler Research is produced? Read our research methodology.
Performance Playbook
Controls Design & Implementation: How fast should controls move from design to full operation?
Learn how to compress your deployment cycle from months to weeks while catching design defects before controls go live. This playbook shows you how to separate design validation from testing, measure what matters, and bu
Open the playbook →