oversee their enterprise - wide compliance - risk management program, and the federal reserve views this trend very favorably. in these cases, the central function has been staffed with experienced compliance officers who are able to provide substantive guidance to business line managers and to keep senior management and boards of directors informed on how well the program is functioning, including by alerting them promptly about any material compliance breaches. overall, such a central function can contribute a great deal toward ensuring that the key elements of a sound and effective compliance - risk management program are present and functioning as intended. corporate standards - - tailored within the business lines how does a board - mandated " compliance culture " permeate a banking organization? among other ways, the culture and expectations are communicated through enterprise - wide compliance - risk management standards or objectives - - established by senior management within a corporate - level compliance function - - that reflect the expectations of the board. regardless of the compliance - risk management framework employed, the business line managers continue to " own " the compliance risk. that is, they are responsible for achieving compliance in their business lines and suffer the consequences in the event of compliance failures or missteps. business line managers convert the corporate compliance risk standards or objectives into policies and procedures tailored to the specific type and level of compliance risk inherent in their activities and to the specific laws of the jurisdictions in which they operate. to create appropriate compliance risk controls, organizations seek first to understand compliance risk across the entire entity. managers assess and evaluate the risks and controls within their scope of authority at least annually. however, an enterprise - wide compliance - risk management program is dynamic and proactive, meaning that risks are assessed whenever new business lines or activities are added or existing activities and processes are altered. once a particular business line has identified and assessed its compliance risks, it can design policies, detailed day - to - day procedures and processes, and associated risk - mitigating internal controls. the corporate compliance function plays an important role in advising business line managers as they assess risk. such counsel adds to consistency in approach and helps control for mis - estimated risk. the corporate compliance function's involvement also increases the organization's ability to aggregate and better understand risks across the organization. understanding of risk helps both the business lines and the compliance function develop internal controls that are reasonably designed to mitigate the risk. while the industry trend toward more - consolidated compliance risk management is a favorable development, it is critical that business line management remain engaged. as i noted, senior

key challenge across the industry. successful organizations are focusing not only on recruiting talent, but also on developing staff from within. training and other staffdevelopment tools are essential in this time of " war for compliance talent. " the role of the regulators the business lines and activities of financial services firms can cross the jurisdictional boundaries of many legal entities, making it more difficult for a supervisory agency acting alone to determine what went wrong and what processes may need to be improved. in these cases, the federal reserve, as the consolidated supervisor of the banking organization in question, works closely with the primary bank regulator and the securities and exchange commission ( sec ) to investigate control breakdowns. the agencies exchange information and compare their findings. for example, findings from sec examinations of broker - dealers, investment advisers, and mutual fund distributors are analyzed together with findings from targeted joint reviews of bank holding companies and banks conducted by the federal reserve and the primary bank regulators. this is the way the functional regulators should and will work in the environment of diversified financial institutions. conclusion controlling compliance risk may be easier said than done. certainly, establishment of an effective enterprise - wide compliance - risk management function and program is not done overnight. nor is it done without costs - - both monetary costs and the intangible costs inherent in real cultural change. however, it is clear that all organizations must find ways to effectively manage compliance risk - - and there is growing consensus within the industry that for some of the largest and most complex organizations, an enterprise - wide approach to controlling compliance risk is no longer just a " nice thing to have. " rather, it has become an essential element of effective risk management.