Compliance Review¶
Review process — instantiates Checks-and-Balances Architecture
A structured check against governing standards, policies, laws, controls, or risk requirements.
A Compliance Review tests a proposed action, product, or process against an external, fixed standard — a law, a regulation, a policy, a control requirement — and returns a conformance verdict: this passes, this fails, this passes only if these gaps are closed. Its defining feature is that the yardstick is given, not invented by the reviewer. Where an independent review measures work against the reviewer's own fresh judgment, a compliance review measures it against a written rule that exists whether or not the reviewer agrees with it; the reviewer's job is to map the action onto the requirement and find where it falls short. That makes the review reproducible and rule-referenced: two competent reviewers applying the same standard to the same facts should reach the same verdict. Its output is not a decision to proceed but a conformance finding, backed by the specific requirement each gap violates, and usually the power to hold a non-conforming action until the gap is cured.
Example¶
A fintech is about to launch a new instalment-lending product. Before it goes live, the second-line compliance function runs a structured review against the governing rules: consumer-credit disclosure requirements, fair-lending prohibitions, and anti-money-laundering / know-your-customer obligations. The reviewer does not ask "is this a good product?" — that is the business's call. It asks, requirement by requirement, "does this product as built satisfy each rule?" It maps the loan's APR disclosure against the disclosure regulation and finds it conformant; it maps the onboarding flow against KYC and finds a gap — the flow does not verify identity to the standard the rule demands for this loan size. The review returns a finding: conditional pass, blocked until the KYC gap is closed, with the specific regulatory citation attached. The product does not ship until the gap is remediated and re-checked. The reviewer never exercised business judgment about the product's merits; it certified conformance against a standard someone else wrote.
How it works¶
- Fix the applicable standard first. Identify which laws, policies, controls, and risk requirements govern this action; the review is only as good as the completeness of the rule set it maps against.
- Decompose into testable requirements. Turn each standard into concrete checks — this disclosure present, this verification performed, this limit respected — so conformance is assessed point by point, not by impression.
- Map the action onto the requirements. For each requirement, determine pass, fail, or conditional, with the specific evidence and the specific rule citation.
- Hold non-conforming actions until cured. Where a requirement fails, the action is blocked or conditioned on remediation, and the fix is re-checked before release.
- Record the conformance evidence. The finding, the requirements tested, and the citations become the durable record that the check was performed against the standard.
Tuning parameters¶
- Standard coverage — how complete the mapped rule set is. A review against an incomplete standard set passes actions that violate the rules nobody listed.
- Depth of testing — full substantive assessment versus checklist tick-through. Deep testing catches disguised non-conformance; checklists scale but invite box-ticking.
- Blocking strength — whether a fail hard-stops the action or merely flags it as an advisory. A review that cannot hold a non-conforming action is documentation, not a check.
- Independence of the reviewer — whether compliance sits inside the business line it reviews or in a separate second line. Embedded reviewers know the product but may share its incentives.
- Timing — pre-launch gate, periodic re-review, or continuous monitoring. Point-in-time reviews miss drift after the check clears.
When it helps, and when it misleads¶
Its strength is reproducibility and defensibility: because it maps action to a fixed standard, its verdicts are consistent across reviewers and traceable to a citation, which is exactly what makes them survive audit and challenge. It is the natural home of the second line of defense — a control function separate from the operators (the first line) that tests their work against the rules before it reaches independent audit (the third line).[n1] When the failure the archetype fears is action that violates a governing standard, this is the check aimed precisely at it.
Its signature failure is box-ticking: a review can certify that every checklist item was marked while the substance is non-conformant, because a checklist confirms that boxes were filled, not that the rule's purpose was met. Reviewers under production pressure drift toward the letter and away from the intent, and a standard set that is stale or incomplete produces confident passes on genuinely non-compliant actions — "we reviewed it" becomes a shield rather than a check. It also says nothing about whether the action is wise, only whether it is permitted, so a fully compliant decision can still be a terrible one. The discipline that keeps it honest is keeping the mapped standard current and complete, testing substance rather than form, and holding non-conforming actions rather than merely noting them.
How it implements the components¶
review_power— it holds the power to inspect an action and test it, requirement by requirement, against the governing standards.veto_or_remedy_rule— it can hold or condition a non-conforming action until the specific gap is remediated and re-checked.accountability_record— its findings, the requirements tested, and the rule citations form the durable conformance record that the check was performed.
It tests against a fixed standard; it does not judge the action on its own merits from an independent footing — that is Independent Review — nor stand as a permanent committee overseeing the whole control environment, which is the Audit Committee, nor adversarially hunt for the failure routes a rule set never anticipated, which is Red-Team Challenge.
Related¶
- Instantiates: Checks-and-Balances Architecture — it is the standards-conformance check that tests an action against the rules that govern it before it proceeds.
- Sibling mechanisms: Oversight Board · Independent Review · Dual Approval · Maker / Checker Separation · Audit Committee · Veto Authority · Red-Team Challenge
Editorial Notes¶
Form Classification¶
Form family: Assessment, Review & Assurance
Rationale: A structured check against governing standards, policies, laws, controls, or risk requirements, making its operative form a bounded evaluation of existing evidence or work that produces a finding or disposition.
Independent corroboration: The frozen evidence defines Compliance Review as 'A structured check against governing standards, policies, laws, controls, or risk requirements', so its operative form is Assessment, Review & Assurance.
Review outcome: Independent reviewer agreement; high confidence.
Origin Attribution¶
Primary origin: Accounting & Auditing
Origin pattern: Cross-disciplinary synthesis
Present-day reach: Multi-domain
Rationale: Second-line compliance and audit practice established structured review of operations against governing controls and requirements.
Related originating lineages:
- Law & Governance — Statutory and regulatory interpretation supplies the external obligations against which conformance is judged.
Review resolution: Both reviewers agree on accounting_auditing as primary. Reading the source mechanism confirms that its defining operation belongs to that lineage; the final record retains law_governance only where it materially formed the mechanism and keeps present-day application breadth separate from provenance.
Review outcome: Reconciled after independent review; high confidence.
Notes¶
[n1] The three lines of defense model of risk governance: the first line owns and operates the controls (the business), the second line sets standards and monitors conformance (risk and compliance), and the third line provides independent assurance (internal audit). A compliance review is the characteristic second-line activity — testing the first line's work against the governing rules. ↩