How to Show Risk, Compliance and Audit on an Org Chart
Draw independent control functions on an org chart: separate risk, compliance and internal audit from the business lines, mark the audit line as dotted and check it against a credit approval.
Control functions such as risk, compliance and internal audit should appear on an org chart as their own branches, so readers can see they are independent of the business lines they oversee.
The short version
- Draw risk and compliance as their own branches beside the business lines.
- Draw internal audit dotted, because it answers to the board audit committee.
- Keep treasury separate from lending so the balance sheet has its own owner.
- Label every dotted line with the relationship it stands for.
- Check independence by looking at who proposes and who approves in a process.
Why control functions get their own branches
In a bank or insurer, business lines earn revenue and control functions test whether that revenue is earned safely. If risk, compliance or audit sit inside a business line on the chart, the chart suggests they report to the people they are supposed to challenge. Draw each as a branch under the chief executive, beside the business lines, not below them.
Internal audit is a special case. It usually answers to the board's audit committee and has only an administrative line to the chief executive. A solid line would misstate that, so draw internal audit dotted and label the relationship. Regulators in each country set their own expectations, so treat the chart as an illustration of the pattern, not a statement of what the rules require.
The chart below is the editable bank organizational chart. A second chart, a customer credit approval, shows the same independence in a process: the person who proposes a limit and the person who approves it should come from different branches of the tree.
Build the bank org chart so the control functions stay independent
Watch the business lines appear first, then the control functions beside them, and finally the dotted internal audit line.
Start with the revenue-earning business lines
Retail banking and commercial banking, with their teams, sit under the chief executive. These are the units that take customer risk, so they come first and the later stages can show what watches them.
Add treasury and the supporting functions
Treasury, operations, technology and finance complete the operating side. Treasury manages funding and liquidity apart from lending, so the balance sheet has an owner who is not also selling loans.
Add risk and compliance as separate branches
The chief risk officer and the chief compliance officer each lead a branch beside the business lines, not inside them. That placement shows that credit risk, market risk and anti-money-laundering work can challenge the business without reporting to it.
Add internal audit with a dotted line
Internal audit is dotted because it answers to the board audit committee, with only an administrative link to the chief executive. A dotted line tells the reader this is a different kind of relationship from a manager line, which is the whole point.
Test independence with a process: customer credit approval
The credit approval process shows the same separation at work: who proposes a limit and who decides it. Built in three stages.
Write the steps and decisions
Begin with the main path: request, checks, scoring and the credit decision, without owners. You can already see where a decision is made, but not whether the decision-maker is independent.
Give each step to the unit that owns it
Add lanes so that screening and approval land in different units from the one that asked for credit: Sales asks, the credit analyst assesses and the credit manager decides. If proposing and approving sit in the same lane, the org chart and the process disagree about independence.
Add exceptions, security and monitoring
The full process adds referrals, security checks and monitoring. Each of these should name a unit that exists on the org chart, and the control functions on the chart should appear where the process needs challenge.
How it works
List the business lines
Add retail, commercial and any other units that take customer risk as branches under the chief executive.
Add the operating support units
Add treasury, operations, technology and finance. Keep treasury apart from lending.
Add risk and compliance as their own branches
Add the chief risk officer and the chief compliance officer with their teams, beside the business lines. Do not place them inside a business line.
Add internal audit as a dotted role
Add internal audit with a dotted line and name the audit committee relationship in the role note.
Label non-manager relationships
Write on each dotted line what it represents, such as audit committee reporting, so the type of relationship is visible.
Test with a process
Open a process such as credit approval and check that proposing and approving sit in different branches of the chart.
Mistakes to avoid
Drawing risk inside a business line
That implies risk reports to the people it challenges. Draw it as a branch of its own under the chief executive.
Using a solid line for internal audit
A solid line says it is managed by the executive it audits. Use a dotted line and name the audit committee.
Stating what a regulator requires
This chart is illustrative. Check your own regulator's rules before using it to describe your independence.
Putting treasury under lending
Funding and liquidity need an owner who does not also sell loans. Give treasury its own branch.
Editable organizational charts
Create your bank organizational chart
Open the editable bank org chart, rename the branches to match your institution and mark every non-manager line.
Related guides
Frequently asked questions
Why is internal audit drawn with a dotted line?
Internal audit usually answers to the board audit committee and has only an administrative link to the chief executive. A dotted line shows that it is a different kind of relationship from a manager line.
Should risk and compliance report to the same person?
Some organizations combine them; many keep them separate. The chart shows them as separate branches so the difference is visible. Adapt it to how your organization is arranged.
Does this chart satisfy a regulator?
No. It is an illustration of a common pattern. Follow the rules of your own regulator and document the real reporting lines.
Can I use this for an insurer?
Yes. Replace the business lines with distribution, underwriting and claims, and keep the chief risk officer, actuarial and compliance branches separate from them.