Which of the following principles best applies to a compliance function?

Step 1: Compliance Function and the Three Lines of Defense Model

The Three Lines of Defense (3LoD) model ensures that risk management responsibilities are properly

segregated:

First Line: Business units (own and manage risk).

Second Line: Compliance and risk management (independent oversight).

Third Line: Internal audit (provides assurance).

Step 2: Why Compliance Must Be Independent

PRMIA and Basel Compliance Principles state that compliance should not report to business units, as

this creates a conflict of interest.

Compliance must be independent to ensure objective oversight of regulatory adherence.

Step 3: Why the Other Options Are Incorrect

Option A ("Report to the business") → Incorrect because compliance must provide independent

oversight, not report to business units.

Option C ("Outsource compliance if risk function exists") → Incorrect because compliance and risk

functions have distinct roles.

Option D ("Outsource risk if compliance exists") → Incorrect because risk management is a core

function, not an outsourcing candidate.

PRMIA Risk Reference Used:

PRMIA Compliance Risk Governance – States compliance must be independent under the Three

Lines of Defense model.

Basel Compliance Principles – Recommends separate reporting structures for compliance and

business units.

Final Conclusion:

Compliance must be independent from the business to avoid conflicts of interest, making Option B

the correct answer.