In 2005, Ernst & Young obtained surveys from 95 companies, mostly from the Fortune 1000 and highly regulated industries. To the question, “Where does Compliance report?,” 52 percent of the respondents said to the General Counsel. The November 2005 report, at 5, states that about one quarter as many (12% of the total) answered to Risk Management, nine percent to the CEO, two percent each to Business Units or Regulatory Affairs, and one percent to the General Auditor.
More replied “Other” than any reporting line except to the General Counsel. In that group were the Audit Committee, Ethics and Compliance Committee, and the Chief Risk Officer. (See my post of Jan. 20, 2009: reporting lines of compliance function with 11 references.).