Strengthening compliance functions: lessons from the CBI's thematic review

This thematic review came as a result of the weaknesses in culture, governance and risk management identified in the CBI’s 2025 and 2026 Regulatory and Supervisory Outlook publications.

What firms are doing well

The CBI found that firms had a good understanding of their requirements and regulatory obligations. The Central Bank of Ireland found that many firms have established effective compliance functions that are well integrated into governance and decision-making processes.

Examples of good practice that the CBI identified included:

• Strong compliance involvement in governance forums and strategic initiatives.
• Risk-based compliance monitoring programmes aligned to key regulatory risks.
• Effective horizon-scanning processes to monitor regulatory developments.
• Use of monitoring findings to inform staff training and continuous improvement.

Overall, the CBI noted that firms are increasingly positioning compliance as a strategic control function that supports sound governance and risk management.

Weaknesses identified

Within the thematic review publication, the CBI identified a number of recurring weaknesses across the sector. While the nature and severity of findings varied between firms, the review highlighted several common themes that firms should consider as part of their ongoing assessment of compliance function effectiveness.

The most significant concerns related to governance, the design and execution of compliance monitoring programmes and the ability of firms to demonstrate effective oversight of compliance risks. In particular, the CBI noted that some firms were not sufficiently evidencing how compliance risks were identified, assessed, monitored and escalated to senior management and boards.

Key weaknesses identified included:

• Insufficient succession planning for key compliance personnel, creating potential key-person dependency and business continuity risks.
• Compliance risk assessments that were not updated regularly or did not adequately support the firm's monitoring programme.
• Compliance monitoring plans that lacked sufficient detail, rationale or clear linkage to identified regulatory risks.
• Limited evidence of robust challenge and discussion of compliance matters at board and committee level.
• Inadequate compliance ownership and oversight of staff compliance training programmes.

The findings indicate that, while compliance frameworks are generally well established, firms should focus on strengthening the documentation, governance and oversight supporting those frameworks. The CBI expects compliance functions to demonstrate not only that appropriate processes exist, but also that they are operating effectively and providing meaningful assurance to senior management and the board.

What firms should do going forward

In light of the thematic review findings, firms should assess whether their compliance frameworks remain fit for purpose and aligned to the expectations set out by the Central Bank of Ireland. Particular focus should be given to ensuring that compliance risk assessments, monitoring programmes and board reporting are sufficiently robust, risk-based and well documented.

Firms should also consider the key weaknesses identified and how they stack up against expectations. Focus should be given to: succession plans and contingency arrangements for key compliance personnel; evidencing the linkages between compliance risk assessments and annual monitoring plans; and ensuring board and committee reporting facilitates meaningful oversight and challenge of compliance matters.

How Forvis Mazars can help

At Forvis Mazars, our financial services regulatory risk and compliance team supports financial institutions in understanding and responding to regulatory developments and CBI expectations. We can help firms ensure their compliance function remains fit for purpose through outsourcing and secondment support.