Compliance management system
CMSAlso called compliance programme, compliance framework
A compliance management system is the set of governance, policies, controls, training, monitoring and audit a firm uses to meet the laws that apply to it. US bank supervisors use the term for consumer compliance. Internationally, ISO 37301 sets out a certifiable standard. Regulators judge the system on how well it prevents, finds and fixes breaches.
How it works
At a US bank, the CFPB and the prudential regulators examine four parts: board and management oversight, a compliance programme of policies, training and monitoring, consumer complaint handling, and independent compliance audit. Examiners rate the system under the FFIEC consumer compliance rating system. A weak system brings a lower rating, matters requiring attention and closer supervision.
Outside consumer banking, the same structure appears in anti-money laundering, data protection and anti-bribery programmes. Prosecutors and regulators give credit when a firm shows its system works in practice. A strong system finds problems early, fixes root causes and keeps records that prove each step. Firms that find their own breaches and correct them usually face lighter outcomes.
The rules
Rates consumer compliance with the CMS as a core factor, alongside violations and consumer harm.
US banks and credit unionsSets out how examiners assess board oversight, the compliance programme, service provider oversight and violations.
Firms supervised by the CFPBInternational certifiable standard for establishing, operating, evaluating and improving a compliance management system.
Any organisationCommon questions
What are the parts of a compliance management system?
US supervisors look at board and management oversight, a compliance programme of policies, training and monitoring, complaint handling, and independent audit. ISO 37301 adds leadership commitment, risk assessment and continual improvement.
Is a compliance management system the same as GRC software?
No. A compliance management system is the firm's whole set of people, policies and controls. Governance, risk and compliance software is one tool firms use to record and run parts of it.
Can a firm be certified for its compliance management system?
Yes. ISO 37301 is a requirements standard, so an accredited body can certify a firm against it. Certification does not replace supervisory examination by a regulator.
How do examiners rate a compliance management system?
Under the FFIEC consumer compliance rating system, examiners rate banks from 1 to 5. The quality of the compliance management system is a main factor, alongside violations of law and harm to consumers.
