Needless to say, the infrastructure should be commensurate with the nature of the organization's compliance risk. For a large complex banking organization, dealing with compliance risk can be particularly challenging unless it has a welldeveloped risk-management program. To create appropriate compliance-risk controls, organizations should first understand compliance risk across the entire entity.
Managers should be expected to evaluate the risks and controls within their scope of authority at least annually.