Risk & compliance careers
Risk and compliance are the two functions that grow whenever regulation does — which is most of the time.
Risk and compliance are the functions that grow when regulation grows, which over the past two decades has been most of the time. They are also the functions most often applied to without a clear picture of what the daily work involves, partly because the job titles are unusually uninformative — "Risk Analyst" and "Compliance Analyst" each describe at least three genuinely different jobs.
The structural fact underneath both is the three lines of defence. A first-line role owns the risk it takes; a second-line role independently oversees it; a third-line role assures both. Sitting in the second line changes the job in a way that is rarely explained: you are in the room and affected by the decision, but you own the challenge to it rather than the decision itself.
These guides describe the disciplines and how they differ rather than any current rule. Specific regulations change, and a page that anchors itself to one is wrong the year it is amended and misleading for years afterwards.
Key terms
- Three lines of defence
- The standard governance model: the business owns and manages its risk (first line), risk and compliance independently oversee and challenge (second line), internal audit assures both (third line). Which line a role sits in determines its accountabilities and its relationship to the business.
- Risk appetite
- The amount and type of risk a firm has decided it is willing to accept, set at board level and expressed through limits. Most second-line work is ultimately about whether an activity sits inside it, and about escalating clearly when something does not.
- Inherent and residual risk
- Inherent risk is the exposure before controls; residual is what remains after them. The gap between the two is the measure of what the controls actually achieve, and quantifying it honestly is most of operational risk assessment.
- Regulatory change
- The discipline of tracking incoming rules, assessing what they require of the firm, and driving the implementation. The most strategic of the compliance functions, the hardest to enter directly, and the one most dependent on writing clearly.
Frequently asked questions
What is the difference between risk and compliance?
Risk is concerned with exposures the firm takes on — credit, market, operational — and whether they sit within appetite. Compliance is concerned with obligations the firm is under, whether from regulation, law or its own policy. They overlap in governance and in financial crime, and in smaller firms they are frequently one team, but the underlying questions are different: how much could we lose, versus what are we required to do.
Are these good careers for someone changing fields?
Among the better ones in financial services, because the entry roles teach a framework rather than assuming years of product knowledge, and because financial crime provides a high-volume route in. Prior experience in a process-heavy environment transfers well. What does not transfer is an expectation of autonomy early — these are functions where the framework and the escalation path come first.
Will automation reduce the number of these jobs?
It has already changed their shape. Monitoring, alert triage and evidence collection are increasingly automated, which reduces routine volume and raises the proportion of work that is judgement, investigation and challenge. The roles most exposed are the ones that are purely procedural; the ones that involve deciding what a rule means, or arguing a position with the business, are not close to automatable.
How do these roles differ in a smaller firm?
Considerably broader and less specialised. A single compliance officer at a small firm covers advisory, monitoring, regulatory change and often financial crime, reporting directly to senior management. That means faster exposure and more visibility, at the cost of the structured training and specialist depth a large firm provides. Both are legitimate starts and they suit different people.