Interview guide for compliance roles: a loop for compliance analysts, officers and managers

Compliance hires are tested on the days when the answer is unpopular. A compliance analyst who knows the rules but cannot explain them to a sales team gets worked around. An officer who writes excellent policies but never tests them finds out about failures from a regulator. A manager who wants to be liked by the business may sign off on things they should stop. A good loop tests the practical skills of the job, turning rules into controls, investigating fairly and writing clearly, and the independence to say no to senior people with a workable alternative.

This guide covers compliance analysts, compliance officers and compliance managers in financial services, healthcare and regulated corporate settings. The first call for BSA/AML analysts is in compliance analyst screening questions, and audit hires are in internal auditor screening questions. Front-line bank roles are in the interview guide for banking roles, and in-house counsel and paralegals in the interview guide for legal roles.

The loop at a glance

Stage 1: the screen (20 minutes)

• "Which regulatory areas have you owned, not just supported?" Examples: BSA/AML, consumer lending, securities supervision, privacy, healthcare billing, anti-corruption.
• "Have you worked through a regulatory exam or audit? What was your role?"
• "Does this role require registration?" For broker-dealer roles, check registration history on FINRA BrokerCheck.

Stage 2: structured interview (40 minutes)

1. "Tell me about a control you designed. How did you know it worked?" Listen for: testing, metrics and changing the control when it did not work.
2. "Tell me about a time a senior leader wanted to go ahead with something you thought was noncompliant." Listen for: clear reasoning, escalation through the right channel, documentation and an alternative offered.
3. "How do you decide what to monitor when you cannot monitor everything?" Listen for: a risk assessment that ranks likelihood and impact, revisited when the business changes.
4. "Describe a finding you had to report to a regulator, board or audit committee." Listen for: accuracy, ownership and remediation tracking.
5. "How do you keep up with regulatory change?" Listen for: a system, such as monitoring sources and an inventory of obligations mapped to owners.

Stage 3: the gap analysis exercise (40 minutes)

Pick a short excerpt of a real rule relevant to your business, one or two pages, and a one-page description of a current process with some gaps. Examples: for a bank, the customer due diligence elements of an anti-money laundering program in 31 CFR 1020.210 and an example onboarding process for business accounts; for a healthcare provider, an excerpt of a billing rule and an example coding workflow; for a broker-dealer, an excerpt of supervision requirements and a description of email review.

Ask for a short written answer:

1. Which requirements are not met by the current process?
2. What control would you add, and who should own it?
3. How would you test it in six months?
4. What would you ask the business before finalizing?

What to score

• Reading: identifies the actual requirements, not general themes.
• Proportion: proposes controls that fit the risk and the business, not maximum controls everywhere.
• Ownership: puts first-line controls with the business and testing with compliance.
• Testing: describes a sample, a method and what a failure looks like.

Stage 4: the investigation scenario (20 minutes)

Read a hotline report: an anonymous employee says a sales manager is telling staff to backdate customer signatures to meet month-end targets. Ask the candidate how they would handle the first two weeks. Score whether they protect the reporter's confidentiality and guard against retaliation, preserve evidence, involve legal and HR appropriately, interview in a sensible order, keep the manager out of the process, and document findings and remediation, including whether customers were harmed. Jumping to conclusions about the manager before evidence is gathered scores low.

Stage 5: business partner conversation and memo (30 minutes)

A business leader plays a product head who wants to launch a new promotion next week. The brief has a feature that creates a compliance problem, such as marketing claims that need disclosures or a process that skips a required check. The candidate has 15 minutes to talk it through and 15 minutes to write a five-sentence email to the product head. Score plain language, a clear position, an alternative path to launch and a tone that keeps the relationship.

Scorecard competencies and weights

Example weights for a compliance officer. Lock yours before the first candidate.

For analysts, move weight from independence and reporting to testing accuracy, and use a smaller exercise, such as reviewing five example alerts or files with one clear issue.

References

Compliance references are most useful from two directions: a former compliance leader, who can speak to quality of work, and a business leader the candidate worked with, who can speak to influence. Ask each the same questions:

• "Tell me about a time [name] disagreed with a business decision. How did it go?" Listen for: firmness with respect, and whether the relationship survived.
• "How reliable were [name]'s testing and documentation when examiners or auditors reviewed them?" Listen for: findings about compliance's own work.
• "Would you want [name] in the room for a difficult regulatory meeting?" Listen for: hesitation, and follow up on it.

Role-specific rules to check

Checked against the linked primary sources as of October 2026. Not legal advice; your regulator and counsel decide.

• Broker-dealer chief compliance officers. FINRA Rule 1220(a)(3) requires each person designated as chief compliance officer on Schedule A of Form BD to register as a Compliance Officer and sets the qualification route.
• Broker-dealer registered staff. FINRA Rule 3110(e) requires a member to ascertain an applicant's good character, business reputation, qualifications and experience before applying to register them, and to verify Form U4 information, including a search of reasonably available public records.
• BSA officers. For banks with a federal functional regulator, 31 CFR 1020.210(a) describes an anti-money laundering program that includes designating an individual or individuals responsible for coordinating and monitoring day-to-day compliance. Make sure the role description and authority match.
• Banks generally. Compliance staff at insured banks are covered by FDIC Section 19 like other employees; see the banking guide for timing.
• Healthcare compliance. HHS OIG's General Compliance Program Guidance is a voluntary, nonbinding reference that includes the seven elements of a compliance program. It is useful for building the role description and interview questions.
• Whistleblower communications. Under 17 CFR 240.21F-17(a), no person may take any action to impede an individual from communicating directly with SEC staff about a possible securities law violation, including enforcing or threatening to enforce a confidentiality agreement. Have counsel review confidentiality language in offer letters and agreements. Do not treat a candidate's past escalation of concerns as a negative.
• Background checks. When a consumer reporting agency runs the check, 15 U.S.C. 1681b(b) requires a stand-alone disclosure, written authorization and pre-adverse action notice. See the FCRA background check process.

The decision rule

1. Floor: at least 3 on the gap analysis and nothing below 2 on independence.
2. Weighted total: in this example, 2.8 or higher on a 1–4 scale is an offer.
3. Contingencies: references from a former compliance leader and a business partner, any required registration, and background checks your industry requires.

Mistakes that weaken compliance loops

• Quizzing on regulation numbers. Test applying a rule, not memorizing it.
• Hiring for agreeableness. Score independence explicitly.
• Skipping writing. Most compliance influence happens in emails and memos.
• Using confidentiality terms that chill reporting. Review offer language with counsel.