---
title: "Risk, Operations, Product Control and Compliance"
book: "The Industry: Firms, Roles and Careers"
subject: quant
language: en
chapter: 24
exercises: 8
source: https://one-course.com/books/quant/17/en/chapter/24-risk-operations-product-control-and-compliance
---

# Chapter 24 — Risk, Operations, Product Control and Compliance

The European Banking Authority’s guidelines on pay say that “The remuneration of independent [control functions](#def-in-risk-operations-product-control-and-compliance-control) should be predominantly fixed, to reflect the nature of their responsibilities”, and that any variable pay should be set “separately from the business units they control”. The rule shapes the career as much as the pay: a risk manager, [product controller](#def-in-risk-operations-product-control-and-compliance-controller) or [compliance officer](#def-in-risk-operations-product-control-and-compliance-compliance) is paid for the quality of the control, not for the profit it allows. The [control functions](#def-in-risk-operations-product-control-and-compliance-control) employ many of the industry’s quantitative people, and for many of them they are a route into the industry as often as a destination. This chapter describes the four functions, compares their pay with the front office’s in the filings and in the banks’ reports, and follows the routes between them.

| **Role cards: the control and support functions** |
| --- |
|  | risk manager | operations analyst | [product controller](#def-in-risk-operations-product-control-and-compliance-controller) | [compliance officer](#def-in-risk-operations-product-control-and-compliance-compliance) |
| works on | limits, measures, escalation | settlement, confirmations, reconciliation | daily P&L and valuation | rules, surveillance, advice |
| reports to | chief risk officer | chief operating officer | chief financial officer | head of compliance |
| codes in filings | 13-2054, 13-2099.01 | 43-4011, 13-2099 | 13-2011, 13-2051 | 13-1041, 23-1011 |
| taught in | Book 6, ch. 21; Book 16, ch. 12 | Book 16, ch. 13 | Book 6, ch. 27; Book 16, ch. 15 | Book 16, ch. 16 |

**Definition 24.1 (Control function).**

A *control function* is an organisational unit, independent of the businesses it oversees, whose job is to measure, check and limit what those businesses do: risk management, compliance and internal audit in the regulators’ list, and in trading firms also product control, which checks the profit and loss the front office reports.

The EBA’s guidelines say independent [control functions](#def-in-risk-operations-product-control-and-compliance-control) “typically comprise risk management, compliance and internal audit functions”. Operations is not a [control function](#def-in-risk-operations-product-control-and-compliance-control) in that sense, but it is independent of the front office in the same way (the front, middle and back offices of Book 16, chapter 13) and it employs many of the same people.

## 24.1 Risk management

The risk function of Book 16, chapter 12, is led by the chief risk officer and sits outside the businesses it limits. Its quantitative work is the measurement of Book 6: value at risk and expected shortfall (chapter 21), stress tests (chapter 22), counterparty exposure (chapter 17), and the capital calculations of chapter 23. The [risk quant](https://one-course.com/books/quant/17/en/chapter/18-bank-quant#def-in-bank-quant-risk) of chapter 18 builds those models; the risk manager uses them to set limits, watch positions against them, and escalate when a desk breaches one or when a risk the models do not see appears. The four-eyes principle and the risk committee of Book 16 are the risk manager’s tools of authority.

A risk manager is judged by what does not happen: no unexplained loss, no limit breach unreported, no desk surprised by a stress. The work needs the quantitative literacy to read a model’s output critically and the standing to say no to a trader who earns more. Professional certification is common and optional: GARP’s Financial Risk Manager requires passing “two multiple-choice Exams” and “at least two years of relevant work experience”.

## 24.2 Operations

Operations makes sure that what the front office traded happens: trades confirmed with counterparties, settled at the central securities depository, margined at the clearing house, reconciled against the firm’s own books and the broker’s (Book 16, chapter 13; Book 15, chapter 22, for the systems). At a trading firm that trades millions of times a day the work is automated, and the operations analyst’s job is the exceptions: a break in a reconciliation, a failed settlement, a corporate action the systems missed. The quantitative content is data and process: finding the pattern in the breaks, automating what repeats, measuring the cost of fails.

## 24.3 Product control

**Definition 24.2 (Product controller).**

A *product controller* is a member of the finance function who produces and explains each trading desk’s daily profit and loss independently of the desk, checks the prices the desk marks its positions at (independent price verification), and signs off the valuation reserves.

Product control (Book 6, chapter 27; Book 16, chapter 15) is where a trading loss is found first. Its daily profit and loss explain attributes the desk’s result to market moves, new trades and residuals, and an unexplained residual is the [product controller](#def-in-risk-operations-product-control-and-compliance-controller)’s to chase. The quantitative work is the valuation models of Books 5 and 6 read from outside, the Greeks-based explain, and the independent sources for prices. Product control teaches every desk’s products and every desk’s numbers, which makes it a useful first job for a quantitative graduate at a bank.

## 24.4 Compliance

**Definition 24.3 (Compliance officer).**

A *compliance officer* is a member of the function that makes sure a firm and its staff follow the laws and rules that apply to them: advises the business, trains and certifies staff, monitors trading and communications for market abuse, and reports to regulators when required.

The compliance function of Book 16, chapter 16, has become quantitative through surveillance: the detection of market abuse (spoofing, layering, insider dealing, marking the close) in order and trade data, which Book 9, chapter 29, and Book 15, chapter 30, describe as models and systems. In the United Kingdom compliance is also a named responsibility: the regulator’s list of senior management functions includes “SMF 16 Compliance oversight function” and “SMF 17 Money laundering reporting function” (chapter 25).

**As of September 2026 — Rules that shape the control functions.**

EBA Guidelines on sound remuneration policies (EBA/GL/2021/04, 2 July 2021): [control functions](#def-in-risk-operations-product-control-and-compliance-control)’ pay “should be predominantly fixed”; their variable pay determined “separately from the business units they control”; institutions “should consider setting a significantly lower ratio between the variable and fixed components of remuneration for [control functions](#def-in-risk-operations-product-control-and-compliance-control)”. United Kingdom: SMF 16 (compliance oversight) and SMF 17 (money laundering reporting) are FCA-required senior management functions. GARP’s Financial Risk Manager: two exams (100 and 80 questions) and two years of relevant experience.

## 24.5 Control functions as careers and as routes to the front office

Two questions matter to a candidate: what the functions pay against the front office, and whether they lead anywhere.

**As of September 2025 — What control functions are paid: the public evidence.**

Labour condition applications at banks, fiscal 2025: risk titles 380 applications (5 employers), median offered base $136 776; traders and [quantitative researchers](https://one-course.com/books/quant/17/en/chapter/17-quantitative-researcher#def-in-quant-researcher-def) 883 (9 employers), median $160 000; ratio 0.855 (95% interval 0.807–0.903). At the trading firms pooled: 17 risk filings from 7 employers, median $193 003, ratio 0.965 (0.925–1.151). Occupational survey, May 2025, securities industry, median wages: financial risk specialists $133 070, accountants and auditors $105 160, [compliance officers](#def-in-risk-operations-product-control-and-compliance-compliance) $100 160, brokerage clerks $70 070. EBA [high earners](https://one-course.com/books/quant/17/en/chapter/14-pay-levels-by-role-firm-type-and-seniority#def-in-pay-levels-by-role-firm-type-and-seniority-median) 2024, credit institutions: 53 in independent [control functions](#def-in-risk-operations-product-control-and-compliance-control), variable-to-fixed ratio 0.88, against 1.23 in investment banking.

![Median offered base of risk-title filings over that of trader and quantitative-researcher filings, with 95% bootstrap intervals: banks in fiscal 2021 and 2025, overall and by wage level; the trading firms pooled, overall only (too few filings by level). Data: data/industry/lca_control_gap.csv, through in_control.ratios.](https://one-course.com/images/onecourse/chapters/quant-17/in-risk-operations-product-control-and-compliance/fig-c38c365c8317.svg)

***Figure 24.1.** Median offered base of risk-title filings over that of trader and quantitative-researcher filings, with 95% bootstrap intervals: banks in fiscal 2021 and 2025, overall and by [wage level](https://one-course.com/books/quant/17/en/chapter/14-pay-levels-by-role-firm-type-and-seniority#def-in-pay-levels-by-role-firm-type-and-seniority-soc); the trading firms pooled, overall only (too few filings by level). Data: `data/industry/lca_control_gap.csv`, through `in_control.ratios`.*

At banks the [control function](#def-in-risk-operations-product-control-and-compliance-control)’s offered base ran about 15% below the front office’s in fiscal 2025 overall, and 15% to 32% below at each level ([Figure 24.1](#fig-in-risk-operations-product-control-and-compliance-ratio)); in fiscal 2021 the two were level overall. The gap in base pay is the smaller part of the difference: in the banks’ reports of their highest earners, [control functions](#def-in-risk-operations-product-control-and-compliance-control)’ variable pay is 0.88 of fixed against 1.23 in investment banking, as the guidelines intend ([Figure 24.2](#fig-in-risk-operations-product-control-and-compliance-eba)). At the trading firms, the few risk filings sit close to the front office’s base, but their interval is wide.

![Ratio of variable to fixed pay of EU credit institutions’ staff paid one million euros or more in 2024, by business area; labels give the number of such staff. Independent control functions’ ratio is below those of investment banking, asset management and corporate functions. Data: data/industry/eba_high_earners.csv (EBA), through in_control.eba.](https://one-course.com/images/onecourse/chapters/quant-17/in-risk-operations-product-control-and-compliance/fig-83f57dda535f.svg)

***Figure 24.2.** Ratio of variable to fixed pay of EU credit institutions’ staff paid one million euros or more in 2024, by business area; labels give the number of such staff. Independent [control functions](#def-in-risk-operations-product-control-and-compliance-control)’ ratio is below those of investment banking, asset management and corporate functions. Data: `data/industry/eba_high_earners.csv` (EBA), through `in_control.eba`.*

The survey shows the same order among the occupations that fill the functions ([Figure 24.3](#fig-in-risk-operations-product-control-and-compliance-survey)): risk specialists paid near the financial analysts, accountants and [compliance officers](#def-in-risk-operations-product-control-and-compliance-compliance) below, operations clerks well below.

![Wages in the securities industry of the occupations that fill the control and support functions, with financial and investment analysts for comparison, May 2025 occupational survey: 10th to 90th percentile (thin), interquartile range (thick), median (mark). Data: data/industry/oews_roles.csv, through in_control.survey.](https://one-course.com/images/onecourse/chapters/quant-17/in-risk-operations-product-control-and-compliance/fig-5eaad6860c84.svg)

***Figure 24.3.** Wages in the securities industry of the occupations that fill the control and support functions, with financial and investment analysts for comparison, May 2025 occupational survey: 10th to 90th percentile (thin), interquartile range (thick), median (mark). Data: `data/industry/oews_roles.csv`, through `in_control.survey`.*

The routes run both ways. Product control and market risk teach every desk’s products and numbers, and people move from them to the desks they controlled, as strategists, [risk traders](https://one-course.com/books/quant/17/en/chapter/16-trader#def-in-trader-kinds) or [structurers](https://one-course.com/books/quant/17/en/chapter/23-structurer-sales-and-sales-trader#def-in-structurer-sales-and-sales-trader-structurer) (chapters 18 and 23); the reverse move, from the front office into risk or compliance, takes experience into the function that checks it. Model validation (chapter 18) sits between. Chapter 28 measures such moves where public data allow. For a candidate the question is less the first title than what the job teaches and who can see the work: a [control function](#def-in-risk-operations-product-control-and-compliance-control) sees the whole firm, the front office sees one desk.

## 24.6 Tutorial: the price of independence

**Goal.** Measure the [control functions](#def-in-risk-operations-product-control-and-compliance-control)’ base pay against the front office’s, and their pay mix against the business areas they control. **End state:** Figures [24.1](#fig-in-risk-operations-product-control-and-compliance-ratio), [24.2](#fig-in-risk-operations-product-control-and-compliance-eba) and [24.3](#fig-in-risk-operations-product-control-and-compliance-survey).

1. **Base pay.** `in_lca_control_derive.py` compares the risk family with the trader and [quantitative researcher](https://one-course.com/books/quant/17/en/chapter/17-quantitative-researcher#def-in-quant-researcher-def) families at banks and at the trading firms pooled, with `firm.roles.median_gap` (chapter 19), from chapter 14’s cache.
2. **Pay mix.** `firm.roles.fixed_share` and `mix_gap` turn the EBA’s variable-to-fixed ratios into shares of fixed pay ([Listing 24.1](#lst-in-risk-operations-product-control-and-compliance-mix)). `def fixed_share (variable_to_fixed): """Share of total pay that is fixed, from the ratio of variable to fixed pay: 1 / (1 + v).""" return 1.0 / (1.0 + float (variable_to_fixed)) def mix_gap (control_ratio, business_ratio): return {" fixed_control " : fixed_share(control_ratio), " fixed_business " : fixed_share(business_ratio), " ratio_of_ratios " : float (control_ratio) / float (business_ratio)}` **Listing 24.1.** Share of fixed pay and the gap in pay mix between a control function and a business area. code/firm/roles/firm_roles.py
3. **Survey.** `oews_roles.csv` for the functions’ occupations in the securities industry.

For the [high earners](https://one-course.com/books/quant/17/en/chapter/14-pay-levels-by-role-firm-type-and-seniority#def-in-pay-levels-by-role-firm-type-and-seniority-median): fixed pay is 53.3% of the [control functions](#def-in-risk-operations-product-control-and-compliance-control)’ total and 44.8% of investment banking’s; the ratio of their variable-to-fixed ratios is 0.71.

**What to change next.** Separate compliance and product control titles in the filings, which needs the job titles this book’s single pass did not keep; add bonus from the banks’ remuneration disclosures by business line; follow people across roles in public profiles (chapter 28).

## 24.7 Build: control cards and pay mix

**Purpose.** Add the control and support functions to the registry and measure the pay mix that the rules require.

**Interface.** `firm.roles`: the cards `risk manager`, `operations analyst`, `product controller`, `compliance officer`; `fixed_share(v)`; `mix_gap(control_ratio, business_ratio)`; with `median_gap` for base pay.

**Rules.** A ratio of variable to fixed pay is converted, never averaged, across areas; the base-pay comparison keeps the three-employer rule.

**Acceptance tests.** `code/firm/roles/tests/`: equal variable and fixed pay give a half; no variable pay gives one; a control ratio half the business’s gives a ratio of ratios of one half.

**Stretch.** A bootstrap over employers rather than filings; the effect of a [bonus cap](https://one-course.com/books/quant/17/en/chapter/15-pay-regulation-and-tax-by-location#def-in-pay-regulation-and-tax-by-location-cap) (chapter 15) on the mix.

Sources and further reading

- European Banking Authority (2021), Guidelines on sound remuneration policies under Directive 2013/36/EU, EBA/GL/2021/04; EBA, high earners 2024.
- FCA Handbook, SUP 10C; GARP, Financial Risk Manager.
- Chapter 14’s tables from the Department of Labor’s LCA files; BLS occupational survey, May 2025.
- Book 16, chapters 12–16; Book 6, chapters 21–28.

## 24.8 Exercises

**Exercise 24.1 ★.**

By how much, in dollars, did the banks’ median offer for risk titles fall short of the front office’s in fiscal 2025?

**Solution of Exercise 24.1.**

$160\,000-136\,776=\$23\,224$, with a 95% interval of $15 195 to $31 100.

**Exercise 24.2 ★.**

A control-function [high earner](https://one-course.com/books/quant/17/en/chapter/14-pay-levels-by-role-firm-type-and-seniority#def-in-pay-levels-by-role-firm-type-and-seniority-median)’s variable pay is 0.88 of fixed. What share of total pay is fixed?

**Solution of Exercise 24.2.**

$1/(1+0.88)=53.2\%$ (53.3% with the unrounded ratio 0.8775).

**Exercise 24.3 ★.**

Which UK senior management functions name the compliance and anti-money-laundering responsibilities?

**Solution of Exercise 24.3.**

SMF 16, the compliance oversight function, and SMF 17, the money laundering reporting function; both are required by the FCA.

**Exercise 24.4 ★★.**

The banks’ control-to-front ratio was 1.01 in fiscal 2021 and 0.86 in fiscal 2025. Using the medians ($131 720 and $130 000 in 2021; $136 776 and $160 000 in 2025), which side moved?

**Solution of Exercise 24.4.**

The front office’s median rose 23.1% ($160\,000/130\,000$), the [control function](#def-in-risk-operations-product-control-and-compliance-control)’s 3.8% ($136\,776/131\,720$): the front office moved.

**Exercise 24.5 ★★.**

Why would a regulator want [control functions](#def-in-risk-operations-product-control-and-compliance-control)’ pay to be predominantly fixed, and what does the rule cost?

**Solution of Exercise 24.5.**

So that the people who check risk-taking are not rewarded by it: a controller paid on the desk’s profit has a reason to let it take more risk. The cost is recruiting: the best quantitative people can earn more in the businesses they would control, so the function must compete on base pay, interest and career.

**Exercise 24.6 ★★.**

A graduate chooses between product control and a desk-analyst job at the same bank. What does each teach, and which is easier to leave?

**Solution of Exercise 24.6.**

Product control teaches every desk’s products, pricing and daily P&L from outside, and the controls around them; the desk analyst’s job teaches one desk’s trading from inside. Product control is easier to leave for another desk or function because it has seen many; the desk job leads more directly to trading.

**Exercise 24.7 ★★★.**

*Coding.* The trading firms’ ratio rests on 17 filings from 7 employers. Explain why its interval is asymmetric (0.925 to 1.151 around 0.965), and what a bootstrap over employers rather than filings would do to it.

**Solution of Exercise 24.7.**

With 17 filings the median jumps between a few offered values, many of them round numbers, so resampled medians pile up on a few points and the percentile interval need not be symmetric. Filings from the same employer are alike; resampling employers instead of filings would treat seven employers as seven observations, and the interval would widen.

**Exercise 24.8 ★★★.**

*Find the flaw.* “Risk managers at banks are paid 15% less than traders, so the banks do not value risk management.”

**Solution of Exercise 24.8.**

[Base salary](https://one-course.com/books/quant/17/en/chapter/13-how-pay-works#def-in-how-pay-works-base) is not pay, and the rules require [control functions](#def-in-risk-operations-product-control-and-compliance-control) to be paid more in fixed and less in variable pay, so the comparison of base understates the front office’s total pay and says nothing about value. The filings compare titles, not the same person; and the 15% gap is the median of different jobs at different levels.

## 24.9 Problem: The Price of Independence

**Problem 24.1.**

Weekend problem — the price of independence

A quantitative graduate has offers in market risk at a bank and as a junior researcher at a market maker, and asks what choosing the [control function](#def-in-risk-operations-product-control-and-compliance-control) costs.

**Part I — The functions.**

1. Define a [control function](#def-in-risk-operations-product-control-and-compliance-control) , a [product controller](#def-in-risk-operations-product-control-and-compliance-controller) and a [compliance officer](#def-in-risk-operations-product-control-and-compliance-compliance) .
2. Which functions does the EBA list as independent [control functions](#def-in-risk-operations-product-control-and-compliance-control) ?
3. What does a risk manager do with the [risk quant](https://one-course.com/books/quant/17/en/chapter/18-bank-quant#def-in-bank-quant-risk) ’s models?
4. What does operations do at a firm that trades millions of times a day?
5. How has compliance become quantitative?

**Part II — The rules.**

6. State the EBA guidelines’ rules on [control functions](#def-in-risk-operations-product-control-and-compliance-control) ’ pay.
7. Why must variable pay be set separately from the businesses controlled?
8. What are SMF 16 and SMF 17?
9. What does the FRM require?
10. What do the rules imply for a control-function career’s pay path?

**Part III — The evidence.**

11. Give the banks’ control-to-front ratio overall and by level in fiscal 2025.
12. Give the trading firms’ ratio and say why it is uncertain.
13. Compare the [high earners](https://one-course.com/books/quant/17/en/chapter/14-pay-levels-by-role-firm-type-and-seniority#def-in-pay-levels-by-role-firm-type-and-seniority-median) ’ pay mix in [control functions](#def-in-risk-operations-product-control-and-compliance-control) and investment banking.
14. Rank the functions’ occupations by the survey’s medians.
15. How did the ratio change since fiscal 2021?

**Part IV — The verdict.**

16. State the *named result* : the ratio of control-function to front-office median offered base at banks and at trading firms, with bootstrap intervals.
17. What does base pay miss here?
18. What does the market-risk job teach that the research job does not?
19. What routes lead from market risk to the front office?
20. In two sentences, answer the graduate.

**Solution of Problem 24.1.**

1. As in the chapter’s definitions.
2. Risk management, compliance and internal audit.
3. Sets limits, watches positions against them and escalates breaches and unmodelled risks.
4. Handles the exceptions: breaks, fails and missed corporate actions, and automates what repeats.
5. Through surveillance models of market abuse in order and trade data.
6. Predominantly fixed pay; variable pay set separately from the businesses controlled, on control objectives; a significantly lower variable-to-fixed ratio.
7. So that the controller is not paid for the risks she should limit.
8. The FCA’s required compliance oversight and money laundering reporting functions.
9. Two exams and two years of relevant experience.
10. A flatter path: more of it in base, less in bonus, less dependent on the businesses’ results.
11. 0.855 (0.807 to 0.903) overall; 0.68, 0.79, 0.85 and 0.83 at levels I to IV.
12. 0.965 (0.925 to 1.151), from only 17 filings at 7 employers.
13. Variable pay 0.88 of fixed in [control functions](#def-in-risk-operations-product-control-and-compliance-control) against 1.23 in investment banking: fixed pay 53.3% and 44.8% of the total.
14. Financial risk specialists $133 070, accountants and auditors $105 160, [compliance officers](#def-in-risk-operations-product-control-and-compliance-compliance) $100 160, brokerage clerks $70 070.
15. From level (1.01) in fiscal 2021 to 0.86 in fiscal 2025, because the front office’s offers rose.
16. Banks 0.855 (0.807 to 0.903); trading firms 0.965 (0.925 to 1.151).
17. Bonus, which is larger and more variable in the front office.
18. The whole firm’s risk, its models from outside, and the controls a firm needs.
19. Market risk to risk trading or strategy; model validation to the desk’s quant teams; product control to the desks.
20. In base pay the market-risk job costs about a seventh at a bank, and much more once bonuses are counted; the market maker’s research job pays more and judges faster. Choose market risk only if you want to see the whole firm, and plan the move you would make from it.

## 24.10 Interview questions

**Interview question 24.1 ★ risk.**

A desk’s P&L explain shows a large unexplained residual today. What do you check first?

**Solution of Interview question 24.1.**

Missing or late market data, a trade booked wrongly or not at all, a model or curve change, a corporate action, and a Greek computed on the wrong position; then the desk’s explanation, in writing.

*What the interviewer is looking for: data and booking before models.*

**Interview question 24.2 ★ risk.**

A trader breaches a limit by 5% for ten minutes and says the model is wrong. What do you do?

**Solution of Interview question 24.2.**

Record and escalate the breach as the policy requires, whatever the trader says about the model; separately, review the model if there is evidence, and change the limit only through the proper approval.

*What the interviewer is looking for: independence and process.*

**Interview question 24.3 ★★ risk, bank.**

How would you verify the price of a position with no liquid market quote?

**Solution of Interview question 24.3.**

Consensus pricing services, recent trades in similar instruments, broker quotes, model prices from observable inputs, and a valuation reserve for the uncertainty (Book 6, chapter 27).

*What the interviewer is looking for: several independent sources and a reserve.*

**Interview question 24.4 ★★ risk, developer.**

Design a detector for spoofing in order data. What is its false-positive problem?

**Solution of Interview question 24.4.**

Flag orders placed and cancelled quickly on one side near the touch while the same trader executes on the other side, with thresholds on size, time and ratio. Legitimate market making cancels often too, so most alerts are false; rank them and review the top with context.

*What the interviewer is looking for: the pattern and the false-positive trade-off.*

**Interview question 24.5 ★★ risk.**

Your value at risk fell sharply while the positions did not change. Why might that be?

**Solution of Interview question 24.5.**

A calm period left the historical window (or a volatile one dropped out), a correlation changed, or data errors in the window; check the scenario set and the inputs before believing it.

*What the interviewer is looking for: the measure moves with its window, not only with positions.*

**Interview question 24.6 ★★★ risk, trader.**

Two desks each hedge the other’s risk and both show profits. What would make you suspicious, and how would you check?

**Solution of Interview question 24.6.**

Profits on both sides of what should be a hedge suggest mismarked or fictitious positions, or a transfer price between desks that is not at market. Check the internal trades against market prices, confirm external positions, and look at who approved the internal trades.

*What the interviewer is looking for: internal trades as a place to hide losses.*