合规官您好！我是一名企业合规官。
今天来信，不是想寻求多大的帮助，只是想分享一些作为合规官的经验与无奈，我知道很多问题，并不是专业问题，也不是求助可以解决的，但至少可以分享出来，让行业内外的人员了解我们合规这个职业的工作特点与难处。也让我们有个地方可以分享。
我是一名从业近十年的合规人员。
在外人眼里，我的岗位是一个“权力岗位”，好像被赋予了天然的权力：公司设立了独立的合规部门，有着完善的合规制度、明确的审核流程，合规人员对重大事项有一票否决权，经常能接触公司顶层管理者，给他们汇报工作、进行培训……看上去，好像是一个凌驾在各部门之上的管理岗位。
但是事实并非如此，身处合规岗位多年，我经常深深地有一种无力感：名义上的一票否决，实则要承担巨大的压力；名义上的为业务把关，实际上却被业务悄悄“架空”。
最初我以为，可能是因为合规与业务的天然对立或者是立场冲突导致了业务对我的远离：业务要冲业绩、抢窗口期，合规要控风险、划红线。对这种冲突，我是有心理预期的，也在工作中尽量化解这种矛盾，始终秉承“合规是业务的伙伴、是朋友”这一态度与业务打交道。而且在发现风险时，我也不是一味地说不、说否定，而是尽量地给出可行的解决方案。
虽然我尽力化解冲突，但是我发现，近年来，我越来越被业务所排斥，越来越无法参与到预审核的阶段中。很多事情，都是业务“有意”绕过我而为之。很多重点项目，立项会我收不到通知；核心业务群，合规人员不在知晓名单里；业务已经跟客户谈完了关键条款，合规条款才发给我审查；甚至有时候项目已经到了收尾阶段，风险早就有了或者已经发生了，才匆匆找到我。
当我对业务指出合规风险点时，常常能收到这样的回答：“市场环境不好，能有个单子就不错了，你阻碍了指标，最后大家都没工作。”我没有办法，只能把意见存在审批流程中，做到基本的留痕，至于之后业务老大怎么处理，我就完全没有话语权了，所谓的合规一票否决，也是在培训时候说说而已。
更让我受挫的是，业务居然摸索出了一套如何“绕开合规”的成熟操作体系。
让我来无奈地说说业务是怎么“对付”我的吧：
常见的是，为了躲避公司的合规审批标准，一些业务人员把重大、高金额的项目进行拆分，分成几个简易小项目，直接绕过合规走简易流程；还有些重大项目，直接不在公司做了，转而通过第三方商业伙伴进行落地；还有些更隐蔽的，很多重要的关键交易点、交易约定直接走口头了，双方点头默认就完事，也不体现在合同中，更别说留痕了。
这些行为中有些之后出现了问题，让我去查，可是我也很难啊，根本无据可依、无迹可查。
如果恰巧，我发现了在进行中的项目没有报到合规进行审查，提出质疑，那么业务就还是那一套：业绩啊、行业惯例啊、你不懂业务不懂市场、老大给的指标，公司艰难等等，好像我合规部就成了公司发展慢的元凶了。
但是，一旦风险爆发了，合规却是第一个要问责的。也就是说，项目做完了跟我没啥关系，项目暴雷了就全是我的错了。“合规为什么没有识别到风险？为什么没有风险提示？”“合规干嘛去了？”每当领导这样问的时候，我也感觉很委屈。
但是，最让我感到讽刺的是，公司的合规制度无比完备，堪比甚至超越国际一线公司，合规手册、合规制度、审核流程、风险报告、员工培训材料等等无一不做得完整又漂亮，而且在各大员工会议、区域会议中，中高层领导也在强调“合规零容忍”这一公司经营准则。但是实际上呢？说归说做归做。
点击下图了解企业合规管理体系建设服务
我也明白，市场竞争非常激烈，业务部门的同事背负着业绩指标，很多时候确实不得已而为之。而且说实话，考虑到业务的艰难，合规部也从来没有行使过一票否决权。
但是我也不知道如何让这种“被架空”的行为进行缓解，好避免之后更多的恶性循环。
当合规只能在事后签字，事前听不到声音，那么再专业的风险判断，都失去了实际意义。我出具的风险提示变成一纸空文，长此以往，业务会习惯性忽略合规意见，合规部门慢慢沦为“走流程”的工具部门。
我想知道，是不是很多同行都跟我有相似的处境：不参与前期谈判，不介入立项研讨，只负责为已经成型的业务做书面背书。出了事，合规背锅；不出事，合规可有可无。
我也常常反问自己，问题到底出在哪里？是我沟通能力不够，不会平衡风险和业务发展？还是我们的合规流程设计过于僵化？后来慢慢意识到，很多困境根源不在合规从业者个人。
我并不追求合规凌驾于业务之上，我只希望获得平等对话的资格：重要项目立项，合规应当在场；关键商业谈判，合规有权知晓；合规出具的风险意见，应当被管理层看见、被纳入决策权衡，而不是被直接无视。合规真正的价值，从来不是项目临门一脚时说“不”，是在预防，是在立项、谈判、方案设计阶段就介入，一起设计既能推进业务，又能规避重大风险的路径。合规的最佳位置，是坐在业务的同一张谈判桌上，而不是站在门外干等着做事后审查。
架空合规，表面看是业务部门图方便、赶进度，深层是企业整体的文化意识根本没有把合规放在高于、哪怕平等于业务的位置，没有意识到违规的后果有多么的严重和深远。风险不会因为业务口头承诺“我们自己承担”就自动消失。业务团队可以对业绩负责，但往往无法完整预判行政处罚、民事纠纷、刑事风险带来的连锁代价。一旦爆发风险，损失承担者终究是整个公司。
写这封信，也想写给和我一样处境的合规同行。
被架空，不代表我们的专业没有价值。但我们也要清醒，如果始终只能游离于业务真实决策之外，再强的专业能力，也很难转化为企业的风险屏障。我们需要修炼沟通能力，学会给出替代方案；但更需要组织层面制度的支撑，而不是让合规人靠个人情商去争取话语权。
我也想写给企业管理者，业绩很重要，特别重要，但是不顾风险的追求业绩是一种饮鸩止渴，会把企业推向深渊。
合规官结语：
注：本篇文章中的敏感信息和隐私信息已进行脱敏处理。
Dear Compliance Officer,
I am a corporate compliance officer.
I write not in the hope of securing much help, but to share some of the experience and the frustration of life as a compliance professional. I know that many of these issues are not questions of professional competence, nor ones that can be resolved by asking for assistance. But at the very least, sharing them can help those inside and outside the profession understand the working realities and the difficulties we compliance practitioners face — and give us somewhere to be heard.
I have been in the compliance profession for nearly a decade.
To outsiders, my role looks like one of “power” — as if it carries an inherent authority. The company has established an independent compliance function, backed by a complete set of compliance policies, clearly defined review procedures, and a unilateral veto right for compliance over material matters. Compliance personnel regularly engage with top management — reporting to them and training them — so the position appears to sit above the various business units as a management role.
But that is not the reality. Having served in this role for years, I am often seized by a deep sense of powerlessness: the nominal veto power in practice carries enormous pressure; the nominal role of “gatekeeper for the business” has in fact been quietly sidelined by the business side.
At first I thought this might stem from the natural opposition — or the conflict of standpoint — between compliance and the business. The business chases performance and races against windows of opportunity; compliance controls risk and draws the red lines. I was mentally prepared for this friction, and in my work I tried to defuse it, always engaging the business with the conviction that “compliance is a partner to, and a friend of, the business.” And when I identified risks, I did not simply say no or issue blanket rejections; wherever possible I proposed workable solutions.
Yet despite my efforts, I have found in recent years that I am increasingly shut out by the business and increasingly excluded from the pre-review stage. Many matters are deliberately routed around me. I receive no notice of kickoff meetings for key projects; compliance is not on the distribution list for core business groups; the business has already negotiated the key terms with the client before the compliance clauses are sent to me for review; and at times a project is already at the winding-up stage — with risks already present or already materialised — before I am hastily brought in.
When I flag compliance risk points to the business, the replies I routinely hear are: “The market is poor; landing any deal at all is a win. You are blocking our targets, and in the end none of us will have a job.” There is little I can do but record my objections in the approval workflow to preserve a basic audit trail. As for how the business head then handles it, I have no voice at all. The so-called compliance veto exists, in truth, only in the training slides.
What frustrates me even more is that the business side has in fact worked out a mature operating system for “getting around compliance.”
Let me, with a sense of resignation, describe how the business “handles” me:
Commonly, to evade the company’s compliance-approval thresholds, some business personnel split major, high-value projects into several minor ones and push them through simplified procedures, bypassing compliance altogether. Some major projects are simply taken off the company’s books and executed through third-party commercial partners. Still more covert are those cases where critical transaction points and key terms are settled orally — a nod and a tacit understanding between the parties, with nothing set out in the contract, let alone documented. Some of these practices later gave rise to problems and I was asked to investigate, but I was at a loss: there was simply no basis and no trail to follow.
If, by chance, I discover an ongoing project that was never referred to compliance for review and I raise a query, the business falls back on the same script: performance targets, industry practice, “you don’t understand the business or the market,” the metrics handed down by senior management, the company’s hard times — as if the compliance function had become the very culprit for the company’s slow growth.
And yet, the moment a risk materialises, compliance is the first to be held to account. In other words, if a project succeeds, it has nothing to do with me; if it blows up, it is entirely my fault. “Why didn’t compliance identify the risk? Why was there no risk warning?” “Where was compliance?” Every time leadership poses these questions, I feel a deep sense of injustice.
But what I find most ironic is this: the company’s compliance framework is impeccably complete — on a par with, or even surpassing, first-tier international firms. The compliance manual, policies, review procedures, risk reports, and training materials are all thorough and polished. And at employee meetings and regional conferences alike, senior and mid-level leaders repeatedly stress the operating principle of “zero tolerance for non-compliance.” But in practice? Words and deeds do not match.
I also understand that market competition is fierce, that colleagues in the business units carry performance targets, and that much of what they do is, to be frank, born of necessity. And, to be honest, given the difficulties the business faces, the compliance function has never once exercised its veto power.
But I do not know how to ease this “sidelining” and avert further vicious cycles down the line.
When compliance can only sign off after the fact and is never heard beforehand, even the most professional risk judgment loses its real meaning. The risk warnings I issue become dead letters. Over time, the business will habitually disregard compliance input, and the compliance function will slowly degenerate into a mere “process” tool.
I want to know whether many of my peers find themselves in a similar position: excluded from early-stage negotiations, absent from project-initiation deliberations, responsible only for providing written endorsement to business that has already been finalised. When something goes wrong, compliance takes the blame; when all is well, compliance is dispensable.
I also constantly ask myself where the problem truly lies. Is it that my communication skills fall short — that I cannot balance risk and business development? Or is our compliance process design too rigid? Gradually I have come to realise that the root of many of these predicaments does not lie with individual compliance practitioners.
I do not seek for compliance to sit above the business. I only wish to earn the right to an equal dialogue: at the initiation of key projects, compliance should be present; in critical commercial negotiations, compliance should have the right to be informed; the risk opinions issued by compliance should be seen by management and factored into decision-making — not simply ignored. The true value of compliance has never been to say “no” at the final moment before a deal closes. It lies in prevention — in engaging at the project-initiation, negotiation, and solution-design stages to chart, together, a path that advances the business while avoiding material risks. The optimal place for compliance is at the same negotiating table as the business, not standing outside the door waiting to perform ex-post review.
Sidelining compliance appears on the surface to be the business units seeking convenience and rushing schedules. At a deeper level, it reflects an enterprise-wide cultural mindset that has never placed compliance above — or even on a par with — the business, and has never appreciated how severe and far-reaching the consequences of violations can be. Risk does not simply vanish because the business orally promises to “bear it ourselves.” Business teams can be accountable for performance, but they often cannot fully anticipate the chain of costs brought by administrative penalties, civil disputes, and criminal exposure. Once a risk materialises, the party that ultimately bears the loss is the company as a whole.
I write this letter also for my fellow compliance professionals who find themselves in the same situation.
Being sidelined does not mean our professionalism is without value. But we must also stay clear-eyed: if we remain permanently outside the business’s real decision-making, then however strong our professional capability, it will be difficult to convert it into an effective risk safeguard for the enterprise. We must hone our communication skills and learn to offer alternatives; but we need still more the backing of an organisation-level system — rather than leaving compliance professionals to fight for a voice through personal emotional intelligence alone.
I also write this for corporate managers. Performance matters — it matters enormously. But pursuing performance while disregarding risk is like drinking poison to quench thirst; it pushes the enterprise toward the abyss.
Compliance Officer’s Postscript：
We deliberated for a long time over whether to publish this letter. After all, it is a “confidence shared in confidence” from a compliance officer — one that voices the helplessness, the sorrow, and the inner conflict of those in the profession, and offers an objective appraisal of compliance as a vocation. But with the author’s consent, we have chosen to publish it. This is not merely the problem of one compliance officer; it is a persistent source of frustration shared by many in the same profession. By publishing it we hope to strike a chord, and perhaps to receive feedback and spark discussion that may, in time, shed light on our predicaments.
Note: Sensitive and private information in this article has been redacted.