The constraint on a small compliance function is almost never knowledge. The CCO knows the rules. What they don't have is hours — a team of one or two carrying the same rule set as a group of thirty at a larger firm, with no ability to specialize.
The usual response is to work later and triage harder. That holds for a while, and then something slips: a filing, a review that didn't get evidenced, a policy that fell out of date. The slip isn't a knowledge failure. It's a capacity failure that looked like a knowledge failure at exam.
Before you can fix that, you have to know where the time is going — and most compliance officers have a rough sense rather than a number.
Start with two weeks of honest logging
The exercise is simple and slightly tedious. For two weeks, log every block of compliance work with three fields:
- What it was — the category, not the specific item.
- How long it took — rounded to fifteen minutes is fine.
- Did it need your judgment? Yes or no. Would a competent person following a written procedure have reached the same answer, or did this genuinely require your call?
That third column is the entire point of the exercise. Hours alone tell you that you're busy, which you already knew. Hours split by judgment tell you which of them a senior compliance professional needed to be spending.
The five categories
Nearly all compliance work sorts into five buckets. They behave differently, and they're worth separating.
1. Monitoring
Reading what regulators publish and deciding what applies to you. SEC rules and proposals, risk alerts, staff guidance, FINRA notices if you're dually registered, enforcement actions for the pattern they reveal.
Very little of this is judgment-heavy. The great majority of published material won't apply to your firm, and establishing that takes a few minutes per item. The work expands because the volume is continuous and there's no natural stopping point — it's never finished, only current.
2. Document assembly
Finding things. Producing records on request, locating the current version of a policy, reconstructing what a file looked like at a point in time, pulling evidence that a review actually happened.
This is the category most likely to be badly underestimated, because it's fragmented — ten minutes here, twenty there, rarely logged as its own activity. It's also almost entirely mechanical. Nobody needs a CCO to search a file share. And it scales badly: the effort is a function of how disorganized the record is, not how large the firm is.
3. Review queues
Marketing materials, personal trading pre-clearance, correspondence sampling, incoming complaints. Recurring streams of items, each needing a decision.
Mixed on judgment, and the mix is the interesting part. Most items in any queue are routine — the social post with a standard disclosure, the pre-clearance request for an unrestricted security. A minority genuinely need a judgment call. But because they arrive interleaved, the routine items consume the same attention as the difficult ones.
4. Recurring obligations
The annual review, the ADV annual updating amendment, code of ethics attestations, vendor reviews, training, testing cycles.
These are predictable, which makes them easy to defer and expensive to defer. The work is mostly assembly and coordination — chasing attestations, gathering evidence, formatting a report — with a genuine judgment layer at the end when findings have to be assessed and graded.
5. Actual judgment
The conflicts question with no clean answer. Whether a claim in an ad is fair and balanced given the audience. Whether an incident is escalation-worthy. How to characterize a finding to an examiner. Where the firm's risk tolerance sits on something the rules don't settle.
This is the work only the CCO can do, and it is usually the smallest share of the week.
What the audit typically shows
Run the exercise honestly and the pattern is consistent: the large majority of the week sits in categories one through four, and only category five required a CCO.
That's the inefficiency worth naming. Not that compliance officers are slow — that a scarce, expensive, senior capability is being spent on searching, chasing, formatting, and triaging. And the cost isn't only the hours. It's that judgment work gets done at the end of a long day, in the gaps, under time pressure. The most consequential decisions get the worst conditions.
Sequencing what you fix
The instinct is to start with whatever is most irritating. The better rule is to start where volume is highest and judgment is lowest, because that's where a fixed amount of effort returns the most time.
A rough order:
- Document assembly first. It's the highest-volume, lowest-judgment category, and improvement is mostly structural — a consistent filing scheme, real version control, records tagged the way examiners actually request them. Unglamorous, and it pays back immediately.
- Then monitoring triage. The reading can't be eliminated, but the applicability decision can be made faster and, crucially, recorded as it happens rather than reconstructed later.
- Then the routine end of review queues. Separating routine items from ones needing judgment is itself most of the win, whether or not anything else changes.
- Then recurring obligations. The assembly and chasing around the annual review, not the judgment at the end of it.
Notice that category five isn't on the list. That's deliberate.
What shouldn't be automated
Worth being explicit, because the market around this overclaims.
Anything ending in a judgment call or a signature stays with a person. A system can prepare the work — assemble the file, flag the likely issues, cite the provision, draft the language, surface what needs attention — but the decision and the accountability for it remain the compliance officer's.
A tool that finalizes its own review isn't an efficiency gain, it's a control failure, and an examiner will treat it as one. The right shape is always: the system prepares, a named person decides, and the record shows who decided what, when, and on what basis. If anything, the audit trail should be better than what a manual process produces, not worse.
The point of the exercise
Efficiency in a compliance function isn't about working faster. It's about changing what the compliance officer's hours are spent on — moving them out of assembly and triage and into the judgment work that no one else in the firm can do.
A firm that makes that shift doesn't just get a less exhausted CCO. It gets better decisions, because the hard calls stop being made in the margins of the day.
If you run the two-week audit and the split surprises you, we'd be interested to see the numbers.