Compliance Officer hiring kit

Every step to hire the compliance officer who turns the rules into controls that run, and knows which alert to close, which to chase and which to escalate.

About this kit — the 5Ws

A compliance officer in a financial firm makes sure the business follows the rules that apply to it, and can show that it does. In practice that means turning those rules into policies and controls people can follow, testing whether the controls actually work, judging customer due diligence and transaction-monitoring alerts, and writing up each decision so someone else could check it later. It also means telling the business plainly when something has gone wrong, escalating it even when doing so is uncomfortable, and helping teams find a compliant way to do what they need rather than simply saying no.

Calibrated for:: Experienced individual contributor: a compliance officer or senior analyst who works cases and controls hands-on, not a head of compliance.
Timeline:: Set an approval-to-offer target at intake, allowing for panel availability, candidate adjustments, references and any lawful checks.

Who: Hiring managers, heads of compliance and recruiters at banks, payment firms, lenders, insurers and investment firms filling a hands-on compliance seat, whether it covers financial crime, conduct or both.
What: Use this kit to define the compliance craft you need, test alert triage, file notes and control design with a written work sample, interview every candidate on the same questions and record why the hire was made.
When: Start when the case for the role is first raised, before any advert goes out, and keep going until you have checked how long each step of this search took, including any regulatory approval the role needs.
Where: Regulated financial-services firms of any size, in any jurisdiction; the kit speaks of the applicable rules rather than any one country's.
Why: Compliance mistakes stay hidden until a review or an inspection finds them. A fixed alert-triage exercise, the same scenario questions for everyone and a written rubric show you who can reach a defensible call and record it, rather than who can recite the rulebook.

The competency model · 7

Use these competencies to compare job-related evidence. Review any apparent gap in a must-have before deciding.

Translating rules into policies and controlsMust-have · 15
Takes a requirement and writes the control that meets it: who does what, when, on what evidence, and what record proves it ran, rather than restating the rule in policy language.
Control monitoring and testingMust-have · 15
Designs a test that checks whether a control operated, not just whether it is written down: picks a sample, sets what counts as a pass, follows up exceptions and reports the root cause.
Due diligence and red-flag judgementMust-have · 20
Reads a customer profile and its activity together, recognises which patterns are genuinely unusual for that customer, and sets the depth of due diligence by risk rather than by habit.
Alert investigation and file notesMust-have · 15
Works an alert to a decision, gathers corroborating evidence rather than relying on the customer's word, and writes a file note a reviewer could follow without asking a single question.
Breach and escalation judgementMust-have · 15
Contains an issue, establishes the facts, assesses it against the firm's breach criteria with the right people, and escalates on time even when a senior colleague would rather wait.
Advising and training the businessMust-have · 10
Explains the risk behind a control in the business's own terms, offers a compliant route to what the team needs, and runs training that changes what staff actually do.
Regulatory change trackingCan learn · 10
Spots a new rule or guidance update that touches the firm, maps it to the policies and controls it changes, and follows it through to a change the business has made.

What's required and what's optional

Your hiring journey for Compliance Officer. Select a stage to jump to it.

Required for every hire
Optional — use when it adds evidence
AI boost — a big drafting win
Colour = phase

Phase 1
Plan
1. 01Plan the roleRequired
2. 02Agree successRequiredAI boost
Phase 2
Attract
1. 03Write the jobRequiredAI boost
2. 04Find candidatesOptionalAI boost
Phase 3
Select
Phase 4
Decide
Phase 5
Onboard & learn
1. 12Help them settle inRequired
2. 13Measure time to hireRequiredAI boost

AI drafts, people decide: Use AI to draft, rewrite and summarise your own material — never to rank, score, screen out or decide on candidates, and never with a candidate's personal data.

Plan

Attract

Select

Decide

Onboard & learn

Solid = required · dashed = optional · arrow keys move between steps

Stage 1 of 13Required

0 of 3 done

Plan the role

Workforce planning and requisition approval

Who runs it: Hiring manager + finance / HR business partner
Done when: An approved requisition with a written business case, budget and a named decision-maker.

Key tool

Answer these before the role is approved

1Which products, customer groups and parts of the rulebook will this person be accountable for in their first year?
2What evidence do we have today that our key controls work, beyond the fact that they are written down?
3Could someone in operations or internal audit move into this seat with training and support?

AI as an advantage4D framework

Delegate: Hand AI the first draft of the business case and the build / borrow / buy comparison. The decision, the budget and the sign-off stay with people.

Show the prompt and the checks

Describe: You are helping a hiring manager write a business case for a Compliance Officer role. Context: I will paste the problem the hire solves, the work it involves, the capacity we already have and the time we have. Produce: (1) a one-sentence problem statement in business terms; (2) a build / borrow / buy comparison with the strongest argument for each; (3) the questions a finance partner would ask; and (4) a short recommendation with the evidence it rests on. Use British English and plain language. Do not invent figures — leave [brackets] where I need to supply numbers. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check every number and claim against your own notes and strike anything the draft assumed. Make sure 'buy' is argued from ongoing work, not from a job title.
Diligence: The hiring manager owns the final case and the budget request. No candidate information belongs here; AI drafts the case, people decide whether to open the role.

Don't miss: Opening the role only to clear an alert backlog, with no plan for the control and policy work that stops the backlog returning.

Framework

Build · Borrow · Buy

Before opening a role, decide whether to build the capability in your current team, borrow it (contractor, agency, partner), or buy it (a permanent hire).

Write the problem the hire solves in one sentence, in business terms — not the job title.
Test Build: could an existing person grow into this within the time you have?
Test Borrow: is the need time-boxed, or does it end once a system is shipped?
Choose Buy only when the work is ongoing, core to the product and nobody inside can absorb it.
Record the decision, the budget and the one person who signs off the final hire.

Why it works: Writing the build, borrow or buy decision down exposes a vague or temporary need before it becomes a permanent requisition — and gives every later stage an anchor to check against.

• Name the decision-maker and confirm the role reports into compliance, not into the business line it oversees.

Is this a dedicated role?

Decide whether the work is sustained and substantial enough for a dedicated owner by writing down the workload, the risk, the capacity you already have and the outcomes you expect.

Answer these before the role is approved

1.Which products, customer groups and parts of the rulebook will this person be accountable for in their first year?
Listen for: Named products and obligations, such as onboarding checks for business customers or monitoring of card payments.
Red flag: 'General compliance support' with nothing anyone could test.
2.What evidence do we have today that our key controls work, beyond the fact that they are written down?
Listen for: An honest answer. If nobody can point to recent testing, that gap is a large part of the job.
3.Could someone in operations or internal audit move into this seat with training and support?
Listen for: A named internal option with a credible development plan, or a clear reason why none fits.
4.Is the need ongoing, or tied to a single remediation project or inspection?
Listen for: Ongoing casework, testing and advice justify a permanent hire; a time-boxed remediation may suit contractors.
Red flag: A permanent role created to clear a one-off backlog, with no plan for the work after it.
5.What happens if this seat stays empty for another quarter?
Listen for: A concrete consequence: alerts ageing past the firm's own review deadlines, untested controls, or a business line launching without compliance input.

Build, borrow or buy?

Build: move a strong operations or audit analyst into the role with a mentor in compliance and a protected study budget.
Borrow: bring in an interim compliance contractor to clear a backlog or run a testing programme, with a hand-over plan.
Buy: hire a permanent compliance officer when casework, testing and business advice all need a continuous owner.

Watch out for

Placing the role under a sales or product head, which undermines the independence the job depends on.

Stage 2 of 13Required

0 of 2 done

Agree success

Intake meeting and competency model

Who runs it: Recruiter + hiring manager
Done when: A signed-off competency model: 5–7 competencies, each marked must-have or trainable, with weights.

Key tool

Ask the hiring manager

1Which of the systems or areas this person will own worries you most, and why?
2When something there went wrong recently, how did you find out?
3In 12 months, what will be shipped, fixed or running for you to call this hire a success? Agree two or three measurable outcomes.
4Who will they work with most closely?
5What could a strong candidate learn in their first three months? Those capabilities are 'trainable' — never use them to filter applications.

AI as an advantageAI boost4D framework

Delegate: Hand AI your raw intake notes to turn into a draft competency model. Choosing the must-haves and the weights stays with the hiring manager and recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter and a hiring manager build a competency model for a Compliance Officer role. Context: I will paste the notes from our intake meeting, including the 12-month outcomes and what the hiring manager worries about most. Produce a table of 5–7 observable competencies with, for each: a one-line definition; whether it is a must-have or trainable, with the reason; what evidence of it looks like in real work; and a suggested weight so the weights total 100. Use British English and inclusive wording, avoid years-of-experience or named employers as evidence, and keep every competency job-related. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that each competency is observable and job-related, that nothing describes a type of person rather than the work, and that trainable items haven't been marked must-have.
Diligence: The hiring manager signs off the final model and weights before anyone meets a candidate. No candidate data goes into the prompt; AI drafts, people decide.

Don't miss: Building the competency model from a list of certifications instead of the casework, control and escalation work the seat really involves.

Framework

Competency model (must-have vs trainable)

A short list of the observable capabilities the job needs, split into what the hire must bring on day one and what you will teach.

Start from the 12-month outcomes, then ask which capabilities produce them.
Keep 5–7 competencies. With more, interviewers struggle to score each one separately.
Mark each must-have or trainable. Only must-haves can count against a candidate.
Give each a weight so they sum to 100, agreed before anyone meets a candidate.
Write what evidence of each looks like, so interviewers know what they are listening for.

Why it works: Agreeing the criteria before meeting candidates stops the bar moving from one candidate to the next, and makes it harder for 'I'll know it when I see it' to decide the hire.

Core intake questions (ask for every role)

Book 45 minutes with the hiring manager before anything is advertised, and write the answers down.
Which of the systems or areas this person will own worries you most, and why?
When something there went wrong recently, how did you find out?
In 12 months, what will be shipped, fixed or running for you to call this hire a success? Agree two or three measurable outcomes.
Who will they work with most closely?
What could a strong candidate learn in their first three months? Those capabilities are 'trainable' — never use them to filter applications.
Who is on the interview panel, and is their time held for the next four to six weeks?

Questions specific to this role

1.Does this seat cover financial crime, conduct and customer-treatment rules, or both, and which matters more in the first year?
Listen for: A clear split, so the work sample and interview weights match the real job.
2.Does the applicable regulator require the holder of this role to be approved, registered or certified, and who in the firm handles that?
Listen for: A definite answer, or a named owner who will find out before the advert goes live.
3.When this person finds a breach, who do they take it to, and can they reach the board or its committees without going through the business?
Listen for: A named escalation route that does not depend on the goodwill of the business line being overseen.

What success looks like in 12 months

The alert queue is worked within the firm's own deadlines, and every closed alert has a file note a reviewer can follow.
Each key control in their area has been tested at least once, with findings reported and fixes tracked to closure.
At least one policy has been rewritten so the controls it describes can actually be checked.
Business teams bring new products and changes to compliance early, because the advice they get is clear and practical.

Stage 3 of 13Required

0 of 3 done

Write the job

Job description and pay band

Who runs it: Hiring manager (content) + recruiter (publishing)
Done when: A published job description that states outcomes, the must-haves, how AI tools are used and the pay information the law requires.

Key tool

Compliance Officer

We're looking for a compliance officer to help [company] meet the rules that apply to our [products / customer base] and show that we do. You'll turn requirements into policies and controls teams can follow, test whether those controls work, work customer due diligence and transaction-monitoring alerts through to a recorded decision, escalate issues on time, and advise the business on how to do what it needs within the rules.

What you'll do

•Translate the applicable rules and the firm's risk assessment into clear policies and controls, each with an owner, a timing and a record that proves it ran.
•Plan and run tests of key controls, report what you find with the root cause, and follow fixes through to closure.
•Review customer due diligence and transaction-monitoring alerts, decide whether to close, investigate or escalate, and write a file note for each decision.
•Assess possible breaches and incidents with the right colleagues, escalate them through the agreed route, and keep a record of the decision and its reasons.
•Track new rules and guidance, work out what they change for the firm, and see the changes through.
•Advise business teams on new products and changes, and run practical training for the staff who apply the controls.

What you need

•You can show a control you designed or improved, and how anyone could check it ran.
•You can work a monitoring or due-diligence alert to a decision and write a file note another reviewer could follow.
•You can explain when an issue must be escalated, and you have done so when it was uncomfortable.
•You can explain a compliance requirement to a non-specialist in plain language and offer a workable option.

Nice to have

•Experience running a regulatory change process from a new rule to an implemented change.
•A background in financial-crime operations, internal audit or a regulator, not only in a compliance team.
•A relevant professional compliance qualification, or progress towards one.
•Experience in more than one product area, such as payments and lending.

How we use AI tools

•You may use the firm's approved AI tools to draft policy wording, summarise a long guidance document or structure a file note, and you check every output against the source text before relying on it.
•You never put customer, case or confidential material into a tool that has not been approved for that data.
•Decisions to close, escalate or report stay with you and the people accountable under the firm's procedures; a tool can help you prepare, not decide.

Pay

Salary range: [currency, minimum–maximum], plus [equity/bonus/benefits]. The range reflects [location/working pattern]. We place every offer within it using the same pre-set, job-related, gender-neutral factors — seniority and depth of casework or control-testing experience, whether the seat requires regulatory approval, registration or certification, breadth of products and rule areas the role covers — never previous salary or negotiating style.

AI as an advantageAI boost4D framework

Delegate: Hand AI the first draft of the job description from your signed-off competency model. The must-haves, the pay range and the final wording stay with people.

Show the prompt and the checks

Describe: You are helping write an outcome-based job description for a Compliance Officer role. Context: I will paste the competency model (must-have and trainable, with evidence), the 12-month outcomes, how the team uses AI tools, the location and working pattern, and the pay range. Produce: a summary paragraph that leads with the problem and what the hire will own; 'What you'll do' as outcomes, not tasks; 'What you need' containing only the must-haves; 'Nice to have' for the trainable items; 'How we use AI tools'; and a pay section that states the range. Use British English and inclusive, gender-neutral wording, avoid hype, and replace any 'X years' with the capability it stands for. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that 'What you need' contains only the must-haves, that no degree, employer or years requirement crept in, and that the pay range and location are exactly what was approved.
Diligence: The hiring manager owns the content and the recruiter owns publishing, including the pay information the law requires for each location. AI drafts the advert; people decide what it says.

Don't miss: Demanding a long list of named qualifications. Applied judgement on a real alert or control matters more, and a qualification can be gained on the job.

Stage 4 of 13Optional

0 of 3 done

Find candidates

Sourcing strategy

Who runs it: Recruiter / sourcer
Done when: A shortlist-ready pipeline from at least three channels, with outreach tracked.

Use when:: Inbound applications won't give you enough qualified candidates.
Skip when:: Your shortlist already comes from inbound applications or referrals.

Key tool

Search query

("compliance officer" OR "compliance analyst" OR "financial crime" OR "compliance monitoring") AND ("transaction monitoring" OR "due diligence" OR "control testing" OR "regulatory change") AND (bank OR payments OR lending OR insurance OR "asset management") NOT (intern OR student)

First outreach message

AI as an advantageAI boost4D framework

Delegate: Hand AI the search queries and the first draft of the outreach template. Choosing channels, personalising to a candidate's public work and sending stay with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter source candidates for a Compliance Officer role. Context: I will paste the must-have competencies, the kind of work we want evidence of, the channels we are using and the pay range. Produce: (1) one search query per channel, using OR for alternatives, AND for things that must all appear and NOT to exclude, with a one-line note on what each query looks for; and (2) a first-outreach template of under 120 words that opens with a [placeholder for something the candidate built], states the problem we are hiring to solve and the pay range, and ends with a low-pressure question. Use British English and inclusive wording. Do not refer to any specific person. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the queries search for evidence of the work rather than job titles alone, and that the template claims nothing about the role or the pay you can't back up.
Diligence: The recruiter personalises every message to something the candidate actually built, and sends it. No names or profile data go into the prompt; AI drafts, people decide whom to contact.

Don't miss: Searching only for the exact title 'Compliance Officer', which misses analysts and investigators already doing the work under other names.

Framework

Channel mix + evidence-first outreach

Spread sourcing across channels where the work is visible, and open outreach with the problem, not the perks.

Pick channels where candidates show their work, not only where they list job titles.
Write one search query per channel. OR joins alternatives, AND joins things that must all appear, NOT excludes. Keep the version that works best.
Personalise the first line to something the candidate actually built or wrote.
Lead with the problem and the pay range. Save the perks for later.
Track reply rates by channel each week and drop the channel that isn't working.

Why it works: Searching for evidence of the work can surface candidates whose current title differs from the vacancy, or whose CV undersells what they have done.

Sourcing basics

Adapt the search query for each platform — the same words behave differently on each site.
Candidates with adjacent titles may have relevant evidence. Search for the work and outcomes the role needs, not the current title.
Channel activity is a lead, not evidence. Review linked work and examples against the written competencies.

Where to look

Financial-crime operations and investigations teams

Investigators and senior analysts already work alerts and write file notes; many are ready for the control and advisory side of the role.

Compliance monitoring and internal audit teams

People who test controls for a living bring the testing discipline this seat needs and know what weak evidence looks like.

Professional compliance and financial-crime associations

Members often publish articles or speak at events, which gives you reviewable evidence of how they think about real cases.

Referrals from your own compliance, risk and audit staff

Colleagues who have reviewed a candidate's casework can say how they handled a difficult call, not just that they were pleasant to work with.

Career sites and job boards for banking, payments and insurance

Titles vary widely between firms; searching profiles for monitoring, due diligence and testing finds people a title search misses.

Boolean search string

("compliance officer" OR "compliance analyst" OR "financial crime" OR "compliance monitoring") AND ("transaction monitoring" OR "due diligence" OR "control testing" OR "regulatory change") AND (bank OR payments OR lending OR insurance OR "asset management") NOT (intern OR student)

First outreach message

Hi [name], I noticed your work on [specific area, such as transaction monitoring for business accounts or control testing in payments]. We're a [firm type] hiring a compliance officer to own alert decisions, control testing and advice to the business across [products], paying [range]. The work is hands-on and reports into compliance, with a direct route to [committee]. Would you be open to a 20-minute call to hear more?

Stage 5 of 13Required

0 of 3 done

Check applications

Application screening

Who runs it: Recruiter
Done when: Every application reviewed against the same written knockouts within five working days.

Key tool

Reject only if one of these is missing

•Can meet the role's work-authorisation requirements by the start date, with sponsorship where the employer offers it. Don't ask for documents at this stage.
•Shows hands-on work in compliance, financial-crime operations, compliance monitoring or internal audit of compliance, not only training courses.
•Describes at least one control, investigation, test or policy they personally worked on, with what they did.

AI as an advantage4D framework

Delegate: Hand AI the job of turning your written knockouts into a consistent checklist with reason codes. Reviewing each application stays with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter prepare an application-screening checklist for a Compliance Officer role. Context: I will paste the must-have competencies and our written knockout criteria. Produce: (1) each knockout as a yes/no question answerable from an application alone; (2) a short list of reason codes for a 'no'; and (3) a note of any criterion that looks like a proxy — a degree, employer brand or employment gap — rather than a job-related requirement, with a suggested rewrite. Use British English. Do not evaluate any applicant and do not ask for applicant details. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that each question is binary and job-related, and that every flagged proxy has been removed or justified in writing.
Diligence: A person reviews every application against the checklist and records the reason. Never paste CVs or applicant details into an AI tool, and never let a tool screen anyone out — in New York City and the EU that can bring automated-decision rules into play.

Don't miss: Treating a compliance qualification on the CV as proof of judgement; it shows study, while the work sample shows practice.

Framework

Knockout criteria

A small set of yes/no requirements, written in advance, applied to every applicant the same way.

Derive knockouts only from must-have competencies and genuine legal requirements.
Keep them binary and answerable from the application itself.
Apply them in the same order to every application and log the reason for each rejection.
Do not use proxies such as university, employer brand or employment gaps as knockouts.
Anything ambiguous gets a second review or moves forward to the skills stage.

Why it works: Early screening rejects people before richer evidence exists, so its criteria need the most care. Written criteria make decisions reviewable — but each one must also be job-related, applied consistently and checked for unjustified adverse impact.

Screening rules

Do not use degrees, employment gaps or certifications as filters unless they are demonstrably job-related and justified for this role.
Judge the claims in a CV, not how polished it is — a well-written CV may or may not have had AI help, and either way it is the evidence that matters.

Knockout criteria

Can meet the role's work-authorisation requirements by the start date, with sponsorship where the employer offers it. Don't ask for documents at this stage.
Shows hands-on work in compliance, financial-crime operations, compliance monitoring or internal audit of compliance, not only training courses.
Describes at least one control, investigation, test or policy they personally worked on, with what they did.

Green flags

Names a control they tested and what changed because of the finding.
Mentions writing or reviewing file notes, case decisions or breach records.
Shows work across both the casework side and the policy or control side of compliance.

Red flags

Lists rules and qualifications at length with no sign of applying them to a real case or control.
Describes compliance only as approving or blocking requests, with no example of offering an alternative.
Claims to have 'ensured full compliance', which no compliance officer can honestly promise.

Compliance checkpointNew York CityEU

For a New York City employment decision, work out whether a tool is an 'automated employment decision tool' (AEDT) under Local Law 144 — one that uses covered techniques to substantially assist or replace a discretionary decision. Before using a covered tool, make sure an independent bias audit was completed no more than a year earlier, publish the required summary, and give covered candidates or employees the required notice at least ten business days before use. In the EU, the AI Act (Annex III) lists AI used to recruit, filter applications or evaluate candidates as high-risk, subject to the Article 6(3) exception; the related obligations apply from 2 December 2027 under the amended timetable. A manual screen does not exempt an AI tool used elsewhere in the process.

Sources: NYC DCWP — Automated employment decision tools · EU AI Act — consolidated Regulation (EU) 2024/1689 · checked 2026-09-25

Stage 6 of 13Optional

0 of 2 done

Recruiter call

Recruiter screen

Who runs it: Recruiter
Done when: A 20–30 minute call that confirms logistics, motivation and one or two must-have signals.

Use when:: You are hiring at volume, or pay and logistics need confirming early.
Skip when:: You have only a handful of applicants — fold the pay and logistics questions into application screening instead.

Key tool

Ask every candidate, in this order

1Walk me through the kind of alerts or cases you worked most recently. What did a typical decision look like?
2Have you tested a control yourself, or designed one? Briefly, what was it?
3Which product areas and types of rules have you worked with hands-on?
4This role reports into compliance and sometimes has to tell business heads things they do not want to hear. How does that sit with the way you like to work?
5Our range for this role is [range]. Does that work for you?

AI as an advantage4D framework

Delegate: Hand AI the first draft of the screening-call script and its evidence anchors. Running the call and taking the notes stay with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter write a 20–30 minute structured screening call for a Compliance Officer role. Context: I will paste the must-have competencies, the logistics we need to confirm (location, working pattern, notice period) and the pay range. Produce: an opening that explains the process, the timeline and the pay range; 4–6 questions in a fixed order, each with one line on what a strong answer contains; and a closing that asks whether the published range works. Use British English and inclusive wording. Do not include questions about salary history, age, family, health or any other protected characteristic. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that every question is job-related and lawful, that the pay question asks whether the range works rather than for history, and that the anchors describe evidence, not impressions.
Diligence: The recruiter asks the same questions of everyone and writes the notes. No candidate details go into the prompt; AI drafts the script, people run the call and decide.

Don't miss: Asking the recruiter to judge whether a candidate's reading of a rule is correct. That belongs in the controls round; this call checks logistics and fit with the scope.

Framework

Structured screening call

The same short set of questions for every candidate, with notes taken against what a strong answer contains.

Open by explaining the process, timeline and pay range. No surprises later.
Confirm logistics: location, working pattern, notice period and whether the range works for them.
Ask the same 4–6 questions in the same order, and note evidence, not impressions.
Leave time for the candidate's questions. Don't score their questions unless they test a written, job-related competency.
Decide within 48 hours and tell the candidate either way.

Why it works: Using the same questions and written evidence anchors makes answers easier to compare, and a short, predictable call respects the candidate's time.

Screening call basics

Set the decision timetable before sourcing and tell candidates when to expect each update.
Ask every candidate what draws them to this particular role, and listen for interest in the work described rather than the title.
Confirm notice period and whether they are in other processes, so you can plan the timetable.
End every call by asking whether the published pay range works — never ask for salary history.

Recruiter screen questions

1.Walk me through the kind of alerts or cases you worked most recently. What did a typical decision look like?
Listen for: Specific alert types, the decision options and the candidate's own part in reaching them.
Red flag: Speaks only about the team's numbers and cannot describe one decision they made.
2.Have you tested a control yourself, or designed one? Briefly, what was it?
Listen for: A named control and a plain description of how it was tested or built, so the panel knows where to probe.
3.Which product areas and types of rules have you worked with hands-on?
Listen for: Areas tied to real work, such as onboarding checks for business customers or monitoring of card payments, rather than a list of every topic.
4.This role reports into compliance and sometimes has to tell business heads things they do not want to hear. How does that sit with the way you like to work?
Listen for: A candid answer about independence and difficult conversations, without bravado.
Red flag: Says they would prefer to leave escalation to someone more senior in every case.
5.Our range for this role is [range]. Does that work for you?
Listen for: A clear answer on whether the published range works. Don't ask for salary history — this process sets pay from the published band and pre-set, job-related factors.

Compliance checkpointUS (state and city)EU

Don't ask for salary history. In the EU, national laws implementing Article 5(2) of Directive (EU) 2023/970 must prohibit the question. US rules vary, but jurisdictions including California and New York prohibit employers from seeking salary history. Ask whether the published range works instead.

Sources: EU Pay Transparency Directive 2023/970, Article 5 · California Labor Commissioner — salary history · New York State DOL — salary history ban · checked 2026-09-25

Stage 7 of 13Required

0 of 2 done

Work sample

Skills assessment / work sample

Who runs it: Hiring manager (design) + recruiter (logistics)
Done when: Every shortlisted candidate completes the same job-shaped task, marked against criteria written in advance.

Key tool

Work a monitoring review: triage six alerts, fix a policy gap and answer the business

Plan on 75 minutes, written. Everything in this pack is fictional: the firm, the customers, the names and the figures. No real customer data is used. Amounts are in a fictional currency shown as 'units'. You are a compliance officer at Larkfield Payments, a small firm offering business and personal current accounts. Its internal cash review level is 10,000 units. It is your Monday monitoring review. ALERT 1: Customer A, a sole trader running a café, expected mainly card takings. Last week: four cash deposits of 9,600, 9,800, 9,700 and 9,900 units at three different branches over five days. ALERT 2: Customer B, a retired individual. One incoming transfer of 182,000 units from a property lawyer's client account. The branch note says she sold her flat; a sale completion statement is on file. ALERT 3: Customer C, an import-export company onboarded four months ago. Three round-sum payments of 25,000 units to a newly added overseas beneficiary with no link to its stated trade. The ownership record lists a nominee director, and the customer's due-diligence refresh is overdue. ALERT 3 EVIDENCE PACK: (a) onboarding file: stated trade is importing kitchen equipment from two named suppliers; expected monthly outgoing payments around 40,000 units; risk rating medium; one owner recorded, holding all shares through the nominee director; (b) payment records: before these three payments, every outgoing payment went to the two named suppliers; the new beneficiary was added online eight days ago, and the payment references read 'consultancy'; (c) the relationship manager's note: 'Customer says they are expanding into a new market; will send a contract'; no contract is on file; (d) a public company-registry search for the new beneficiary returned no result. You may not contact the customer during the exercise. ALERT 4: Customer D, a student account. Over ten days, 31 incoming transfers of 150 to 400 units from different senders, each moved out the same day to a single account at another firm. ALERT 5: Customer E. Name screening returned a partial match to a sanctions-list entry; the listed person is 20 years older and of a different nationality. ALERT 6: Customer F, a registered charity. A payment rule fired because a monthly grant of 5,000 units was paid twice; the charity's finance team has already recalled the duplicate. POLICY EXTRACT: 'Enhanced due diligence. Before opening an account for a customer the firm rates as high risk, staff must obtain evidence of the source of funds and approval from a senior manager. High-risk relationships are reviewed every year.' ONBOARDING RULE (firm procedure): a business account may not send or receive payments until the firm has verified the business, identified every person who owns or controls it and verified their identity. The only permitted exception: a compliance officer may allow the account to receive card takings, with outgoing payments blocked, for up to 10 working days while ownership checks finish, if the business has a simple structure and the outstanding item is recorded. BUSINESS REQUEST, from the head of small-business accounts: 'We are losing new merchants because account opening takes too long. Can we let new business customers start trading straight away and collect their ownership documents within 30 days?'

Planned for up to three hours (adjustments available on request). At the agreed stopping time, write a short note on what you would examine next, and what you deliberately left out.

AI as an advantage4D framework

Delegate: Hand AI the first draft of the work-sample brief and its marking sheet. Choosing the task, setting the timebox and marking stay with the hiring manager.

Show the prompt and the checks

Describe: You are helping a hiring manager design a work sample for a Compliance Officer role. Context: I will paste the competency model, a real problem the team solved recently with anything confidential removed, the timebox, and our AI-tool policy for candidates. Produce: a candidate-facing brief (what to do, what to hand in, the time cap, how to request an adjustment, which AI tools are allowed and how to report their use); and a marking sheet with 4–6 criteria tied to named competencies, each with what a 1, a 3 and a 5 look like. Use British English and plain, inclusive wording. Do not design anything that needs more than the stated time. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the task fits the timebox, that every criterion maps to a competency, and that the brief gives all candidates the same starting materials.
Diligence: The hiring manager owns the task and the criteria, and people mark every submission. Do not paste candidate submissions into an AI tool for scoring; AI drafts the brief, people mark and decide.

H-EvaluateH-Evaluate can generate a job-specific assessment from your job description, so you don't have to build the task by hand.How H-Evaluate helps →

Don't miss: Using real customer files or real alerts, even redacted. The pack must be fictional from end to end.

Framework

Work-sample test

A small, realistic slice of the job, marked against criteria written in advance. Give candidates equivalent materials and arrange reasonable adjustments where required.

Take a real problem the team solved recently and shrink it to fit the timebox.
Write the marking criteria first, tied to the competency model.
Timebox honestly — for take-home work, a few hours at most — and say so in the brief.
State the AI-tool policy in writing. Where the job permits these tools, use equivalent conditions in the assessment and evaluate how candidates verify their output.
Mark without CV details where you can, and have two people mark borderline submissions.

Why it works: A well-designed work sample gives direct evidence of job-relevant skill rather than a proxy for it, and gives candidates a realistic preview of the work.

Assessment rules for every candidate

State the planned time cap and how to request an adjustment. At the agreed stopping time, ask candidates to note what they would examine next and what they left out — never reward unpaid overtime.
Give every candidate the same starting materials, and use a second marker for borderline submissions.
Say in writing which AI tools are allowed and ask candidates to tell you how they used them.
Invite every candidate to ask for adjustments, and answer each request promptly.
Pay for anything the task costs the candidate to run, such as model or cloud usage.

The work sample

Work a monitoring review: triage six alerts, fix a policy gap and answer the business

Timebox: Planned for up to three hours (adjustments available on request). At the agreed stopping time, write a short note on what you would examine next, and what you deliberately left out.

What the candidate hands in

A triage table for the six alerts: close, investigate or escalate, each with a one- or two-line reason and what you would check next.
A file note for Alert 3, written as it would sit on the case record, using only the evidence pack and keeping known facts apart from the checks you propose.
The gap you see in the policy extract, why it matters, your redrafted wording, and the control that would put it into practice: its owner, what triggers it, the evidence it records and how you would test that it operated.
A reply to the head of small-business accounts of no more than 200 words.

Marking criteria (write these first)

The triage separates alerts that can be closed with a recorded reason from those that need more work, and does not close a suspicious pattern on the customer's word alone.
Each reason names the specific fact that drives the decision, such as the deposit pattern against the café's expected takings.
The file note states what triggered the alert, which items in the evidence pack were relied on, what remains unknown, the decision, and the next step and its owner, without inventing evidence.
The policy gap is identified precisely, such as the extract covering only onboarding and saying nothing about customers who become high risk later, and the redraft can be tested.
Translating rules into policies and controls: the proposed control names an owner, a trigger and the evidence it records. Control monitoring and testing: the test says what sample is drawn and what counts as a pass or an exception.
The reply to the business explains the risk in plain terms, uses the firm's onboarding rule and its one permitted exception accurately, and offers at least one workable option within the rules and the firm's risk appetite.
Nothing in the submission promises an outcome a compliance function cannot guarantee, and nothing assumes a specific country's law without saying so.

Adjustments: Candidates can ask for extra time, a screen-reader-friendly version of the pack, or a talked-through version with an interviewer taking notes. The pack can be shared in advance on request, on the same terms for everyone.

Watch out for

Marking down a candidate who escalates an alert you would have investigated first, if their reasoning is sound and recorded; the test is the judgement and the note, not matching one answer.

Compliance checkpointUSGreat BritainEU

In the US, covered employers must provide a reasonable accommodation to a qualified applicant with a disability unless it would cause undue hardship (ADA). In Great Britain, the Equality Act 2010 requires reasonable adjustments in recruitment. In the EU, the duty comes from national equality law. Don't ask for more medical information than the law allows.

Sources: EEOC — prohibited practices · Equality Act 2010 · checked 2026-09-25

Stage 8 of 13Required

0 of 3 done

Structured interviews

Structured interview loop

Who runs it: Interview panel (named in advance)
Done when: Every competency has a lead interviewer and at least one second source of evidence, with the same questions for every candidate.

Key tool

Interview questions by pillar

Free in this kit: Domain questions for every round. The other three pillars and the AI-fluency check are measured by H-Evaluate.

Free in this kit

The head of financial crime, or the officer responsible for internal suspicious-activity reports · Due diligence and red-flag judgement · Alert investigation and file notes

1.Take the alert from your work sample that you were least sure how to triage. What fact would have moved it into a different bucket, and what would you check first if it landed on your desk on Monday?
Due diligence and red-flag judgement
Good answerNames the deciding fact, explains which alternative reading it rules out, and picks a first check that would genuinely change the decision, such as the customer's expected activity or the counterparty's details.
Weak answerRestates the original decision without considering what would change it, or proposes checks that could not alter the outcome.
2.A business customer's ownership record shows a company in another country as its sole owner, and nobody has recorded who owns that company. The relationship manager says the customer is long-standing and low risk. How do you decide what due diligence is enough, and what would you ask for?
Due diligence and red-flag judgement
Good answerTraces ownership through to the people who ultimately own or control the customer, sets the depth by risk, asks for evidence from independent sources, and reconsiders the risk rating rather than inheriting it.
Weak answerAccepts the relationship manager's view because of the customer's tenure, or asks for every possible document regardless of risk.
3.You have closed an alert as not suspicious. A year and a half later an internal reviewer who never met the customer reads your file note. What must be in it for them to reach the same conclusion without calling you?
Alert investigation and file notes
Good answerLists the trigger, the checks made and their sources, the customer's explanation and how it was corroborated, the reasoning against each red flag, the decision, the date and who made it, keeping facts apart from opinion.
Weak answerSomething like 'explanation satisfactory, alert closed', with no sources or reasoning.

Optional follow-ups (1)

4.One of your monitoring rules produces dozens of alerts a week, and nearly every one closes as a false positive. How would you decide whether to retune it, and what would you need to show before changing it?
Alert investigation and file notes
Good answerReviews a sample of closed alerts, checks what risk the rule is meant to catch and whether real cases would be missed, proposes a change with that evidence, gets it approved and watches the results afterwards.
Weak answerRaises the threshold to cut the volume, without asking what the rule is there to detect.

AI as an advantageAI boost4D framework

Delegate: Hand AI the drafting of probe questions and strong / weak anchors for one competency. Asking, listening and scoring stay with the interviewer.

Show the prompt and the checks

Describe: You are helping an interviewer prepare a structured technical interview for a Compliance Officer role. Context: I will paste one competency, its evidence description and the core question we ask every candidate. Produce: four probes in this fixed order — what would you do, why that choice, what else did you consider, how would you know it worked — tailored to the question; a one-line description of a strong answer and of a weak answer; and two follow-ups to use only if time allows. Use British English and inclusive wording. Keep everything about the work, nothing about the person. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the probes test the named competency rather than trivia, that the anchors describe observable evidence, and that no question touches a protected characteristic.
Diligence: Interviewers ask the same core questions of every candidate and score alone against the rubric. Interview notes and candidate names never go into an AI tool; AI drafts the questions, people interview and decide.

H-EvaluateH-Evaluate can add evidence on Cognitive, Situational judgement, Behavioural and AI fluency for your panel to review alongside these interviews.How H-Evaluate helps →

Don't miss: Letting the business-line head on the final panel score the candidate on whether they would approve the business's requests; score whether the advice was clear, practical and still compliant.

Framework

Structured technical interview

Every candidate gets the same job-specific questions, each interviewer leads on specific competencies, and every answer is probed with the same four follow-ups: what would you do, why, what else did you consider, and how would you know it worked.

Give each competency a lead interviewer, plus a second source of evidence — the work sample, another round or an independent marker. Avoid asking the same thing twice, but never let one person's view be the only evidence for a critical competency.
Ask the three core questions for your round, in order, for every candidate. Use an optional follow-up only if there is time.
Probe each answer: why that choice, what else they considered, and how they would know it worked — until you hear the candidate's own technical decision.
Take notes on evidence during the interview. Don't rate until it's over.
Fill in your interviewer sheet and submit it before you talk to any other interviewer.

Why it works: Structured interviews make answers comparable: every candidate faces the same job-related questions and is scored against the same anchors.

Interview rules

Use the same core questions in the same order for every candidate.
In the work-sample review, understand the candidate's decisions against the rubric — don't turn it into a debate about your preferred solution.
Avoid trivia disconnected from a real job decision. Use a realistic debugging, design or evaluation problem instead.

Compliance checkpointUSUKEU

Don't ask about protected characteristics — such as age, disability, pregnancy or family plans, religion, race or nationality — unless applicable law permits the question for a specific, necessary, job-related purpose, and HR or counsel has confirmed that basis beforehand. Ask only whether the candidate can meet the role's work-authorisation requirements. If a candidate volunteers protected information, don't probe; record only what is lawfully needed, keep it separate and restrict access.

Sources: EEOC — prohibited practices · Equality Act 2010 · checked 2026-09-25

Where to find more interview questions

Use web question banks for inspiration only: ask every candidate the same job-related questions, check each one against this kit's competencies, and never ask about protected characteristics. Don't reuse this kit's work sample from a public bank — candidates can find questions that circulate online, so a widely posted question tests preparation more than skill.

Show 4 sites

US OPM — Structured interviews(opens in a new tab)
US federal guidance on building structured interviews, with a guide, training material and sample questions with rating scales.
FreeFor interviewers
Acas — Interviewing job applicants(opens in a new tab)
UK public guidance on preparing fair interviews, asking applicants the same questions and avoiding discriminatory ones.
FreeFor interviewers
Workable — Interview questions library(opens in a new tab)
Sample interview questions for employers, listed by job role, including machine learning, data and engineering roles.
FreeFor interviewers
Indeed for Employers — Interview questions(opens in a new tab)
Sample interview questions for employers by job title and skill, with notes on what to look for in answers.
FreeFor interviewers

Links checked 2026-10-05. External sites; we don't control their content.

Stage 9 of 13Required

0 of 1 done

Compare evidence

Scoring, calibration and debrief

Who runs it: Hiring manager (chairs) + panel
Done when: A documented hire / no-hire decision traceable to scored evidence against the competency model.

Key tool

Interactive scorecard

Score one candidate against the rubric. Everything stays in your browser. Download it as a spreadsheet for your records.

Translating rules into policies and controls Must-have

Weight

What do 1, 3 and 5 look like?

1: Restates requirements as policy text with no owner, timing or record.
3: Writes a workable control when asked, though the evidence or exception route is sometimes vague.
5: Turns a requirement into a control with an owner, a trigger, an evidence standard and a record, and prefers built-in checks to reminders.

Control monitoring and testing Must-have

Weight

What do 1, 3 and 5 look like?

1: Checks that a procedure exists rather than whether it operated.
3: Designs a reasonable sample test, though root cause and follow-up are thin.
5: Tests operation on a well-chosen sample, follows up every exception, reports the root cause and re-tests the fix.

Due diligence and red-flag judgement Must-have

Weight

What do 1, 3 and 5 look like?

1: Treats every alert alike, or accepts a customer's explanation without corroboration.
3: Spots the obvious red flags and sets a sensible level of due diligence, but misses subtler patterns.
5: Reads profile and activity together, picks out what is unusual for this customer, and sets due diligence by risk.

Alert investigation and file notes Must-have

Weight

What do 1, 3 and 5 look like?

1: Reaches decisions without recorded sources or reasoning.
3: Writes a usable file note that covers the main facts, though a reviewer would still have questions.
5: Writes a note a reviewer can follow alone: trigger, checks, sources, unknowns, reasoning, decision and next step.

Breach and escalation judgement Must-have

Weight

What do 1, 3 and 5 look like?

1: Escalates late or not at all, or acts alone on whether to report.
3: Escalates through the right route, though containment or the record of the decision is incomplete.
5: Contains the issue, establishes the facts, involves the right people, escalates on time under pressure and records why.

Advising and training the business Must-have

Weight

What do 1, 3 and 5 look like?

1: Answers requests with a bare yes or no, in technical language.
3: Gives clear advice and sometimes offers an alternative route.
5: Explains the risk in the business's terms, offers a compliant option and designs training that changes behaviour.

Regulatory change tracking Can learn

Weight

What do 1, 3 and 5 look like?

1: Relies on others to flag new rules, and stops at a summary.
3: Maps a new requirement to affected policies when asked, though follow-through is patchy.
5: Spots relevant change early, maps it to controls with owners and dates, and confirms with evidence that it was done.

Weighted score– / 5

AI as an advantage4D framework

Delegate: Hand AI the drafting of a blank debrief worksheet and agenda from the competency rubric alone. People add the evidence locally; the scores and the decision stay with the panel.

Show the prompt and the checks

Describe: You are helping a hiring manager prepare a debrief for a Compliance Officer role. Context: I will paste the competency rubric only — the competencies, their weights and their 1, 3 and 5 anchors. Produce: (1) a blank debrief worksheet with one row per competency and empty columns for each interviewer's independent score, the evidence they cite, the spread of scores and an 'evidence gap?' box; (2) a 45-minute agenda: confirm every scorecard is in and reveal all scores at once, discuss the widest spreads using evidence only, review any must-have scored 1, then look at the weighted total and decide (hire, no hire or one targeted follow-up), and record the reasons; and (3) neutral questions the chair can ask to draw out evidence rather than adjectives. Leave every evidence and score cell empty. Do not suggest a score, a rating or a recommendation. Use British English. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the worksheet follows your rubric exactly — same competencies, weights and anchors — and that the agenda keeps independent scores hidden until the reveal.
Diligence: Interviewers fill in the evidence and scores locally, alone, before the debrief, and the panel decides together. Candidate notes and personal data never go into an AI tool; AI never scores, ranks or compares candidates.

H-EvaluateH-Evaluate gives you a report on each candidate's assessment evidence to bring into this debrief.How H-Evaluate helps →

Don't miss: Letting a polished policy redraft carry a candidate whose alert triage closed suspicious activity on the customer's word alone.

Stage 10 of 13Optional

0 of 2 done

Check references

References and background checks

Who runs it: Recruiter (references) + HR (checks)
Done when: At least two references that test specific competencies, plus only the checks that are lawful and relevant to the role.

Use when:: It is lawful where you hire, and specific evidence from a referee would change the decision.
Skip when:: Local law or company policy rules it out.

Key tool

Ask each referee

1When [candidate] escalated something uncomfortable, how did they go about it?
2How did their file notes or test reports hold up when someone else reviewed them?
3How did business teams react to their advice?

AI as an advantage4D framework

Delegate: Hand AI the drafting of reference questions aimed at the competency the panel was least sure about. Choosing referees, making the calls and interpreting the answers stay with the recruiter.

Show the prompt and the checks

Describe: You are helping a recruiter write competency-based reference questions for a Compliance Officer role. Context: I will paste the competency model and the one or two competencies where our evidence is thinnest — no candidate details. Produce: 3–4 questions per competency that ask for specific examples ('tell me about a time…') rather than ratings; an opening question about how the referee worked with the person and for how long; and a closing question about what their next manager could do to help them do their best work. Use British English and inclusive wording. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the questions ask for examples rather than opinions, that they stay on job-related competencies, and that none asks about health, family or other protected matters.
Diligence: References are taken with the candidate's consent and interpreted by people. Referee answers and candidate details never go into an AI tool; AI drafts the questions, people decide.

Don't miss: Accepting a candidate's own description of their regulatory status, or a copy of a certificate, in place of checking the primary source.

Framework

Competency-based referencing

Treat references as a last structured conversation about the candidate's work, aimed at the competencies where your evidence is thinnest.

With the candidate's consent, ask for two people who saw their relevant work directly — ideally a former manager and a peer.
Accept suitable alternatives if a manager or peer isn't available, and never penalise a candidate for a former employer's no-reference policy.
Aim your questions at the one or two competencies the debrief was least sure about.
Ask for examples, not ratings. 'Tell me about a time they…' works here too.
Set the timing of each background check by the law and policy that apply.

Why it works: Generic reference questions tend to produce little job-related evidence. Asking for specific examples tied to the role's competencies turns referencing into something you can use.

Core reference questions and checks

Open with: 'How did you work together, and for how long?' — it tells you how much weight the rest can carry.
Ask: 'Tell me about a time something they owned went wrong. What did they do?'
Close every reference with: 'What should their next manager do to help them do their best work?'
Verify only claims that were material to the decision — don't verify a degree the role never required.
Run criminal-record checks only where the role justifies them and local law allows; many roles don't need one.
Schedule formal work-authorisation checks at the legally required time: before employment starts in the UK; for US Form I-9, Section 1 by the first day of paid work and Section 2 within three business days.

Reference questions specific to this role

1.When [candidate] escalated something uncomfortable, how did they go about it?
Listen for: A specific example of timely, well-routed escalation, handled without drama.
2.How did their file notes or test reports hold up when someone else reviewed them?
Listen for: Confirmation that their records stood up to quality assurance or audit without rework.
3.How did business teams react to their advice?
Listen for: Signs that teams came back for more, because the advice was clear and offered a way forward.

Compliance checkpointUS

If a consumer reporting agency provides a background report, the Fair Credit Reporting Act requires a clear, stand-alone written disclosure and the candidate's written authorisation before you order it. Before rejecting someone because of the report, give them a copy and the FCRA summary of rights and a reasonable opportunity to review and dispute it before any adverse action; if you still reject, send a final adverse-action notice. State and local 'fair chance' laws may delay criminal-history questions or checks until after a conditional offer.

Sources: FTC — Background checks: what employers need to know · FTC — Using consumer reports: what employers need to know · checked 2026-09-25

Stage 11 of 13Required

0 of 2 done

Agree the offer

Offer, negotiation and close

Who runs it: Hiring manager + recruiter
Done when: An accepted written offer within the approved band, with a start date.

Key tool

Build the offer around

•Independence: a clear reporting line into compliance and a direct route to the board or its committees.
•Scope: ownership of real casework, control testing and policy, not only queue work.
•Development: support and study time for a professional qualification relevant to the role.
•Influence: early involvement in new products, so advice shapes the design rather than arriving at the end.

AI as an advantage4D framework

Delegate: Hand AI the first draft of the offer message built around what the candidate said matters to them. The figure, the approval and the conversation stay with the hiring manager.

Show the prompt and the checks

Describe: You are helping a hiring manager draft an offer message for a Compliance Officer role. Context: I will paste three general priority categories (for example: learning, flexibility, scope) — not the candidate's words, notes or personal details; the parts of the offer; and the start-date options — without the salary figure. Produce: a warm, plain-English message that links each part of the offer to one of their priorities, says what happens next and when the written offer follows, and invites questions. Use British English and inclusive wording, and leave [brackets] for figures and names. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that nothing promised is outside policy or the approved band, that every claim about the role is true, and that the message reads as personal rather than templated.
Diligence: The hiring manager places the offer in the band using the same pre-set factors for everyone and makes the verbal offer personally. Figures and personal details are filled in by people, never pasted into AI.

Don't miss: Setting a start date that ignores the time an approval or background check may take, and then pressing the candidate to start early in a reduced role nobody defined.

Framework

Close plan (motivators → offer → objections)

Build the offer around what the candidate told you they care about, anticipate their objections, and make sure the verbal and written offers match.

List the candidate's top three motivators from your notes at every stage.
Make the verbal offer personally, and link each part of it to a motivator.
Ask what else they are weighing and when they have to decide.
Place the offer in the band using the same pre-set, job-related factors for everyone, and record why.
Send the written offer promptly after the verbal one.

Why it works: A close plan ties the offer to the candidate's stated priorities and makes approvals explicit before the final interview.

Offer checklist and negotiation

Stay inside the approved band. If the candidate is worth more, re-level them with evidence rather than stretching the band.
Trade in things that cost less than salary where policy allows: start date, learning budget, working pattern.
Before the written offer, ask: 'What would make this an easy yes?'
Agree approval and the pay band before the final interview, so the offer isn't held up.
The hiring manager makes the verbal offer; the written offer follows within a working day.
Record which pre-set factors placed the offer where it is in the band.
Tell unsuccessful finalists personally, without avoidable delay, with brief feedback.

What will close this candidate

Independence: a clear reporting line into compliance and a direct route to the board or its committees.
Scope: ownership of real casework, control testing and policy, not only queue work.
Development: support and study time for a professional qualification relevant to the role.
Influence: early involvement in new products, so advice shapes the design rather than arriving at the end.

Compliance checkpointEUUS

Use objective, gender-neutral, pre-agreed factors to place candidates within the band, apply them consistently and record the decision as an internal pay-equity control. Check the national law implementing Directive (EU) 2023/970 and any local record-keeping rules; this recommendation is good practice, not a universal statutory documentation rule.

Sources: EU Pay Transparency Directive 2023/970 · checked 2026-09-25

Stage 12 of 13Required

0 of 2 done

Help them settle in

Pre-boarding and 30-60-90 onboarding

Who runs it: Hiring manager + buddy + HR
Done when: A new hire who has worked through a written 30-60-90 plan tied to the 12-month outcomes, with a check-in at each milestone.

Key tool

Before day one
Access to the monitoring and case-management systems, the policy library and the breach log, ready for day one.
Days 1–30: learn
Reads a sample of recent closed alerts and file notes to learn the firm's standards and where they slip.
Days 31–60: contribute
Takes ownership of an alert queue and its file notes, with quality checks on a sample of their decisions.
Days 61–90: own
Reports the first control test with root cause, owners and dates.

AI as an advantage4D framework

Delegate: Hand AI the first draft of the 30-60-90 plan from the 12-month outcomes. Agreeing the plan with the new hire stays with the manager.

Show the prompt and the checks

Describe: You are helping a hiring manager draft a 30-60-90 day onboarding plan for a new Compliance Officer. Context: I will paste the 12-month outcomes from the intake meeting, the systems and people the hire will work with, and anything they will need before day one. Produce: a pre-boarding checklist (equipment, access, a named buddy, a first-week schedule); then three sections — days 1–30 learn, days 31–60 contribute, days 61–90 own — each with 3–4 concrete, checkable expectations and one milestone check-in question. Use British English and plain wording. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that each expectation is realistic for a new starter, ties back to a 12-month outcome, and offers the hire support rather than a test.
Diligence: The manager agrees the plan with the new hire in week one and owns the check-ins. The new hire's personal details stay out of the prompt.

Don't miss: Putting a new compliance officer straight onto the alert queue alone, before they have seen the firm's risk assessment, customer base or past file notes.

Framework

30-60-90 day plan

Three phases — learn, contribute, own — with written expectations for each, agreed with the new hire in week one.

Before day one: equipment, access, a named buddy and a first-week schedule.
Days 1–30, learn: systems, people and the current state of the work.
Days 31–60, contribute: a first scoped piece of work shipped with support.
Days 61–90, own: an area of responsibility with clear outcomes.
Hold a check-in at each milestone against the written plan.

Why it works: Hiring doesn't end at the signature. A written onboarding plan makes expectations and support visible to the new hire and their manager.

Before day one
- Access to the monitoring and case-management systems, the policy library and the breach log, ready for day one.
- The firm's financial-crime and compliance risk assessments, the latest monitoring report and recent internal audit findings.
- Named contacts in each business line the role covers and in internal audit.
Days 1–30: learn
- Reads a sample of recent closed alerts and file notes to learn the firm's standards and where they slip.
- Meets each business line it covers and learns what their main products and customer types are.
- Works alerts alongside an experienced colleague before taking a queue alone.
Days 31–60: contribute
- Takes ownership of an alert queue and its file notes, with quality checks on a sample of their decisions.
- Plans and starts the first control test in their area.
- Logs one gap between the applicable rules and current policy, with a proposed fix.
Days 61–90: own
- Reports the first control test with root cause, owners and dates.
- Delivers a short training session to one business team on a red flag or control that matters to them.
- Owns the regulatory change log for their area and has seen at least one change through.

Compliance checkpointUSUK

US: the employee completes Form I-9 Section 1 no later than their first day of paid work, and the employer completes Section 2 within three business days after that day (on the first day if the job lasts less than three business days). UK: complete the prescribed right-to-work check before employment starts, and apply it the same way to everyone.

Sources: USCIS — Form I-9 instructions · GOV.UK — Check a job applicant's right to work · checked 2026-09-25

Stage 13 of 13Required

0 of 3 done

Measure time to hire

Measure the process: mean time to hire

Who runs it: Recruiter / talent lead + hiring manager
Done when: A stage-by-stage timing record for this hire, the slowest step named, and one change agreed before the next requisition opens.

Key tool

Record when the hire accepts

•Time to hire: days from the successful candidate entering the pipeline (application or first contact) to the accepted offer. Average it across hires for mean time to hire.
•Time to fill, recorded separately: days from requisition approval to the accepted offer.
•Days per stage, from the stage's first action to its last — and whether the time was spent waiting or working.
•Offer-acceptance rate: offers accepted divided by offers made.
•Where candidates dropped out, and the reason you were given.
•Screening clock and regulatory clock, recorded separately: application to shortlist, and the days approval, registration or background checks took.

Check in at 90 days whether the hire is meeting the outcomes in the job description — that tells you whether the process picked well.

Read: mean time to hire Read: time to hire vs time to fill

AI as an advantageAI boost4D framework

Delegate: Hand AI the job of building a blank timing worksheet and the instructions for reading it. Entering dates, working out the timings and deciding what to change stay with the recruiter and the hiring manager.

Show the prompt and the checks

Describe: You are helping a recruiter and a hiring manager set up a timing review for a Compliance Officer hire. Context: I will list the stage names we used, in order (for example requisition approved, sourcing, screening, recruiter call, work sample, interviews, debrief, references, offer accepted). Produce: (1) a blank worksheet with one row per stage and columns for start date, end date, days in stage, days spent waiting (scheduling, approvals, no reply) and number of candidates who entered and left; (2) step-by-step instructions for us to work out, from our own records, time to hire (the successful candidate's entry to the pipeline, by application or first contact, to the accepted offer; average it across hires for mean time to hire) and, separately, time to fill (requisition approval to the accepted offer); (3) five questions we should ask about the slowest stage, separating waiting from working; (4) a short template for recording one change to make before the next hire. Use British English. Do not include benchmarks or example figures. Ask me questions if anything is missing. Rule: do not ask for, and I will not paste, candidate names, interview notes, CVs, submissions or any other personal data. If any appears, stop and tell me to remove it.
Discern: Check that the worksheet covers every stage you actually ran, that the two definitions are not mixed up, and that the questions point at the process rather than at any person.
Diligence: People fill in the dates and do the arithmetic from their own records, choose the one thing to fix and write it down. No dates, names or details about any candidate go into the prompt.

Don't miss: Blaming a long search on a thin market without first separating the days the regulator's process took from the days the firm added itself.

Framework

Mean time to hire, by stage

Time to hire is the number of days from the successful candidate entering your pipeline (their application or your first contact) to their accepted offer; mean time to hire is that figure averaged across hires. Time to fill — requisition approval to acceptance — is a separate measure. Record both per stage, so you can see where the time went rather than only the total.

When the hire accepts, write down the date each stage started and ended, and the day the successful candidate entered the pipeline.
Work out the days per stage, the time to hire and the time to fill, and mark the slowest stage.
Note the offer-acceptance rate and the stage where most candidates dropped out.
Separate waiting time (scheduling, approvals, silence) from working time, and decide which one to shorten.
Fix one thing before the next hire, and write down what you changed.

Why it works: A single total hides where the delay sits. Per-stage timing points at the one step to fix, and the acceptance rate and drop-out points show whether candidates kept pace with the process.

Record for every hire

Time to hire: days from the successful candidate entering the pipeline (application or first contact) to the accepted offer. Average it across hires for mean time to hire.
Time to fill, recorded separately: days from requisition approval to the accepted offer.
Days per stage, from the stage's first action to its last — and whether the time was spent waiting or working.
Offer-acceptance rate: offers accepted divided by offers made.
Where candidates dropped out, and the reason you were given.
Check in at 90 days whether the hire is meeting the outcomes in the job description — that tells you whether the process picked well.

What to log for this role

Screening clock and regulatory clock, recorded separately: application to shortlist, and the days approval, registration or background checks took.
How long marking the work sample took, and how often the two markers disagreed on the alert triage before calibration.
Which sourcing channel produced the hire, and whether candidates from operations or audit progressed as far as those with compliance titles.

Where this role's hiring slows down

Watch for the regulatory approval or background check being started only after the offer is signed, which pushes the start date back.
Watch for the business-line panellist being hard to book, which stalls the final round.
Watch for work-sample marking queuing behind the compliance team's own monitoring deadlines.

Compliance checkpointUKEU

Under the EU and UK GDPR, tell candidates how long you will keep their data, or the criteria used to decide. Give that notice when you collect data from them directly, or within the Article 14 time limit when it comes from another source (such as a referral or a sourcing tool). Delete or anonymise data when it is no longer needed, keeping only what a documented lawful purpose still requires.

Sources: GDPR — Regulation (EU) 2016/679, Articles 5, 13 and 14 · ICO — UK GDPR guidance · checked 2026-09-25

General information, not legal advice. Rules depend on the employer, the role and where the work is done — confirm what applies with HR or counsel.

Frequently asked questions

What does a compliance officer do day to day?

Much of the week goes on working alerts and due-diligence cases to a recorded decision, testing whether key controls operated, and answering questions from business teams. Around that sit the slower tasks: tracking new rules and guidance, rewriting policies so they can be checked, assessing possible breaches and running training for the staff who apply the controls.

How does a compliance officer role differ from a compliance analyst role?

It varies by firm. Often the analyst works cases and tests under supervision, while the officer owns decisions, advises the business and escalates breaches. Decide which of those your seat needs and hire for that scope rather than the title.

What should a compliance officer work sample include?

Use a short, fictional monitoring review: a handful of alerts with notes, a policy extract with a gap, and a request from the business that conflicts with a control. Ask for a triage, one file note, a policy fix and a reply to the business, with a stated time limit. Never use real customer data.

Does a compliance officer need a specific qualification or licence?

It depends on the jurisdiction and the seat. Some regulators require certain compliance roles to be approved, registered or certified; others do not. Where it applies, check any existing status against the primary source, such as the applicable regulator's register or the certifying body, where one is available, and separately confirm whether the new appointment needs its own application and by when it must be complete; both belong in the references and checks stage. No assessment or interview replaces those checks, and a qualification on its own does not show judgement on a live case.

How long does it take to hire a compliance officer?

The firm controls the screening and interview steps, so set a target for them from your own past searches and track it. Any regulatory approval, registration or background check runs on its own timetable, so start it as early as the rules allow and track it as a separate clock.

Go deeper

Related hiring kits

Guides

Skills tests

See your first AI-generated assessment in 5 minutes

No credit card. No question library to learn. Paste a job description and watch H-Evaluate build.

Request early access