University of South-Eastern Norway

Faculty of Social Sciences

–
Master’s Thesis
Study program: Strategy and management
Spring 2021

Helena Holter Antonsen

A Compliance Function Maturity Model
University of South-Eastern Norway
Faculty of Social Sciences
Department of Business, Marketing, and Law
PO Box 235
NO-3603 Kongsberg, Norway

http://www.usn.no

© 2021 Helena Holter Antonsen

This thesis is worth 30 study points

1
Abstract

In the Norwegian financial market, the MiFID II directive requires firms to implement a series
of systems and controls aimed at securing a robust governance framework. This includes
policies and procedures to ensure regulatory compliance and the establishment of a
permanent, independent, and effective compliance function (ESMA, 2020b, p. 6).

However, the establishment of an effective compliance function is not solely a requirement

from the authorities that for firms represents a necessary evil. Previous research proves that
there is a connection between compliance and firms’ profitability and performance (Antonsen,
2020). For that reason, it is seen as important to organize the compliance function to be as
effective as possible.

Motivated by this, the current research project aims to develop a maturity model for assessing
the maturity of the compliance function within Norwegian investment firms. This, based on
the assumption that effectiveness increases with maturity.

Using a narrative literature study to examine previous research on the development of

maturity models, the development of a compliance function maturity model was completed by
looking to frameworks suggested in existing literature. As part of this, a case study method
was used to test the model in practice.

Findings from this research show how the effectiveness of the compliance function can be
evaluated using a maturity model. By looking to previous research, ideas from compliance
practitioners, and guidelines from the authorities, a path of evolution where the compliance
function matures from being reactive and inconsistent to it becoming a proactive and
integrated part of a firm’s business endeavors is indicated.

Used in the assessment of the compliance function within a relevant case firm, the suggested
model – the CFMM – proved to be compatible with practice. As such, the CFMM represents
an improvement framework that can help its intended audience with identifying where a
firm’s compliance function stands as of today and further provide guidelines for its
improvement. This further implies that the development process, which was inspired by
previous research, helped develop a model that was both usable and useful. As such, the
findings of this study also recognize the measures suggested by other scholars for developing
theoretically and empirically validated maturity models.

2
Table of contents

1 Introduction ............................................................................................................................... 7
1.1 Background and motivation ............................................................................................. 7
1.2 Research problem and scope ............................................................................................ 8
1.2.1 Objectives ................................................................................................................... 8
1.2.2 Research questions .................................................................................................... 9
1.2.3 Limitations ............................................................................................................... 10
1.3 Structure........................................................................................................................... 10
2 Key concepts ............................................................................................................................ 11
2.1 Internal control and compliance .................................................................................... 11
2.2 Regulation of Norwegian Financial Instruments Market ............................................ 12
2.2.1 MiFID II ................................................................................................................... 13
2.2.2 Guidelines and circulars ......................................................................................... 16
2.2.3 Organizational requirements of the compliance function ................................... 18
3 Methodology............................................................................................................................. 20
3.1 Research methods ............................................................................................................ 20
3.2 Literature study ............................................................................................................... 22
3.2.1 Methodological strategy .......................................................................................... 23
3.3 Case study ........................................................................................................................ 25
3.4 Research quality .............................................................................................................. 29
3.5 Ethical considerations ..................................................................................................... 31
3.6 Summary .......................................................................................................................... 33

Part A – Developing a Compliance Function Maturity Model ....................................................... 35

4 Maturity models ...................................................................................................................... 35
4.1 Purpose ............................................................................................................................. 35
4.2 Criticism ........................................................................................................................... 36
5 Modeling process ..................................................................................................................... 37
5.1 Literature review on the modeling process ................................................................... 37
5.2 Developing a Compliance Function Maturity Model ................................................... 39
5.2.1 Phase 1: Planning .................................................................................................... 39
5.2.2 Phase 2: Design ........................................................................................................ 42
5.2.3 Phase 3: Presenting the Compliance Function Maturity Model (CFMM) ......... 52

Part B: Testing the CFMM in practice – An empirical study ......................................................... 55

6 Introduction of case firm ........................................................................................................ 56
6.1 Organization of the compliance function ...................................................................... 57
6.2 Maturity assessment of the compliance function .......................................................... 58
6.2.1 Business Integrity .................................................................................................... 58

3
 6.2.2 Resources .................................................................................................................. 60
6.2.3 Policies and processes .............................................................................................. 61
6.2.4 Coordination ............................................................................................................ 63
6.2.5 Technology ............................................................................................................... 64
6.3 Further effectivization measures.................................................................................... 66
7 Discussion ................................................................................................................................. 68
7.1 Evaluation of the CFMM ................................................................................................ 68
7.1.1 Success criteria 1: Usability .................................................................................... 68
7.1.2 Success criteria 2: Usefulness ................................................................................. 72
7.1.3 Sub-conclusion ......................................................................................................... 73
7.2 The development process of maturity models ............................................................... 73
7.2.1 Meeting criticism ..................................................................................................... 74
7.2.2 Revision based on feedback .................................................................................... 75
7.2.3 Sub-conclusion ......................................................................................................... 77
8 Conclusion ................................................................................................................................ 77
8.1 Contributions ................................................................................................................... 78
8.1.1 Theoretical contributions........................................................................................ 78
8.1.2 Practical contributions ............................................................................................ 79
8.1.3 Methodological implications ................................................................................... 80
8.2 Limitations and further research ................................................................................... 81

4
List of figures

Figure 1: Firms affected by MiFID II. .................................................................................................. 14

Figure 2: The narrative literature review process (Demiris et al., 2019). ............................................ 24
Figure 3: A typology of case studies (Thomas, 2011, p. 518). .............................................................. 26
Figure 4: Case study classified using Thomas' (2011) typology. .......................................................... 33
Figure 5: Conceptualized process and learning-oriented maturity model. .......................................... 51
Figure 6: The Compliance Function Maturity Model ........................................................................... 54
Figure 7: Maturity assessment related to business integrity (Excerpt taken from the CFMM) ............ 60
Figure 8: Maturity assessment related to resource allocation (Excerpt taken from the CFMM). ........ 61
Figure 9: Maturity assessment related to policy and processes (Excerpt taken from the CFMM). ...... 63
Figure 10: Maturity assessment related to coordination (Excerpt taken from the CFMM). ................ 64
Figure 11: Maturity assessment related to technology (Excerpt taken from the CFMM). ................... 66
Figure 12: Maturity assessment of the case firm’s compliance function using the CFMM. ................. 67

List of tables

Table 1: Key words used in the literature search.................................................................................. 24

Table 2: Overview of development frameworks reviewed ..................................................................... 38
Table 3: Decisions when scoping a Maturity Model, adapted from de Bruin et al. (2005, p.5) ........... 40

Appendix

Appendix 1: An overview of the maturity models for the compliance domain reviewed for this study . 91
Appendix 2: Interview protocol ............................................................................................................. 93
Appendix 3: Information and consent form ........................................................................................... 96

5
Preface

“You are about to spend a lot of hours working on your master thesis, so make sure that you
chose a subject that you find interesting, and which you feel excited about sharing with
others!”

That was the advice I was given from an older student last year when asking for advice
regarding what I had in store for my last year as a master’s student in Business and
Administration at the University of South-eastern Norway.

Today, after a long but equally educative period of writing this master thesis - I am excited to
share with you what I have learned. But, before that, I would like to hand out my gratitude to
those who have helped me along the way.

First, I would like to thank my supervisor, Dag Øivind Madsen, who has been available for
guidance throughout the process. His feedback and encouragement have been valuable –
especially in periods when a discussion partner has been needed the most.

Next, to the participants of the case study. I would like to thank the case firm for allowing me
to gain insight into its structure, processes, and organization of a business function as
important as the compliance function. That is not something I take for granted. Especially, my
gratitude goes out to Head of Compliance and Risk within the firm, for taking the time to
answer all of my questions thoroughly, and for the many interesting discussions along the
way. Without the knowledge and experience of this person, this paper could not have been
completed as it is today.

And at last, a big thank you to my family and my partner for supporting me through the years
I have spent as a student. Knowing that you believe in me has been a great motivator along
the way.

Oslo, 01.06.2021

Helena Holter Antonsen

6
1 Introduction

As an introduction to this master’s thesis, the first chapter will provide information on the
background and motivation for doing this research as well as a brief description of the
research problem and scope. The latter will elaborate on the objectives, research questions,
and limitations of the study.

1.1 Background and motivation

Today’s business environment is increasingly more regulated and expectations for ethical and
sustainable activities from society in general are more evident than ever (PwC, 2016). In the
Norwegian financial market, the MiFID II directive requires firms to implement a series of
systems and controls aimed at securing a robust governance framework through a clear
organizational structure, lines of responsibility, and effective risk management processes (ILA
Norge, 2015). This includes policies and procedures to ensure regulatory compliance and the
establishment of a permanent, independent, and effective compliance function (ESMA, 2020b,
p. 6).

As the business environment evolves, stakeholders expect firms to be flexible and quickly
move to adopt sophisticated and effective measures answering to all new demands in their
industry (Blum, 2020). Research (See: Antonsen, 2020) also point out that firms who are
responsive to changes and develop in accordance with them often emerge as winners in their
industries (Drnevich & Kriauciunas, 2011; Teece et al., 1997). However, such a change is not
made overnight. Just as small children must learn to crawl before walking, firms must take
their processes through a maturation process to enable sophisticate and effective measures
(Blum, 2020). This also applies to the development of an effective compliance function.
Further, the notion of “effective” must also be considered. What measures must the firms
resort to for satisfying the requirements for organizing an effective compliance function – and
what are the requirements?

From the above, this study aims to develop a compliance function maturity model for
application within Norwegian investment firms. The model will be based on current
legislation and prescribed guidelines from regulatory authorities, as well as ideas from
practitioners, describing how to organize an effective compliance function. This, by assuming
that effectiveness increases with maturity.

7
For the model to encompass the complexness of real-world environments, empirical data from
a case study involving a Norwegian investment firm will be used to test the model. Such a
case study will not only be valuable in testing the model, but it will also provide the firm with
a better understanding of where their compliance function stands as of today. In addition,
having mapped its current level of maturity, the model will also provide guidelines with
implications on how the firm might improve its compliance function to become more
effective.

The motivation behind developing a compliance function maturity model is based upon work
with the preliminary project related to this master thesis. Throughout the autumn of 2020, a
thorough literature review on the connection between a firm’s competitive advantage and its’
compliance initiatives were conducted. The review first and foremost illustrated that there is a
widely accepted belief, among both researchers and compliance practitioners, that there is a
connection between compliance and a firm’s profitability and performance. Using Barney's
(1991) VRIO-framework to assess the connection further, it became evident, that for the
compliance function to lay a foundation for a competitive advantage - it must be organized in
a way that allows the firm to take full advantage of it. In this, it lies that the top management
group is able to organize, allocate, and structure capabilities and resources in a way that
enables this. And for that purpose, what is called the descriptive and prescriptive purposes of
a maturity model can make it an important tool for firms in search of improvement.

1.2 Research problem and scope

1.2.1 Objectives

The main objective of this research project is the development of a compliance function
maturity model. However, to complete such an objective, smaller objectives must be achieved
along the way. One can see these objectives as milestones to be completed during the project
period. Hence, other than developing a compliance function maturity model, the objectives
are (1) to test the suggested model in a real-life case (a Norwegian investment firm), (2) to
evaluate the model based on empirical data from that case, and (3) to evaluate the compliance
function of the case firm, using the model.

8
1.2.2 Research questions

Research questions make a formal statement about the goal of the study, identifying clearly
what the researcher intends to learn. In other words, they summarize what is unknown that
requires further exploration (Savin-Baden & Major, 2012, p. 99). As such, articulating an
investigable question that captures the topic and the purpose of the research is critical to the
research endeavor.

Using the purpose statement template of Creswell (1998), the purpose of this research project
is to develop and test a maturity model for the compliance function in Norwegian investment
firms. At this stage in the process, it is known that there is a connection between compliance
and firms’ profitability and performance (i.e., its competitive advantage), and for that reason,
that it is important to organize the compliance function to be as effective as possible.
Research on internal control and compliance also addresses questions on how this ought to be
done, and ideas in form of frameworks and guidelines on how to organize the firm’s
compliance initiatives are provided by both academia and practitioners on the field.

Based on this, two different - but complementary - research questions are formulated for this
study:

RQ 1) How can the effectiveness of the compliance function within Norwegian investment
firms be evaluated using a maturity model?

RQ 2) What is the state of the compliance function within the selected case firm as of today,
and how can the function possibly be improved to be more effective?

The first question calls for a literature study on how to develop a maturity model,
complemented by knowledge from a previously conducted literature review on how to gain a
competitive advantage from the way in which a firm’s compliance function is organized.

To answer the second research question, on the other hand, the model which will be
developed is tested in a real-life situation. This is important because the model will be
developed based on theoretical data solely (i.e., existing research and literature on the field),
and therefore, it is not sure whether it will be compatible in practice. A case study involving a
Norwegian investment firm is thought to give implications on whether the model reflects real-
life situations and can be used for both the as-is assessment and as an improvement
framework – which is what research question number two is asking for.

9
1.2.3 Limitations

When describing the scope of the project, it is not sufficient to talk solely about what will be
done. Also, limitations to the project should be presented.

Typically for master’s thesis, they are limited when it comes to time and resources. Having
conducted a literature review on the modeling process of maturity models, it has become
evident that most research projects involving the development of such models are lengthy and
involve a range of different methodological procedures (e.g., Solli-Sæther & Gottschalk,
2015). The current research project was initiated in January 2021 and submitted on 1 of June
2021 – i.e., its timeframe is approximately 20 weeks. This has naturally limited the
extensiveness of the research project and study.

Further, for students writing their master’s thesis this year, it is inevitable not to mention the
current situation of Covid-19 which has led to the society locking down. This has also had its
implications for the research endeavor. For example, it has not been conducive to use focus
group interviews – which is one of the techniques suggested by the literature on the modeling
process for maturity models. Also, when one-to-one interviews are conducted, they should
preferably be carried out digitally (through the use of videoconferences, telephone interviews,
etc.). With the goal of interviews being to replicate in a research setting the elements of a
natural conversation (Bryman et al., 2019, p. 357), carrying them out digitally might be
thought to diminish that effect.

Nevertheless, by being solution-oriented and adapting the research problem and subsequent
methodological techniques, the study was completed in a satisfactory way, well before the
assignment’s deadline.

Limitations of the study which are due to constraints on research design, or which have come
as a result of issues with the researcher will be elaborated on later, towards the end of this
paper.

1.3 Structure

This last subchapter provides an overview of the structure of the paper, which is built up
around the objectives and associated research questions. The choice to do it this way has been
made for the reader to better understand and follow the research process. Mainly, the paper is
divided into two parts, A and B, each of which is related to one of the research questions set
up in Chapter 1.2.2.
10
In Part A, RQ1 will be in focus. This means that the focus here will be on developing a
maturity model that can be used to assess the maturity of the compliance function within
Norwegian investment firms. To do this, Part A will start by explaining what maturity models
are, and why they are considered important tools in many different industries. Furthermore, a
literature study on the development process of such models will be presented as a basis for the
development of a compliance function maturity model. Rounding up Part A, the suggested
compliance function maturity model – The CFMM – is presented in chapter 5.

In Part B, empirical data from the case study conducted to answer RQ2 is presented. In doing
so, Part B constitutes discussions on the findings that can be related to both of the research
questions. This, because the empirical data will provide information necessary to evaluate
both the compliance function of the case firm and the model developed in Part A. To come to
a conclusion – the last chapter will summarize whether the objectives of the study are met,
and research questions are answered. It will be commented on the study's contribution (i.e.,
both theoretical, practical, methodological implications) as well as its limitations. Finally,
suggestions for future research will be provided.

Before this, however, key concepts and methodological choices for this research project will
be elaborated on and explained more closely.

2 Key concepts

In this chapter, key concepts that play an important role in the field of risk management and
compliance will be defined and explained more closely. The concepts that will be elaborated
on have been selected because they represent an important part of this thesis. A good
understanding of what these concepts entail will make it easier to understand the complexity
and the various elements that are part of organizing an effective compliance function.

2.1 Internal control and compliance

The compliance function is a crucial function within firms, responsible for identifying,
assessing, monitoring, and reporting on the firms’ compliance risk (ESMA, 2020b, p. 4). It
entails compliance with both external1 and internal2 regulations and is established to help

1 By external regulations, one thinks first and foremost of laws, regulations and decisions made by
public authorities on the basis of laws and regulations. Some also include industry norms / standards
and requirements in customer and supplier contracts in the term (IIA Norge, 2015).
2 Policy, guidelines and instructions from the board and management.

11
management to prepare and implement an effective internal control system to manage the risk
of violating those regulations.

The term internal control, as used above, encompasses far more of the management aspect
than what is often narrowly understood as internal control measures. If one is to understand
the concept of internal control, one must see the connection between goals, risk, management,
and internal control measures (DFØ, 2009, p. 4). COSO defines internal control as:

“A process, effected by an entity’s board of directors, management, and other personnel,

designed to provide reasonable assurance regarding the achievement of objectives relating to
operations, reporting, and compliance” (Msib & Foster, 2019, p. 7).

However, there is a possibility – or a risk - that an event will occur that adversely affect the
achievement of objectives (COSO, 2004). With compliance objectives pertaining to
adherence to laws and regulations to which the entity is subject – one can understand
compliance risk as The Basel Committee on Banking Supervision (BIS) defines it:

“The risk of legal or regulatory sanctions, financial loss, or loss to reputation an

organization may suffer as a result of its failure to comply with laws, regulations, rules,
related self-regulatory organization standards, and codes of conduct applicable to its
activities” (Singh, 2005, p. 7).

The above definition points out how failure to comply with laws, rules, and standards might
expose the firm to loss of reputation. This coincides with compliance risk also sometimes
being referred to as integrity risk. The backdrop is that many compliance regulations are
enacted to ensure firms’ fair and ethical operation (TechTarget, 2014). And, throughout
history, we have several examples of how firms’ failure to answer to those regulations has
exposed both them and their stakeholders to great losses (Steinberg, 2011).

2.2 Regulation of Norwegian Financial Instruments Market

Having understood the concept of compliance risk and the related responsibilities of the
compliance function – it follows that one should also know the rules and standards which
apply to these firms, to further be able to evaluate how effective the function is.

12
2.2.1 MiFID II

In the run-up to the financial crisis in 2008, The Markets in Financial Instruments Directive
(MiFID) was introduced in the EU to set stricter regulations for securities trading, strengthen
investor protection, and promote transparent markets. The directive was implemented on
November 1 2007 and was seen as the cornerstone of European capital market regulations
(Directive 2014/65/EU, 2014; EY, 2015).

On the other side of the Atlantic Ocean, on September 15, 2008, Lehman Brothers filed for
bankruptcy, Bank of America announced its acquisition of Merill Lynch, and the day after the
Federal Reserve bailed out AIG. On September 17, the markets were in free-fall and the
financial crisis was a factum (Karp et al., 2018). Not long thereafter, regulatory bodies at an
international level agreed that weaknesses in corporate governance in several financial
institutions, including the absence of effective checks and balances within them, had been a
contributory factor to the financial crisis (Directive 2014/65/EU, 2014).

Therefore, in the aftermath of the financial crisis in 2008, the need for a revised directive was
seen as necessary due to the shortcomings in regulation and supervision of the financial
industry in the EU. As a result, MiFID II entered into force in the EU and EEA on 3 January
2018 and was later implemented in Norwegian law on January 1, 2019 (BAHR, 2017).

Structure and scope

The scope of MiFID II is determined by the terms "financial instruments" and "investment
services". These terms are defined in the Securities Trading Act §§ 2-1 and 2-2. One can
shortly describe financial instruments as assets that can be traded. They come in the form of
real or virtual documents representing a legal agreement involving any kind of monetary
value (Kenton, 2020). Investment services thus become services associated with financial
instruments. This may apply to the receipt and dissemination of orders (Securities Trading
Act § 2-1 first paragraph no. 2), proprietary trading (Securities Trading Act § 2-1 first
paragraph no. 3), active management (Securities Trading Act § 2-1 first paragraph no. 4),
investment advice (Securities Trading Act § 2-1 first paragraph no. 5) and corporate
(Securities Trading Act § 2-1 first paragraph no. 6).

As such, a wide range of firms that provide investment services related to one or more
financial instruments will to some extent be covered by MiFID II. The below figure shows
which firms are included (BAHR, 2017, p. 7).

13
Figure 1: Firms affected by MiFID II (Sectors of the pie chart do not correspond to the actual number of firms of
each type).

Investment firms, which are in focus in this thesis, are defined in the Securities Trading Act §
2-7 first paragraph and are hereinafter used to refer to firms that provide one or more
investment services to third parties or conduct investment activities on a commercial basis.

When it comes to the structure, EU regulations that apply in the Norwegian financial market
are categorized in levels one to three. MiFID II (directive) and MiFIR (regulation) have been
implemented in Norwegian law through the Securities Trading Act, and hence, they are
referred to as level 1 rules in the securities market (Finanstilsynet, 2017).

Commission directives and commission regulations are level 2 rules, which specify and
supplement the framework provisions in MiFID II and MiFIR. Level 2 rules related to MiFID
II and MiFIR are mainly introduced into Norwegian law through the Securities Regulations
(Schjødt, 2018). Lastly, common guidelines and recommendations – like those drawn up by
The Europeans Securities and Markets Authority3 are considered level 3 rules and have
approximately the same position as circulars from the Norwegian Financial Authority
(Finanstilsynet, 2017).

As understood from the above, MiFID II is one of the more comprehensive EU directives and
regulations as of today. As such, it regulates several areas that are not relevant to the research
problem of this thesis. Therefore, the focus in the chapters to come will be on those parts of
the directive that aims to secure a robust governance framework - further limited to what is
relevant for the organization of the compliance function within investment firms specifically.

3
Hereafter referred to as ESMA.

14
Compliance function requirements set out in MiFID II
MiFID II requires firms to implement a series of systems and controls to secure a robust
governance framework with a clear organizational structure and lines of responsibility, and
effective risk management and compliance processes (ESMA, 2020b, p.6). These systems
include policies and procedures to ensure regulatory compliance and the establishment of a
permanent independent and effective compliance function.

What these policies and procedures involve is set out in Directive 2014/65/EU4 Article 16 and
the Commission Delegated Regulation (EU) 2017/5655 Article 22. The requirements brought
fore are further implemented in Norwegian law through the Securities Trading Act § 9-16 and
in the Regulations to the Securities Trading Act § 2-7. I.e., they are level 1 and 2 regulations.

MiFID II Article 16(2), on organizational requirements, sets out that investment firms shall
establish adequate policies and procedures sufficient to ensure compliance of the firm with its
obligations under MiFID II. According to Article 22(1) in MiFID II Delegated Regulation,
this includes the firm detecting any risk of failure by the firm to comply with these obligations
and put in place adequate measures designed to minimize such risk. Following this, Article
22(2) requires the firm to establish and maintain a permanent and effective compliance
function to handle these risks and sets out specific responsibilities that follow from that task.

Firstly, the compliance function is held responsible for monitoring and assessing the adequacy
and effectiveness of the measures, policies, and procedures mitigating compliance risk. This
also involves the actions taken to address any deficiencies in the firm’s compliance with its
obligations. Naturally, it follows that the function is responsible for advising and assisting
employees who carry out the relevant activities covered by the obligations of the MiFID II
directive. For this to work effectively, the compliance function must - in accordance with
paragraph 3 of MiFID II Delegated Regulation Article 22 - have the necessary authority,
expertise, resources, and access to relevant information.

Furthermore, it is a prerequisite that there should be a direct connection between the

compliance function and the management body6 as the overall, responsible corporate body
because this is an integral part of ensuring that the control function is effective. MiFID II

4 Hereafter MiFID II
5 Hereafter MiFID II Delegated Regulation
6 Management body refers to an institution's body or bodies, which are appointed in accordance with

national law, which are empowered to set the institution's strategy, objectives and overall direction,
and which oversee and monitor management decision-making, and include the persons who
effectively direct the business of the institution (EBA, 2019). Hereafter referred to as the board.

15
makes this explicit, by requiring established procedures for direct communication lines
between the compliance function and the board. Article 22(2)(c) sets out that the chief
compliance officer7 shall report to the management body on at least an annual basis, on the
implementation and effectiveness of the overall control environment for investments services
and activities, and on the risks that have been identified. Article 22(3)(c) also demands ad-hoc
reporting when significant risks of failure by the firm to comply with its obligations under
MiFID II are identified.

Lastly, to enable the compliance function to discharge its responsibilities properly and
independently (whereas the latter is one of the elementary requirements to the compliance
function), Article 22(3) sets out that firms should ensure specific conditions to be satisfied.
These involve that relevant persons involved in the compliance function are not involved in
the performance of services or activities they monitor, and that remuneration of such persons
does not compromise their objectivity.

It should also be noted that the requirements set for the compliance function can be relaxed if
the firm can demonstrate that in view of the nature, scale, and complexity of its business, and
the nature and range of investment services and activities, the requirements are not
proportionate and that its compliance function continues to be effective (FSA Norway, 2015,
p. 9). This is known as the proportionality principle8.

2.2.2 Guidelines and circulars

Level 3 rules, like common guidelines and recommendations set out by the different securities
market regulators, have approximately the same position as circulars in Norway. In the
following, EMSAs guidelines on certain aspects of the MiFID II compliance function
requirements and circular 5/2015 from the Norwegian financial authority9 on the same topic
are presented.

According to ESMA, the guidelines are meant to provide additional clarifications on certain
topics of the MiFID II compliance function requirements (ESMA, 2020a). In accordance with
the focus of this paper, the guidelines are addressed to investment firms providing investment
services. ESMA provides12 guidelines, divided into three main categories. Namely:

7 Hereafter, the CCO. Also referred to as Head of Compliance (HOC).

8 In deciding on the proportionality with regard to the effectiveness of the compliance function firms
can look to ESMA Guideline no. 9 for more specific criteria to consider.
9 Hereafter referred to as The FSA

16
 1. Responsibilities of the compliance function
2. Organizational requirements of the compliance function
3. Competent authority review of the compliance function

In the following, category 1 and 2 will be in focus, as these are more aimed at elements
important for firms in organizing an effective compliance function. This also coincides with
the focus of FSA’s circular being to provide investment firms with guidance on how they
should align themselves to ensure that the law’s requirements for an effective compliance
function are met (FSA Norway, 2015, p.3).

Responsibilities of the compliance function

The tasks of the compliance function are related to monitoring the firm’s compliance with
rules and regulations, perform regular assessments of established routines and guidelines, and
give preventive advice and provide guidance on the firm's obligations related to the legal
framework that regulates their industry (FSA Norway, 2015, p 7). Towards these tasks, the
compliance function must have a risk-based approach (ESMA, 2020).

Following up on Article 22(2) of the MiFID II Delegated Regulation, ESMA guidelines

emphasize that a monitoring program – which The FSA refers to as a compliance plan – shall
determine the function’s priorities and the focus of the monitoring, advisory and assistance
activities, and resources allocated to each10.

The compliance plan shall be based on the compliance risk assessment (FSA Norway, 2015,
p.7). Therefore, as the guidelines articulate, the risks identified in the assessment should be
reviewed on a regular (and ad-hoc) basis, so that the program is always updated and ensures
the objectives, focus, and scope – as well as the validity - of the planned compliance
initiatives (p. 27). For this to be possible, both ESMA and The FSA find it important that the
risk assessment takes into consideration all areas of the investment firm’s investment services,
activities, and any relevant ancillary services. The guidelines also stress that the risk
assessment should be based on both the applicable obligations under MiFID II as well as
national implementing rules, policies, and procedures implemented within the firm in the area
of investment services and activities.

10Resources refers both the number of compliance employees, their skills and qualifications, IT
resources and financial resources (FSA Norway, 2015)

17
As understood from MiFID II Delegated Regulation, the compliance plan work as a tool for
evaluating whether the firm’s business is conducted in compliance with regulatory
obligations. As such, the ESMA guidelines clarify that the program also shall enable the
evaluation of whether internal policies and procedures, organization, and control measures
remain effective and appropriate to ensure that compliance risk is comprehensively monitored
(p. 28). If the result of any monitoring activities shows that there is a risk for violating rules
and regulations, these results should be taken into account in the ad-hoc revision of the firm’s
risk assessment (MiFID II Delegated Regulation, p.14).

Guidance on appropriate tools and methodologies for the compliance function to use in its
monitoring activities are also available in ESMA’s guidelines. Among other examples, ESMA
suggests using technology for aggregated risk measures and exceptions logs11 and targeted
trade surveillance (p.8).

According to guideline 3(28), compliance’s monitoring activity should inform in general on

the adequacy and effectiveness of firms’ policies and procedures, as well as relevant changes
in applicable requirements. This involves the manner of monitoring and reviewing activities,
relevant findings, and actions taken to address significant risk of failure of the firm to comply
with obligations under MiFID II (p.30).

2.2.3 Organizational requirements of the compliance function

Cf. Article 22(3)(a) of MiFID II Delegated Regulation, the compliance function must have the
necessary authority, resources, expertise, and access to all relevant information to work
effectively. As with all other requirements that by law applies to the compliance function, the
organizational ones should also be based on the proportionality principle.

ESMA's guideline no. 5 deals specifically with the effectiveness of the compliance function,
and hence provide guidelines complementing Article 22(3) of the MiFID II Delegated
Regulation.

Paragraph 44 says that to ensure that appropriate resources are allocated to the compliance
function, senior management should regularly monitor whether the number of staff and their
expertise is still proportionate to the scale and types of investment services, activities, and
ancillary services of the firm. Also, budgeting for the compliance function should be

11Documenting material deviations between actual occurrences and expectations (ESMA guidelines,
p.28).

18
consistent with the level of compliance risk the firm is exposed to and should be decided on in
collaboration with the CCO (ESMA, 2020b, p. 34).

In addition to human resources, guideline no. 5 says that sufficient IT resources should be
allocated to the compliance function. This relates to ensuring that the compliance staff has
access to the relevant information for their tasks at all times. For this purpose, access to all
relevant databases and records such as recordings of telephone conversations and electronic
communications are relevant IT resources (ESMA, 2020b, p. 34, paragraphs 46-47).

To demonstrate the necessary level of knowledge and/or experience, different options may be
foreseen at national level in the Member State concerned (ESMA, 2020b, p. 35). For the
CCO, the requirement for professional qualifications means that the person concerned must
have in-depth knowledge of the regulations to which the company is subject. This, including
circulars and prepared practices from the supervisory authority. Other compliance employees
must know this framework and should be regularly trained in order to maintain their
knowledge (ESMA, 2020; FSA Norway, 2015). The compliance function must also have
specific knowledge of the company's various business areas. For Norwegian investment firms,
the responsibility for the assessment of the CCO’s qualification - and its appointment - lies
with the firm’s board (Bahr, 2020, p. 20; FSA Norway, 2015, p. 3).

Lastly, to grant the compliance function the authority required for performing its duties, the
firm’s senior management should support the function in the exercise of its duties12. ESMA’s
guideline no. 6 suggests that this may be enhanced by the firm’s compliance policy explicitly
acknowledging the specific authority of the compliance function. MiFID II Delegated
Regulation also holds that the compliance function should perform its activities permanently.
What is meant by the compliance function being permanent is that it must be arranged for
competent persons to take over the functions of the person who usually performs the tasks, in
the event of planned or unforeseen absences (Bahr, 2020, p.20). Here the guidelines extend
the notion of permanence to also entail regular monitoring as planned in the compliance plan,
and not only control under specific circumstances (p. 36). Again – explicit and understood
compliance policies and processes are important.

12 Tone at the top.

19
3 Methodology

“Methodology is the strategy, plan of action, process or design lying behind the choice and
use of particular methods and linking the choice and use of methods to the desired outcomes”
(Crotty, 1998, p. 3).

This master’s thesis is conducted as a research-based project consisting of certain project

objectives to be met and research questions to be answered. To do so, however, a clear plan of
action must be evident – and hence, decisions upon the methodology of the research project
must be made.

This chapter will provide detailed information on the methodology used in this thesis,
allowing the reader to critically evaluate the overall validity and reliability of the study.

3.1 Research methods

According to Bryman et al. (2019), business research and its associated methods do not exist
in a vacuum. Firstly, it is informed and influenced by existing theory and knowledge, which it
also contributes to, as it feeds into the stock of knowledge to which the theory relates. Second,
assumptions about the nature of social phenomena influence the research process. These
ontological considerations should determine what one wishes to understand through research
and further inform how we research it. The latter relates to assumptions known as
epistemological considerations and focuses on how the social world should be studied (p. 25-
31).

Before the following subchapters elaborate on the methods used to attain the objectives of this
research project, the context of the research methods will be explained.

In conducting research, data is collected and analyzed in order to generate knowledge. The
most common view of the relationship between theory and research is associated with a
deductive approach where theory is tested through observations and findings. With an
inductive approach, the connection is reversed and theory is the outcome of the research
(Bryman et al., 2019, p. 23). For this particular research project, an inductive approach is used
for data collection and analysis to develop a maturity model for the compliance function and
further test this to evaluate the model for use as an improvement framework. However, rising
from the criticism of the inductive approach that no amount of empirical data will necessarily
enable theory-building, an abductive approach is also considered (Bryman et al., 2019, p.24).

20
This involves back-and-forth engagement with the social world as an empirical source for
theoretical ideas, and with the literature, in a process of “dialectical shuttling” (Atkinson et al.
2003; Schwartz-Shea and Yanow 2012, in Bryman et al. 2019). This approach is viewed as
especially helpful in choosing the “best” explanation from the competing explanations or
interpretation of the data used in developing, for example, a compliance function maturity
model.

In conducting research like this, meanings are assigned to the phenomena studied, and it is
this assignment of meaning which constitutes the reality of the objective studied (Bryman et
al., 2019, p. 27). For example, when describing the term “compliance” in terms of various
characteristics such as specific structures, roles, etc., this makes such functions real in the
sense that it is understood as a legitimate category of corporate functions. This point, also
showed to by Alvesson and Thompson (2005), in Gay & Gay (2005), illustrates how the
researcher always presents a specific version of social reality rather than one that can be
regarded as definitive. And as such, knowledge can be argued to be indeterminate and to some
degree subjective.

The concept of compliance initiatives, in my opinion, is an emergent reality in a continuous

state of construction and reconstruction (Bryman et al., 2019). What I mean about this is not
that it is not a pre-existing object – cause in all simplicity it is easy to view it as a social order
excreting pressure on individuals to conform to certain requirements. This even lies in the
word itself, in its verb form “to comply”. People apply to the rules and follow standardized
procedures as informed by the compliance initiatives – but from my view, the phenomenon of
compliance is made real by the actions and understandings of the practitioners and researchers
in the financial services sector.

Viewing realty as constituted by human action and meaning-making, rather than existing
objectively and externally, the research must reflect the distinctiveness of humans as against
the natural order (Bryman et al., 2019, p. 31). For this, the research strategy that respects the
differences between people and the objects of the natural sciences is required and the
researcher should grasp the subjective meaning of social action. Therefore, preoccupying
myself with formal objective properties of compliance initiatives neglects the degree to which
the concept is accomplished through everyday interaction. New problems need to be solved,
new solutions appear, and the understandings of how the initiatives should work are adapted
to this. Being concerned with how the compliance function can grow mature and generate
benefits to firms through functioning as effectively as possible, this project will aim to
21
understand the phenomena of compliance and the processes whereby it works and develop a
model for this purpose.

The next subchapters will dig deeper into the research methods used to accomplish this.

3.2 Literature study

How can the effectiveness of the compliance function within Norwegian investment firms be
evaluated using a maturity model?

This research question reflects the main objective of this research project. Namely, to develop
a model for assessing the maturity of compliance functions within Norwegian investment
firms. To enable this, however, knowledge on how to develop such a model is required.

Snyder (2019) argues that for many research questions, a literature review may be the best
methodological tool (p.334). She does so by referring to Webster and Watson (2002), who
states that an effective and well-documented review as a research method creates a firm
foundation for advancing knowledge and facilitating theory development. She also
emphasizes that by integrating findings and perspectives from many empirical findings, a
literature review can address research questions with a power that no single study has (p.
333).

However, there are different types of review methodologies. The most common distinction
found in the methodological literature is between a systematic and narrative approach
(Bryman et al., 2019). The latter is less focused and more wide-ranging in scope. In contrast,
the first is about adopting explicit, often more quantitative, procedures to generate unbiased
and comprehensive accounts of literature in a research field (Mays et al., 2005, in Bryman et
al., 2019). In addition to these, Snyder (2019) also addresses what she refers to as integrative
approaches. These are closely related to the semi-structured (narrative) review approach, but
in comparison to those, the integrative review usually has a different purpose (p.335).
Namely, to review, critique, and synthesizes representative literature on a topic in an
integrated way so that new frameworks and perspectives on the topic are generated (Torraco,
2016, p. 356). Which approach to rely on however depends on the purpose of the study and
the research question targeted.

In order to establish a reasonable catalog of requirements for the design of maturity models,
exploring collective evidence from that research area will be useful. This, to attain a
foundation for - and understanding of – the decisions that must be made when one is to

22
develop such a model. For this purpose, a semi-systematic - or narrative - approach is
considered appropriate.

In general, the reasoning behind this is that the semi-systematic review approach is designed
for topics that have been conceptualized differently and studied by various groups of
researchers within diverse disciplines (Wong et al., 2013). The application areas of maturity
models are widespread and range from cognitive science to business applications and
engineering (Kohlegger, 2009, p. 51). And as such, research on the act of developing them is
also conducted by researchers within the same wide range of disciplines. Hence, in deciding
on a narrative approach for this literature study, whether the approach would help summarize
and evaluate a vast research field was considered. For that purpose, a strict systematic review
was thought of as too limiting.

As opposed to the fact that the systematic approach may limit the scope of the review by
having pre-specified inclusion criteria to answer a particular research question or hypothesis
(Snyder, 2019, p. 335), the semi-systematic approach seeks to identify and understand all
potentially relevant research traditions that have implications for the studied topic (Green et
al., 2006; Wong et al., 2013).

However, while covering broad topics and different types of studies, the narrative approach
holds that the research process should be transparent and have a developed research strategy
that enables readers to assess whether the arguments for the judgments made were reasonable,
both for the chosen topic and from a methodological perspective (Snyder, 2019, p. 335). This,
to meet the criticism of narrative reviews lacking synthesis and rigor (Byrne, 2016). As such,
the following subchapter will elaborate on the process by which the literature study for this
research project is conducted.

3.2.1 Methodological strategy

Following Demiris et al. (2019), the narrative approach decided on for this project follows a
four-stage review process. This involves conducting a search, identifying keywords,
reviewing abstracts and articles, and lastly to document the results (See Figure 2). Maier et al.
(2012) followed a similar process in selecting their review sample for their paper on stages-
of-growth modeling.

23
 Step 1:
• Search databases for studies
Search

• Backward and forwad snowballing

Step 2:
Identify
• Identify papers pertinent to review question
Keywords

Step 3: • Ensure that articles address review question

Review
Abstracts and
Articles

• Summarize and synthesize findings

• Integrate findings in writings through references
Step 4:
Document
results

Figure 2: The narrative literature review process (Demiris et al., 2019).

Step 1: Conduct a Search

The first step includes the researcher searching for studies that describe the problem of
interest in a variety of databases in which scientific literature is indexed. Here, it was
important for me to use more than one database to ensure the identification of the majority of
relevant literature. The databases used were those recommended by the university library13 for
students researching topics in economics and management. Among others, Business Source
Elite (EBSCO), Emerald Management Plus, Jstor, SpringerLink, and Wiley Online Library
were used.

Step 2: Identify keywords

Next, when the initial search for relevant literature is done, Demiris et al. (2019) call for the
identification of relevant keywords in that literature to extend the search and find individual
studies on similar topics. In search for additional literature for the current study, also
synonyms for the identified keywords were used. See examples in Table 1.

Keyword 1 Keyword 2
Maturity model “Designing ….”, “Modelling process of…”, “Stages-of-
growth models”, “Stages-of-growth modeling”, “principles”
Design science “..in relation to maturity models”, “guidelines in ….”

Table 1: Key words used in the literature search.

13 University of South-Eastern Norway

24
Step 3: Review abstracts and articles
As soon as the search is complete, and one is left with a handful of relevant articles, reviewing
the abstracts of these will ensure that they actually address the topic of interest (Demiris et al.,
2019).

Step 4: Document results

The last step of the literature review process includes synthesizing and summarizing the
findings from the chosen articles. For a narrative review, no rules are stating that the literature
search must be documented other than through references in the study (Demiris et al, 2019).
However, for the sake of transparency,
Table 2 in chapter 5 on the modeling process provides an overview of the articles considered
most important for further use in this project.

3.3 Case study

What is the state of the compliance function within the selected case firm as of today, and how
can the function possibly be improved to be more efficient?

Yin (2018) recommends doing a case study when one wants to understand a real-world case
and assumes that such an understanding is likely to involve important contextual conditions
pertinent to the case (p.15). More closely case studies can be defined as:

“analyses of persons, events, decisions, periods, projects, policies, institutions, or other

systems that are studied holistically by one or more methods. The case that is the subject of
the inquiry will be an instance of a class of phenomena that provides an analytical frame—an
object—within which the study is conducted and which the case illuminates and explicates”
(Thomas, 2011, p. 513)

From this definition, Thomas (2011) adopts a classification typology of case studies
consisting of six aspects considered important for differentiating between the various types of
case studies to be applied in a research project (See Figure 3). In the following, the case study
to be conducted in this research project will be classified accordingly.

25
Figure 3: A typology of case studies (Thomas, 2011, p. 518).

From the above definition, it becomes evident that a case study must comprise two elements:
namely, a subject and an object. Here, Thomas (2011) stresses that the subject is not a sample
representative of a wider population. Rather, it shall be selected because it is an interesting or
unusual, or revealing example through which the lineaments of the object can be refracted
(p.514). This implies that the essence of subject selection rests on the dynamic of the relation
between subject and object.

The subject in focus in the current case study is a Norwegian investment firm which was
selected because it offers what can be referred to as “exemplary knowledge” (Thomas 2010,
in Thomas, 2011). This means that it is chosen based on its capacity to exemplify the
analytical object of the inquiry – which in this case is to test the maturity model developed
throughout the first part of the research project.

The purpose of the study is intimately connected to the object (Thomas, 2011, p.516). I.e., the
understanding that is required – or explanation needed – will be related to the reason for doing
the study. In the current study, the purpose is twofold. First, testing the model in practice will
provide implications as to whether it is compatible in a real-life situation. Second, it will
enable the evaluation of the case firm’s compliance function “as-is” and further contribute
with guidelines for its improvement.

Thomas (2011) refers to researchers such as Stake (1995), Merriam (1988), and Bassey
(1999) when introducing the terms “intrinsic”, “instrumental”, “evaluative”, and
“exploratory” for describing the purposes of case studies. The beforementioned purpose of
testing the model is not based upon interest for a particular case – i.e., an intrinsic interest in
the case firm itself. Rather, the interest lies in figuring out how the model functions in
practice. Testing the model within the particular case firm is as such done to provide insight

26
into that research problem on a general basis, and not for the sake of learning about that
particular firm (Stake, 1995, p. 3). In other words, the first purpose can be labeled
instrumental. For the next purpose, however, the case firm is studied in depth with “the
purpose of providing decision-makers within the firm with information that will help them to
judge the merit and worth of policies, programmers or institutions”. This definition is
formulated by Stenhouse (1985) to describe evaluative case studies (Bassey, 1999, p. 4).
Hence, the second purpose of this case study can be thought of as evaluative.

Following the typology of Thomas (2011) further, the next consideration regards the approach
adopted. Reflecting the broad nature of the object and the purpose of the study, the
significance of theory in the conduct of the study is at this point enlightened (p.516). As stated
by Bassey (1999), instrumental research falls into a category in which inquiry is carried out to
understand (p. 40). As such, a theory-seeking/testing approach is considered appropriate. For
the evaluative purpose, on the other hand, the inquiry is carried out to understand and to
evaluate (p.41). Hence, it will also have a descriptive approach.

From the above discussion of approaches, decisions on the methods to be applied in the case
study must be made. Such decisions concerns what Yin (2018) refers to as the research
design. More closely defined as the logical sequence that connects the empirical data to a
study’s initial research questions and, ultimately, to its conclusions (p.26). According to
Savin-Baden and Major (2012, p. 152), this regards decisions on data collection and analysis.
To accomplish the objective and associated purposes of this case study, I regard the
qualitative approach and use of interviews as appropriate.

Case study interviews typically resemble guided conversations rather than structured queries
(Yin, 2018). This means that although a consistent line of inquiry exists, the actual stream of
questions in a case study interview is likely to be fluid rather than rigid (Rubin & Rubin,
2011, in Yin 2018). As such, case study interviews are ideal when the researcher wishes to
follow up initial responses by probing for additional information that can help clarify or
illuminate (Savin-Baden & Major, 2012, p.358).

This approach has helped inform the current case study. Relying on an interview protocol
covering topics of interest in a particular order has ensured the collection of information
important to cover both the instrumental and evaluative purpose of the study (See Appendix
2). Nevertheless, being able to stray from the interview protocol from time to time and include
additional questions in response to participant comments and reactions have enabled a deeper

27
understanding - both for the maturity assessment of the case firm’s compliance function and
to the applicability of the model in practice. Savin-Baden and Major’s (2012) statement that
“interviews are appropriate when a researcher wants to take advantage of the one-to-one
communication form in order to probe deeply into a participant’s experiences” (p. 358)
supports the latter.

For the last considerations to be made in regard to Thomas’ (2011) classification typology, we
look to the subject chosen. Here, this is the case firm. To decide on the operational processes
of the study, it is important to consider whether there should be a comparative element to it
(Stake, 2005, in Thomas, 2011, p. 516). This refers to the single/multiple case distinction,
which Yin (2018) presents as a choice between four different case study designs. Here, every
type of design includes a desire to analyze contextual conditions in relation to the “case” and
the primary distinction lies in choosing between a single- and multiple-case study.

In the first section of this chapter, it was stated that the choice of subject was decided on
based on its “exemplary-knowledge”. As the case study is focused on the maturity model, the
theory on which it is based specifies a clear set of circumstances under which the determining
factors of the model are believed to be true. Here, these circumstances will apply to the
compliance function within Norwegian investment firms. Hence, it is believed that choosing a
holistic single-case – a compliance function within a Norwegian investment firm - can
represent a significant contribution to knowledge and theory building (Yin, 2018, p.49) in the
research question posed.

The choice between single and multiple case studies further determines the boundary and
shape of the study. Single-case studies like the one conducted for this research project's
purpose often come in one out of three forms, wherein personal or systemic features of the
subject are bounded by some time aspect (Becker, 1992, in Thomas, 2011). Based on a
comprehensive literature review of different case studies, Thomas (2011) presents these three
forms as retrospective, snapshot, and diachronic studies (p.517).

To test the model and assess the maturity of the compliance function within the case firm it is
relevant to look into how the compliance function is organized as of today. This involves the
collection of data on how the case firm satisfies specific requirements for arriving at different
maturity levels. As the interview is aimed at collecting data to draw conclusions on this,
questions regarding existing procedures and processes will be relevant. To complete
Thomas’s (2011) typology, this process falls into the category labeled “retrospective”. The

28
reason is that it is the “as-is” situation of the firm that is of interest, and not to show change
over time (diachronic) or to analyze the collected evidence aided by a temporal juxtaposition
of events (snapshot) (Thomas, 2011, p. 517).

3.4 Research quality

Lincoln and Guba (1985) propose trustworthiness as a criterion of evaluation in qualitative

studies and describe four aspects to be considered. These are listed in Bryman et al (2019) as
credibility, transferability, dependability, and confirmability - and will in the following be
used in the evaluation of quality for this research project.

Credibility pertains to how believable the findings of the study are, and the implementation of
the credibility criterion is a twofold task. In this lie, firstly, to carry out the inquiry in such a
way that the probability that the findings will be found to be credible is enhanced and, second,
to demonstrate the credibility of the findings by having them approved by the constructors of
the realities being studied (e.g., the interviewee) (Lincoln & Guba, 1985, p. 296).

To increase the probability that credible findings were produced, this research project was
conducted according to the canons of good practice (Bryman et al., 2019). Testing the
developed model in a case study helps to ensure that the results obtained through the literature
study are not biased. Although they cannot be validated with the same scientific rigor as if the
model were applied in a formal experiment, it can at least provide implications on their
relevance. Further, member checking, whereas the interviewee provided feedback on the
findings served several purposes. For example, allowing the interviewee to correct errors of
fact and challenge what was perceived to be wrong interpretations of the data, has
strengthened the truth-value of the findings (Noble & Smith, 2015). What lies behind the
decision to use member checking is the recognition that multiple realities exist. Having the
interviewee assess the overall adequacy and confirm the information in which the data
constitutes, mitigates the chance of false reporting or misinterpretations of the information
due to the researcher’s own experiences and viewpoints being biased.

Similar to the concept of external validity in quantitative research, transferability is about the
extent to which the study findings can be transferred to other contexts or groups (Lincoln &
Guba, 1985). However, this concept differs from that used in quantitative research in that it is
the reader who must determine the degree of transferability to other contexts. To make this

29
possible, the researcher must provide sufficient information about the context of the study.
I.e., thick descriptions should be provided (Lincoln & Guba, 1985, p. 359).

In connection with Part B of this research project, which constitutes a case study, the need for
rich descriptions had to be weighed in relation to the informant’s need for anonymity (Morse,
2008). That the compliance function is an important function for firms’ earnings (this, in the
form, that it is both vulnerable in connection with the risks and consequences that comes with
the poor organization of it, and that it can create a basis for competitive advantage - see
Antonsen, 2020), has meant that the demographic description of the case company and quotes
from the interviewee's statements are anonymized.

According to Yin (2018), the most desirable option is for a case study to disclose the identities
of both the case and the individual informants (p. 239). Among other reasons, because
disclosure provides the reader with the opportunity to recollect any other previous information
he or she may have learned about the case from other sources in reading and interpreting the
current case study. In other words, anonymization may eliminate some important background
information – and can therefore be viewed as a limitation. However, the case firm was chosen
for it to portray an “ideal type” (Yin, 2018, p. 239), and therefore it is seen as justifiable not to
disclose any such information that could lead to recognition.

The assumptions underlying the CFMM and the context of the study, on the other hand, have
been described in such detail that the findings may be transferred to other cases nationally.
The requirements for the organization of the compliance function within investment firms in
Norway are mostly the same. Therefore, rich information on both the choices made for the
structure of the CFMM and the organization of the compliance function within the selected
case firm is seen as strengthening the study’s transferability to other Norwegian investment
firms.

The third criterion, dependability, parallel with the quantitative research criteria reliability.
I.e., it questions whether the findings are likely to apply at other times (Bryman et al., 2019, p.
48). To achieve dependability, researchers can ensure the research process is logical,
traceable, and clearly documented (Tobin & Begley, 2004 in Nowell et al., 2017, p. 3).

Throughout the current research process, there has been a focus on accurate data processing.
However, the possibilities that the findings from both the literature study and the case study
could be repeated, if the studies were repeated, are limited. The limitations include that
neither the topic (maturity models for the compliance function within investment firms) nor

30
the actors (the firm, its Head of Compliance, and external regulations) are static over time.
Also, that the researcher's role and own perception of reality is important for how data is
collected, interpreted, and analyzed might be a limiting factor.

However, by reporting how the research process has proceeded and what assessments have
formed the basis for choices made along the way, the reader can assess the dependability of
the study.

Lastly, the criteria of confirmability concern objectivity (Bryman et al., 2019, p. 48).
According to Lincoln and Guba (1989), confirmability is first established when the criteria of
credibility, transferability, and dependability are met (Nowell et al., 2017, p. 3). In the above
discussion on those three criteria, there has been shown to different “markers” throughout the
study that are meant to substantiate the readers' understanding of why and how different
choices related to the use of theory and research methods made. For example, it is referred to
the use of thick descriptions in presenting the context of the study, as this is considered
important for transferability. It is also discussed how member checking was used as a
technique to establish credibility. Arguably, this can be seen as part of providing a rationale
for the decisions made during the research project.

Further, how researcher subjectivity might have influenced choices when it comes to data
collection and analysis is elucidated in the discussions on choices made during the modeling
process. This to show awareness that one’s position and background may influence the
research process and consequently results.

3.5 Ethical considerations

According to Diener and Grandall (1978), discussions on ethics in business research tend to
revolve around four main areas. Whether there is harm to participants, lack of informed
consent, invasion of privacy, and lastly, whether deception is involved (Bryman et al., 2019,
p. 114).

Harm to participants entails many facets. For this research project, harm to career prospects or
future employment is considered to inhabit a risk of occurring for the participant. Since the
interviewee will provide information on the organization of the firm, thoughts on its culture
and structure – failing to anonymize its quotes could possibly harm the reputation of both the
firm and the interviewee.

31
The financial industry in Norway is strictly regulated. Statements disclosing weaknesses in
the organization of the compliance function could, for example, lead to an investigation by the
FSA. In a worst-case scenario, this could harm the case firm both economically and in terms
of its integrity. Also, since it is the interviewee who is in charge of the organization, such
information could damage his/her reputation and chances in a future career.

As such, the issue of harm to participants is addressed in ethical codes by advocating care
over maintain the confidentiality of records and the anonymity of accounts (Bryman et al.,
2019, p. 115). For this purpose, this research project was requested approved by NSD
(Norwegian center for research data) in advance of the data collection. As part of the
application, an information and consent form were designed. This form, which also formed
the basis for the approval from NSD, is the same as was signed by the participant (See
Appendix 3).

Through the form, the participant was provided with sufficient information about the research
project to make an informed and free decision on whether (s)he would participate in the study.
The information was provided in written form and formulated to be comprehensible for the
participant. This, as a measure to ensure that there was no explicit or implicit coercion and to
prevent deception (Bryman et al., 2019).

For applications to be approved by NSD, it must be assured that data about people and society
can be collected, stored, and shared, both safely and legally, today and in the future (NSD,
n.d.). This aspect, concerning privacy, is also covered in the form in terms of it describing
how the participant's privacy will be protected. First and foremost, it is declared that the
information collected is treated confidentially and in accordance with the privacy regulations.
Among other things, this includes the assurance that the information gathered is used for the
purposes described in the information letter only and that the material will be stored as an
encrypted file where names and other contact information will be replaced with codes. This,
to ensure that no unauthorized person can obtain any personal information. It is also assured
that study participants will not be recognizable in the publication and that the information is
deleted when the project ends.

On behalf of the University of Southeast Norway, NSD has assessed that the processing of
personal data in this project is in accordance with the privacy regulations.

32
3.6 Summary

Summarizing the above chapters on methodology, one can see how a strategy to answer the
research questions and attain the research objectives has been formed.

RQ1 reflects the main objective of this research project. Namely, to develop a model for
assessing the maturity of compliance functions within Norwegian investment firms. To do so,
knowledge on how to develop such a model is important. And, to attain that, a narrative
literature review is considered appropriate. The reason for choosing the narrative approach is
that it enables the establishment of a reasonable catalog of requirements for the design of
maturity models, before starting the actual process of developing a compliance function
maturity model.

The narrative literature review can be viewed as the first of two parts involved in the strategy
to attain the main objective. The second part is established by answering RQ2. Doing so
involves testing the developed model in practice. By looking to Yin (2018) it was decided that
this would be done using a case study method. This, assuming that understanding the case
firm and its compliance function in terms of requirements in the model would involve
important contextual conditions pertinent to the research.

The case study conducted in this research project was classified using Thomas’ (2011)
classification typology for case studies. Figure 4 summarizes this.

Figure 4: Case study classified using Thomas' (2011) typology.

In short, the focus of the study is the maturity model developed for the compliance function
within Norwegian investment firms. The theory on which it is based specifies a clear set of
circumstances under which important elements of the model are true. The case firm is chosen
because of its capacity to exemplify these circumstances. Therefore, assessing the “as-is”

33
situation of the firm (ref. a retrospective case firm) is thought to provide valuable insight into
the research problem.

Also, as RQ2 ask for the maturity of the compliance function within the firm to be assessed
using the model - the case study will also provide decision-makers within the case firm with
relevant information for enhancing their compliance function's effectiveness.

34
Part A – Developing a Compliance Function Maturity Model

4 Maturity models

Pullen (2007) defines a maturity model as “a structured collection of elements that describes
the characteristics of effective processes at different stages of development. It also suggests
points of demarcation between stages and methods of transitioning from one stage to
another” (p.1318).

Maturity models – also referred to as stages-of-growth models – have been widely used in a
vast array of domains to assess the maturity (i.e. competency, capability, level of
sophistication) of a selected business process, function, program, or system (de Bruin et al.,
2005; Poeppelbuss & Roeglinger, 2011; Solli-Sæther & Gottschalk, 2010, 2015). Working
both as a means of assessment and as part of a framework for improvement, maturity models
are developed to assist firms in deriving an informed approach for increasing the capability of
a specific area within the organization (Fraser et al., 2002).

The idea that maturity models can be used as an improvement framework, according to Solli-
Sæther & Gottschalk (2015), is based on the underlying assumption that predictable patterns
(in terms of stages) exist in the maturity/growth process in all parts of an organization. From
this, the core concept of maturity models is based on these stages being (1) sequential in
nature, (2) occurring as a hierarchical progression that is not easily reversed, and (3) involve a
broad range of organizational activities and structures (p.90).

4.1 Purpose

From the above description of maturity models, we understand that in practice, these are used
as roadmaps guiding firms in search for improvement. For such application, maturity models
must be capable of serving more than one purpose (Poeppelbuss & Roeglinger, 2011).
Rosemann and de Bruin (2005) call for both diagnosing the “as-is” and guiding towards the
“to-be” of the process, function, or system to be improved.

Becker et al., (2009) elaborate on the as-is assessment, which Poeppelbuss and Roeglinger
(2011, p. 4) refer to as part of the descriptive purpose of maturity models. Here, the current
domain under investigation is assessed with respect to given criteria and characteristics and

35
evaluated to identify its maturity level (Becker et al., 2009). Rummler and Brache (1990) used
the metaphor of making a diagnosis to describe this process.

If we use Rummler’s (1990) metaphor that a diagnosis has been made, the next purpose of the
maturity model should be prescriptive. Just as a doctor would give his patient prescriptions on
how to get well, the maturity model should give the firm guidelines for how to move forward
to reach the next stage of growth. In the words of Moultrie (2009) “specific and detailed
courses of action are suggested for each maturity level of a process area” (p.150).

The last purpose suggested by Poeppelbuss and Roeglinger (2011) is a comparative one. This
coincides with Batenburg et al. (2014) using maturity models to codify what might be
regarded as good practice and bad practice. This can be done because the models can be
designed to allow for both internal and external benchmarking. De Bruin et al. (2005)
emphasize how external benchmarking helps compare similar practices across organizations
(p.4). This, given sufficient data from a vast array of assessment participants is available when
the model is developed.

4.2 Criticism

Although their use is widespread – the underlying concept of maturity models is frequently
subject to criticism. Teo and King (1997) are among the researchers who are skeptical
towards the simplicity of the typical evolutionary maturity model. They point to the
“simplistic deterministic nature of such models” (p. 189) and claims that it limits the potential
for explaining complex organizational phenomenon. Holding the contingency perspective,
they emphasize that there are no predictable patterns, but rather multiple advantageous
pathways of growth. Lasrado et al (2015) highlight this criticism in their paper and show a
lack of theoretical foundations with developers adopting the CMM as their structure14 and not
conceptually grounding the structure from literature (p.6).

This concern that there is no inevitable linear sequence of stages in organizational life is
strengthened by the lack of empirical foundation proving the opposite (Benbasat et al., 1984).
That the core concept of maturity models is hard to prove empirically is another aspect of the
criticism that is being directed at maturity models. For example, Becker et al. (2010) point to
a lack of operationalizing maturity measurement, and Solli-Sæther and Gottschalk (2010)

14 Number of maturity levels, dimensions, etc.

36
state that the research related to stages of growth has to a large extent been conceptual while
the debate over the existence of stages itself has suffered from a lack of empirical evidence.

Besides discussing how researchers for decades have struggled to meet this criticism, Solli-
Sæther & Gottschalk (2010) also aim to develop maturity models that are both theoretically
founded and empirically validated. They present and tests a modeling procedure that might be
capable of doing so. In the next chapter, on the modeling process of maturity models, their
research is addressed alongside other research on the same topic.

5 Modeling process

5.1 Literature review on the modeling process

This chapter addresses research on the modeling process of maturity models. The research
presented is retrieved from a comprehensive literature review on the field of maturity and
growth modeling, covering different business management journals and articles that have the
term “maturity models” or “stages-of-growth” as keywords or in their title. Specifics on the
method used in the literature review were elaborated on in chapter 3, on methodology.

In order to establish a reasonable catalog of requirements for the design of maturity models,
many researchers (e.g. Batenburg et al., 2014; Becker et al., 2009; Maier et al., 2012; Mettler,
2011) have taken a design science research perspective. With regards to the modeling process
of maturity models, the design science perspective involves the understanding of maturity
models as artifacts serving to solve problems (March & Smith, 1995) in determining the status
quo of a firm’s capabilities and deriving measures for improvement therefrom (ref. the
descriptive and prescriptive purpose of a maturity model).

As for the process of maturity model design, research differs in how different artifacts
(constructs, models, methods, and instantiations) are deployed to develop frameworks for the
modeling process. For example, the current literature review reveals differences in the number
of phases of the procedure. Becker et al. (2009) suggest a procedure model consisting of eight
phases for the “theoretically founded development and evaluation of maturity models” (p.
217; 221). This by relying on seven guidelines for design science defined by Hevner et al.
(2004). De Bruin et al. (2005) propose a framework consisting of six generic phases, and
Solli-Sæther and Gottschalk (2010) and Maier et al. (2012) propose five phases. See overview
in Table 2.

37
 Research Phases Frameworks conceptualized
article
(Becker et al., 1) Problem definition
2) Comparison of
2009)
existing maturity
models
3) Determination of
development strategy
4) Iterative maturity
model development
5) Conception of transfer
and evaluation
6) Implementation of
transfer media
7) Evaluation
8) Rejection of maturity
model
(de Bruin et 1) Scope
2) Design
al., 2005)
3) Populate 1 2 3 4 5 6
4) Test
5) Deploy
6) Maintain
(Solli-Sæther 1) Suggested Stage
Model
& Gottschalk,
2) Conceptual Stage
2010) Model
3) Theoretical Stage
Model
4) Empirical Stage
Model
5) Revised Stage Model
(A. M. Maier 1) Planning
2) Development
et al., 2012)
3) Evaluation
4) Maintenance

Table 2: Overview of development frameworks reviewed

However, what is evident is that although they differ in the number of phases suggested, the
different frameworks all hold a process that in itself is evolutionary. This, as each phase offers
new challenges as soon as the challenges of the prior phase, are solved (Solli-Sæther &
Gottschalk, 2015, p. 90). Solli-Sæther and Gottschalk (2010), for example, refer to their stage-
of-growth modeling process as a goal-oriented procedure (p.7). What is meant by this is that

38
the maturity model changes its status from a suggested maturity model via a conceptual,
theoretical, and empirical model, and finally to a revised maturity model. Such a notion will
also cover the modeling process of de Bruin et al. (2005) as they describe the phases as
“guiding the development of a model through first the descriptive phase, and then to enable
the evolution of the model through both the prescriptive and comparative phases within a
given domain” (p. 4). The order of the generic phases is as such important because decisions
made in one phase will have implications for the next phase. However, all of the frameworks
also encourage iterative progressions throughout its phases to improve theory building and
empirical validation (Becker et al., 2009; de Bruin et al., 2005; A. M. Maier et al., 2012; Solli-
Sæther & Gottschalk, 2010, 2015).

As another step to improve the lack of empirical validation, which holds a strong position in
the critique against maturity models, Maier et al. (2012) take inspiration from Eisenhardt's
(1989) roadmap for developing theory from case studies (p.145). This includes alerting the
reader to the steps and associated decision points in the development journey. The use of case
studies also becomes evident in Solli-Sæther and Gottschalk's (2010, 2015) framework. Here,
in developing theory on the sequential nature of the stages are drawn from case studies.

5.2 Developing a Compliance Function Maturity Model

When developing a maturity model for the compliance function within Norwegian investment
firms, I find it relevant to take notes from various phases as presented in
Table 2. This, because many of the frameworks have shown to be evident also in practice (See
for example Solli-Sæther & Gottschalk, 2015). Additionally, it will help ensure a well-
structured and -documented modeling process.

To develop a foundation for (and an understanding of) the decisions that are made in the
process of developing a Compliance Function Maturity Model15, the first phase of this process
will consist of some of the elements included in the planning (Maier et al., 2012), scoping (de
Bruin et al., 2005), and problem defining (Becker et al., 2009) phases introduced in
Table 2.

5.2.1 Phase 1: Planning

As with every other project, it is clever to start with problem definition before initiating the
actual design process. According to Becker et al. (2009), problem definition includes

15 Hereafter CFMM

39
determining both the targeted domain versus partial discipline and the target group (p.217).
This is what de Bruin et al. (2005) refer to as the scope of the desired model. Determining the
scope will set outer boundaries for model application and use and will thus impact the
remaining phases of the process (p. 5). Table 3 reflects the major decisions to be addressed in
the planning phase.

Criterion Characteristic
Focus of Model Domain-Specific General
Development stakeholders Academia Practitioners Government Combination
Table 3: Decisions when scoping a Maturity Model, adapted from de Bruin et al. (2005, p.5)

In determining the focus of the model, one spells out which domain the maturity model will
target and be applied to. Here, it is normal to divide between a domain-specific or general
focus. I.e. whether the model is developed to assess and improve management in general, or
in a particular discipline – say for example, the management in software development (de
Bruin et al., 2005; A. M. Maier et al., 2012). With the initial focus of the model identified,
stakeholders from academia, industry, non-profits, and government can be identified to assist
in the development of the model (de Bruin et al., 2005, p.5).

Maier et al. (2012) suggest some additional decisions to be made in a planning phase –
namely to (1) specify the audience, (2) define aim, and (3) define success criteria for the
model. The term audience refers to all stakeholders who will participate in various aspects of
the assessment (Maier et al., 2012, p. 149). To specify the audience is important for the design
phase to come, because the design of the model should incorporate the needs of the intended
audience and how these will be met (de Bruin et al., 2005). Defining aims are related to
maturity models being seen as analytic strategies (Maier et al., 2012). Based on a
comprehensive review of existing models, Maier et al. (2012) suggest two overarching aims
or improvement paradigms. These are improvement through “raising awareness” and
improvement through “benchmarking” across companies or industry sectors (p. 149). Here,
benchmarking includes a comparison against an identified best practice example and making
statements about the performance of a whole industry sector in terms of a certain process or
capability. Raising awareness can be seen as a more analytic approach, where one aims for
evidence to determine what improvements are needed and whether an improvement initiative
has been successful. Benchmarking seems to incorporate “raising awareness,” but not vice
versa.

40
Finally, a definition of success criteria is suggested as a part of the planning phase. As these
will be manifested in the form of high level or specific requirements for the design of the
model, they become a basis for the evaluation of whether the development and application of
the model were successful (Maier et al., 2012).

A plan for The CFMM

To effectively manage risk, firms must establish appropriate internal control to provide
reasonable assurance regarding the achievement of objectives relating to operations,
reporting, and compliance (Msib & Foster, 2019). Compliance objectives pertain to adherence
to laws and regulations to which a firm is subject. Failing to do so may lead to legal or
regulatory sanctions, financial loss, or loss of reputation (Singh, 2005). In the Norwegian
financial market MiFID II, implemented by law in 2018, requires firms to implement a series
of systems and controls aimed at securing an effective risk management process (ILA Norge,
2015). This includes policies and procedures to ensure regulatory compliance and the
establishment of a permanent, independent, and effective compliance function (ESMA
guidelines, p). However, adaptations and changes to ensure an effective compliance function
cannot be made overnight. Therefore, the aim is to develop a maturity model for the
compliance function within Norwegian investment firms, to be applied for raising awareness
about the “as-is” situation for the firm using the model. The results can then be turned to
making recommendations for where to go next to improve the effectiveness – or maturity – of
the firm’s compliance function. This means that the model, first and foremost, will have a
descriptive and prescriptive purpose.

With the focus being domain-specific, it is important to gather information about the context,
the idiosyncrasies, and terminology of the specific domain for the model to be understood by
and be of relevance to the audience (A. M. Maier et al., 2012, p. 150). The audience of the
CFMM can be thought of as “industry professionals”. E.g., CEOs in charge of corporate
planning or Chief Compliance Officers who wish to measure how their department is doing -
and see what can be done better. For that reason, development stakeholders that might be
helpful in that regard can be both academia and practitioners. For example, literature studies
on the field will provide insight into the peculiarities of the phenomenon, and ideas from
practice can further complement such information.

In general, the CFMM is meant to be used by and be useful for investment firms in the
Norwegian financial market. Success criteria for usability, as such, shall pertain to the clarity
of the language used and the architecture and rating scale of the model shall not be too
41
complex (either not too simple) for non-academics without prior knowledge of maturity
models to apply. On the other hand, criteria for usefulness will revolve around whether the
model shows out the be helpful – i.e., whether it triggers reflection and learning among its
audience. This will be answered when testing the model together with its intended users (see
Part B of this project).

5.2.2 Phase 2: Design

As soon as the scope of the model is set, it is time to determine a design or architecture for the
model (de Bruin et al., 2005). Seemingly all of the process development frameworks reviewed
for this project emphasize the importance of a comprehensive comparison of existing maturity
models as a foundation for the design phase. This, because shortcomings in existing models
can motivate modifications for enhancement, structures or design ideas can be transferred, or
content from one domain can be found interesting to apply to another domain (Becker et al.,
2009; Solli-Sæther & Gottschalk, 2010).

However, it is not only the existing literature on maturity models one should have a good
overview of. In designing a maturity model, decisions about the process areas to be assessed,
the maturity levels to be assigned, and its related cell descriptions (Maier et al., 2012, p.150)
call for references to an established body of knowledge on the field in which the maturity
model is to be applied. This is elaborated on by Solli-Sæther and Gottschalk (2010, 2015) as
they describe what ought to be done in phase one of their modeling process referred to as
developing the suggested stage model. In their framework (2010), they make a distinction
between theoretical and empirical work related to the five phases. The theoretical work of
phase one, which is of most relevance to this project, includes a thorough literature review on
the field in which the model is to be applied to get indications on the theoretical concepts and
definitions that will be of importance when defining maturity levels and descriptions (Solli-
Sæther & Gottschalk, 2015, p. 90).

In the sections below, I will address three important building blocks, that are important in the
design phase according to existing frameworks and research. As for this thesis, the design
process is meant to result in a “first draft” of a maturity model for the compliance function.
Therefore, theory on compliance will be discussed on the basis of these building blocks.
Theory and knowledge on the compliance function in investment firms are retrieved from an
extensive literature review connected with preparatory work for this thesis in the autumn of
2020. Ideas from practice are also considered through reviewing and comparing existing

42
maturity models developed by practitioners to be applied in the same - or similar – domains.
See Appendix 1 for further details on these.

Process areas

Within existing maturity models a common design principle is to represent maturity as a

number of cumulative stages where higher stages build on the requirements of lower stages
(de Bruin et al., 2005; Rosemann & de Bruin, 2005). How many stages there are may vary
from one model to another, but there is a general agreement among researchers and
practitioners that the stages need to be distinct, well-defined, and need to show a logical
progression (de Bruin et al., 2005; A. M. Maier et al., 2012). Arguably, this is because clear
and distinct definitions ease both the descriptive and comparative purpose of the model (e.g.,
positioning the firm along an evolutionary scale), but also the prescriptive purpose if it gives
clear guidelines and criteria for the firm to grow more mature.

It follows from this, that each stage should be labeled with a name that provides the audience
with a clear indication of what it entails. However, a more thorough definition of each stage
name should also be provided to elaborate on the requirements and measures of the stage. De
Bruin et al. (2005) suggest that this is done either through a top-down or a bottom-up
approach. From a top-down approach, the emphasis is firstly on what represents maturity and
then how this can be measured. Typically, a top-down approach works well if the field is
relatively new and there is little evidence of what is thought to represent maturity (Maier et
al., 2012, p. 151; Rosemann & de Bruin, 2005). In a more developed domain, where there is
existing evidence on what represents maturity, the focus moves first to how this can be
measured and then builds definitions on this basis (de Bruin et al., 2005, p.6).

Maier et al. (2012) suggest starting the design phase by selecting the process area to be
assessed. A key process area identifies a cluster of related activities that enables the
achievement of a set of goals considered important for establishing process capability at each
maturity stage (Domingues et al., 2016; Hammer, 2007). In existing maturity models, process
areas have been labeled differently based on the improvement entity. Key attributes,
components, pillars, or categories are examples of different labels that are used. However, a
common goal (regardless of the label) is to identify key process areas that are mutually
exclusive and collectively exhaustive. To accomplish this, the assessment should be based on
an underpinning conceptual framework generated from principles of good practice (Maier et
al., 2012, p. 150).

43
There are many ways in which the assessment of process areas can be done. Literature
reviews have brought fore that the most common strategies are expert interviews (Batenburg
et al., 2014; Solli-Sæther & Gottschalk, 2015), synthesizing critical and frequently mentioned
concepts in the literature (Rosemann & de Bruin, 2005), and understanding and recognizing
organizational process goals as a point of departure for defining the key processes. This last
alternative is described more closely by Maier et al. (2012). It includes defining associated
goals necessary to achieve the overall objective of the firm for so to derive key process areas
from these goals (p.150).

Process areas of the CFMM

The predominant objective of the CFMM is to assess the maturity of the compliance function
within Norwegian investment firms. Although the explicit establishment of separate
compliance functions in the financial services sector was not evident before the late 1990s,
ample literature from both academia and practitioners is available for synthesizing critical and
frequently mentioned concepts (Rosemann & de Bruin, 2005). The reason is that the function
was established as an answer to several business scandals exposing weaknesses in regulatory
risk management and internal control (Ramakrishna, 2015; Steinberg, 2011). And that again
called for more research on how the control functions should be organized to become
effective and mitigate such weaknesses.

Although there is no “canon of theory to which all scientist refer” (A. M. Maier et al., 2012, p.
154) in the field of corporate compliance, existing literature is rich and cross-references are to
be found concerning aspects of organizing an effective compliance function (and meeting the
challenges in doing so). Also, regulatory bodies have, with regards to the MiFID II directive,
explicitly stated what aspects they see as particularly important - and developed guidelines for
implementing these. Therefore, a bottom-up approach has been used in defining the maturity
steps of the CFMM. This means that identified factors that influence the effectiveness of the
compliance function are used to define the maturity steps of the model (de Bruin et al., 2005).
In addition to reviewing the research addressed in the preliminary project and guidelines from
the regulatory body, a comprehensive comparison (Becker et al., 2009) of existing maturity
models on corporate compliance and governance have been completed to identify key factors
of the compliance function.

The review conducted in preliminary work with this thesis addresses research on firms’
commitment to ethics and regulatory compliance conducted as early as in the 1990s. Already
then, the discussion evolved around measuring the effectiveness of compliance programs and
44
their importance to firms’ overall financial performance ( C. Verschoor, 1998; Laufer, 1999).
At the turn of the millennium, however, the research focus was expanded to also involve the
identification of challenges in establishing an effective compliance function and frameworks
that take note of them (Frigo & Anderson, 2009; Kharbili et al., 2008; Mitchell, 2007; Vicente
& Mira da Silva, 2011).

The challenges addressed in organizing an effective compliance program was the emergence
of workplace silos (Frigo & Anderson, 2009, p. 20; Kenton, 2019), costs rising from
redundancy and miscommunication (Loh, 2019; PwC, 2004, p. 6), and changing
environmental and regulatory conditions (Kharbili et al., 2008). As a step to meet these
challenges, it seems to be commonly accepted that the compliance function should be
organized to be proactive rather than reactive and that it should be part of a holistic approach
to meet integrity risk. I.e., that it is coordinated with other control functions and connected to
all business lines in the firm.

Appendix 1 provides details on the existing maturity models that have been reviewed. Even
though they are labeled differently, there is an underlying agreement of what components are
deemed important for the effectiveness of an established compliance function. For example,
the review reveals that many key processes evolve around four “enablers” suggested by
Deloitte (2017). Namely: people, process, technology, and analytics. More closely, it seems
important that processes and policies are clearly defined and documented (The Compliance
Maturity Survey, 2009; RSA Archer Compliance Management, n.d.).When it comes to people,
resources (in form of requisite skills and experience) and autonomy is in focus. For
technology and analytics, connected and integrated technology is important for both
monitoring and reporting (Deloitte, 2017).

Looking at the compliance function requirements set out by the MiFID II directive, and made
explicit in ESMA’s guidelines, similarities to the above-mentioned key components becomes
evident. Cf. Article 22(3)(a) of MiFID II Delegated Regulation, the compliance function must
have the necessary authority, resources, expertise, and access to all relevant information to
work effectively. ESMA’s Guideline no. 5 on the effectiveness of the compliance function
elaborates on this. What it says is that in ensuring appropriate human and other resources are
allocated to the compliance function, the scale and types of investment services, activities and
ancillary services undertaken by the firm must be considered. This means that the number of
compliance staff coinciding with what is required for the tasks is considered important for the
function’s effectiveness. Further, sufficient IT resources are important, not only for the
45
information flow to be efficient in itself but also for the compliance staff to have access to
relevant information at all times. I.e., access to relevant database and records will ensure that
the compliance officer has relevant information that is important to disclose and mitigate
compliance risk and plan adequate controls and policies. At last, Guideline 5 also emphasize
the importance of the firm putting in place necessary arrangements to ensure an effective
exchange of information between the compliance function and other business units (i.e.
ensuring that it is not siloed) (ESMA, 2020b, p. 34).

Further, the first subparagraph of Article 22(2) of the MiFID II Delegated Regulation requires
firms to ensure that the compliance function performs its tasks and responsibilities on a
permanent basis. This is also seen as important for the effectiveness of the function, because
ensuring competent persons to take over the functions of the person who usually perform the
tasks, for example in the event of planned or unforeseen absences (Bahr, 2020, p.20), might
save the company from violating with regulations in such periods. Therefore, the guidelines
require responsibilities and processes, as well as expected competence and authority of the
compliance function, to be explicitly defined and set out in a ‘compliance policy’ and other
general policies or internal rules.

From reviewing the literature, existing maturity models, and regulatory guidelines on the
domain, the following key process areas of the compliance function is suggested:

1. Processes
Should be clearly defined and implemented – meaning that compliance processes should have
well-thought-out and documented procedures, which also must be understood by employees
and other stakeholders to arrive at an effective compliance solution (GAN Integrity, 2020).
The latter is important because having well-defined processes and policies that should
mitigate risk considerably, does not help if they are not understood and followed. Laufer
(1999) commented on this in his work, pointing to how the effectiveness of compliance
programs was hard to determine, as the firms could “simply adopt the appearance of a
program” and put less effort into actually preventing wrongdoings and violations (p.1343).
Oded (2013) supplements this, saying that it will hinder firms from implementing the
procedures and engage in effective self-policing.

2. Resources
Appropriate human and financial resources must be allocated to the compliance function.
When it comes to human resources, ESMA (2020b) emphasizes both the capacity and
46
capability of the function. This means that the compliance function must have enough
employees to handle the risk the firm is exposed to, and that compliance employees regularly
are provided with training in order to maintain their knowledge (ESMA, 2020; FSA Norway,
2015). Sufficient financial resources (e.g., size of budget) provided to the compliance function
have proven to be critical to its effectiveness. Hence, it protects the firm against financial
losses and damaged reputation (C. Verschoor, 1998).

3. Technology
Ever since the incubation of start-ups in Silicon Valley started, firms have sought to increase
efficiency and transparency through the use of technology (Deloitte, 2017, p. 5). As illustrated
in existing models assessing the maturity of firms’ compliance initiatives, effective
compliance programs should be supported by an automated system that removes friction and
gathers data and reports on real-time analytics (GAN Integrity, 2020). What technology will
be right for the firm will depend on the maturity of the other key process areas, however,
creating capacity for the employees to focus on activities of higher priority (from a risk
perspective) through automation will enhance efficiency either way.

4. Coordination

Workplace silos have been defined as “groups or departments within an organization that
work in a vacuum with little functional access to other groups, or little communication with
them” (Loh, 2019). The lack of cooperation and communication between different risk and
control functions – as well as other business units - has shown to create accountability and
communication gaps, as well as redundancies and confusion (PwC, 2004, p. 6).

Vicente & Mira da Silva (2011) refers to the Open Compliance and Ethics Group’s (OCEG)
notion that “compliance is the act of adhering to, and the ability to demonstrate adherence to,
mandated requirements defined by laws and regulations, as well as voluntary requirements
resulting from contractual obligations and internal policies”. According to Vicente and Mira
da Silva, organizations need an effective approach to verify that they conform to external and
internal rules. This approach is, according to OCEG’s statement the responsibility of the
compliance function. Vicente et al. (2011) shed light on how this function, in order to
constitute an effective approach, needs assistance from risk management in identifying and
prioritizing risks. And also, from the governance function which before this must have
defined those risks and aligned them to corporate objectives (p.10).

47
5. Business integrity
When you want to solve a problem in mathematics, it is normal for one variable to be held
constant. This metaphor is used by Ramakrishna (2015) to describe how having fundamental
principles of business integrity at place is important for the effectiveness of the compliance
function when both the external and internal environment of the compliance system is in a
state of constant flux (p.159). This has also been a fundamental part of all the reviewed
frameworks for organizing firms’ governance, risk, and compliance initiatives, suggested by
practitioners in the field (see for example the OCEGs and PwCs standard concepts16). As
such, the firm’s responsibility and commitment to integrity risk management (e.g. Tone at the
top and Tone at the middle) is critical for the effective functioning of the compliance
initiatives set to live (Deloitte, 2018, p. 9).

These five key process areas are expected to be evident in all stages of the maturity journey of
the compliance function. Their characteristics, however, will evolve from the first stage to the
last. Beneath, an explicit statement of the underlying rationale for the intersection of key
process areas and maturity stages the CFMM will be provided as an approach to promote
theoretical rigor (Lasrado et al., 2015; A. M. Maier et al., 2012, p. 151; Solli-Sæther &
Gottschalk, 2015).

Maturity levels and their intersection with process areas

Following Maier et al. (2012) further; having identified key process areas, the next step in the
design phase is to define a set of maturity levels and decide what rationale informs the rating
scale (p.15). To ensure the comparability of maturity assessments, the criteria should exhibit
a high level of intersubjective verifiability, i.e., the corresponding descriptions are precise,
concise, and clear to discriminate between levels (Moultrie, 2009). For this purpose,
Roeglinger et al. (2012) also call for a definition of the underlying notion of maturity and an
underpinning theoretical foundation concerning organizational evolution and change. This
includes among other things information about the way change typically happens in the
respective application domain as well as about drivers and barriers of maturation
(Poeppelbuss & Roeglinger, 2011, p. 8).

16OCEG’s Principled Performance is about “the reliable achievement of objectives while addressing
uncertainty and acting with integrity” (VComply Editorial, 2017).
PwC’s Integrity-Driven Performance strategically integrate governance, risk and compliance into their
business, to from an ethical and operational backbone to how businesses is managed (PwC, 2004).

48
According to Maier et al., (2012), what rationale informs the rating scale is related to
decisions on leverage points for organizational change. Kazanjian & Drazin's (1989)
argument that “organizations undergo transformations in their design characteristics which
enable them to face new tasks or problems that growth elicits”, underpins this. In terms of the
architecture of the maturity model, what can be understood therefrom is that each maturity
stage should be defined based on the characteristics of - or requirements to - the key process
areas at that stage. Solli-Sæther & Gottschalk (2010) refer to this part of the modeling process
as defining benchmark variables or formulating cell text.

Maturity stages in the CFMM

An analysis of cell descriptions of existing maturity models reveals how the same subject can
be conceptualized in different ways. This is interesting because it says something about the
researchers’ views of a firm, its processes, people, and products, and these conceptualizations
impact organizational change initiatives as they specify leverage points. Maier et al. (2012)
have performed such an analysis and suggest four underlying notions of maturity: 1) existence
and adherence to structured process; 2) alteration of organizational structure, 3) emphasis on
people; and 4) emphasis on learning (p. 148).

Conceptualizing the maturity of the compliance function within firms, however, it seems
deficient to rely solely on one of the aforementioned notions. Based on the identified key
process areas of the compliance function (see “Process areas of the CFMM”) an emphasis on
the existence and adherence to structured processes seems appropriate. This, as maturity
models using infrastructure, transparency, and formality as leverage points defines maturity as
“the extent to which a specific process is explicitly defined, measured, controlled, and
effective” (Paulk et al., 1993, referred to by Maier et al, 2012, p 148).

Defining maturity as the degree to which a process is institutionalized and effective coincides
with one of the key components of the compliance function being seen as well-documented
and implemented compliance processes. If one were to map out the maturity journey on this
aspect alone, one could rely on the definitions suggested by the CMM model (See Appendix
1) The first level (defined “Initial”) covers recently established processes performed on an ad-
hoc basis, and the latter (defined “Optimized”) involves processes being measured and
controlled and continuously improved. Further, there has also been a focus on the support
from automated systems to relieve employees in the compliance function to focus on the areas
of the firm that are most vulnerable to compliance risks. Most often, the architecture of

49
maturity models assessing information systems is adopted from the Software CMM –
evaluating the system on an ordinal scale, as exemplified above.

In terms of coordination, compliance initiatives will be more effective/mature as execution

and oversight can be integrated among different control functions (Deloitte, 2017). As such a
compliance function that works in a vacuum with little functional access to other groups, or
little communication with them (Loh, 2019) will be seen as less effective because
accountability and communication gaps will lead to poorer management of control risk. With
regard to coordination of control functions, organizational change could also be initiated via
structural changes in job roles and training in skills and methods—which also makes it a
candidate for focus on organizational structure or people.

However, an emphasis on learning in discriminating between the maturity levels also seems
adequate for this study. This, because it in a prescriptive manner can raise awareness towards
adequate actions and attitudes. For example, in their study of communication in complex
product development, the underlying notion of change for Maier et al. (2008) was that
proactive actions are favored over reactive ones. In regard to the CFMM, one can make an
example of the key process area referred to as “Business integrity”. The underlying rationale
for choosing this as one of the key process areas of the compliance function is basically that
the overall attitude towards responsibility and commitment to integrity risk management in
the firm is critical for the effective functioning of the compliance initiatives set to live
(Deloitte, 2018, p. 9). Tone at the top was set as an example of this. Tone at the top refers to
the ethical atmosphere that is created in the workplace by the organization's leadership
(ACFE, n.d.). What lies in this is that whatever tone the management sets will have a trickle-
down effect on the employees of the firm. If the tone set by managers upholds ethics and
integrity, employees will be more inclined to uphold those same values.

As for how the aforementioned is connected to the maturity of the compliance function, one
can see to Ramakrishna's (2015) distinction between passive and active compliance. Positive
and active compliance is defined as the proactive responsiveness of an organization to follow
a set of rules and standards yielding to change without disruption of its or the systems'
structure and function, inclusive in approach for the well-being of itself and its stakeholder (p.
67). This approach to compliance is believed to form a basis for many of the underlying
drivers yielding the firm benefits from compliance through business integrity principles.

50
From the introduction, we understand that such benefits, however, only will become evident if
the compliance function is organized in an effective manner. The number of resources
allocated to the compliance function by the management will give indications on the mindset
and attitude of the firm towards ethical business. A study by Harvey (2004) exemplifies this
in a good manner. Conducting a cost-benefit analysis of compliance in financial firms, Harvey
finds support for what was already well acknowledged. Namely, that avoidable costs saved by
acting compliant are revenue earned. However, she also adds that it is the intangible benefits,
like better reputation, competitor relationships, employee morale, and customer satisfaction
(Harvey, 2004; Kenton, 2020), that really adds to the bottom line, and hence ensure value
creation and perpetuates a healthy and sustainable growth of the business. So, even though the
cost of compliance is high and continuously increasing, “it would be a brave person who steps
up to say that it is too high a price to pay for countering terrorism and serious crime”
(Whitehouse, 2003, in Harvey, 2004, p. 343). As such, in terms of resources, one can say that
for the compliance function to mature, the right amount of resources – given the
proportionality principle (ESMA, 2020b) – must be allocated to it.

Based on the above reasoning, the CFMM is both processes- and learning-oriented, and
hence, the maturity stages and associated cell texts will be defined accordingly. See Figure 5.

Figure 5: Conceptualized process and learning-oriented maturity model.

51
The stage definitions will give an immediate indication of the existence and adherence to
structured compliance processes as well as whether the compliance function can be referred to
as reactive or proactive. Based on existing governance and compliance maturity models and
concepts from reviewed literature, the following four stages are suggested:

Level 1: Reactive and inconsistent

Level 2: Organized but reactive
Level 3: Actively managed and understood
Level 4: Proactive and implemented

For the descriptive purpose of use, cell descriptions provide specific descriptions on
characteristics expected from each process area, at each distinct maturity level. They will be
phrased as clear statements to avoid misconceptions in evaluating whether the cell’s statement
corresponds to the firm’s situation. Since specific characteristics of each process area have to
be implemented to reach a new level of maturity – it can be argued that improvement
measures for the prescriptive purpose of use are implicitly included in the model (Poeppelbuss
& Roeglinger, 2011, p. 11). The descriptions are added to the model and will therefore
become evident in the next chapter.

5.2.3 Phase 3: Presenting the Compliance Function Maturity Model (CFMM)

In this chapter, the model developed to assess the maturity of the compliance function within
Norwegian investment firms – The CFMM – will be presented. Until now, relevant literature
on compliance and a comprehensive comparison of existing maturity models have been used
as input in the modeling process. At this point, the discussions on the different building
blocks of the maturity model will be summarized and merged into what can be seen as a “user
guide” for the model, explaining how it should be understood and used for a maturity
assessment.

Figure 5 illustrates that the greater extent to which a firm adhere to established and structured
compliance processes and has a proactive approach to compliance – the more mature their
compliance function is expected to be. However, it does not provide clear guidelines on how
to position a firm along the evolutionary stage. That is, to decide whether a firm should be
categorized as “Reactive and inconsistent” or “Actively managed and understood”. Figure 6
eases the model’s descriptive purpose by establishing clear and distinct criteria for what to

52
expect from each key process area17 (de Bruin et al., 2005; A. M. Maier et al., 2012) at each
distinct maturity stage.

As for the rating scale of the CFMM, ISO 9001 (see Appendix 1) is looked to as an example.
ISO 9001 is a binary model, whereas the firm is either ISO Certified or not, depending on the
overall score of maturity (M. Paulk, 1994). For the CFMM, whether the firm meets the
criteria of each distinct maturity stage can be decided on, on a binary pass/fail scale (with
scope for minor deviations). As such, the CFMM can be used in two different ways, which
will result in the same positioning of the firm. These two “pathways” will be described in the
following sections.

The first pathway starts with the assessor comparing the situation in the firm as-is, with the
requirements set out in the cell descriptions associated with Level 1. Having “ticked-off”
boxes that can be “ticked-off” at Level 1, the assessor moves on to perform the same activity
for Level 2, and further. For the second pathway, the assessor performs the same activity of
comparing the as-is situation in the firm with the cell text descriptions in the model. But,
instead of moving upwards level-vise, an assessment is made for each key process. This
involves comparing each key process of the CFMM with that of the firm as of today and place
these at the level that fits with the real-life situation of the firm.

Regardless of which path is applied for the as-is assessment, the current situation of the firm
is assessed with respect to given criteria for the different process areas (Becker et al. 2009, in
Poeppelbuss & Roeglinger, 2011). Hence, in most cases, the assessor will experience that the
firm does not fulfill all criteria for each distinct maturity level. For example, the compliance
function might be supported by business integrity principles that foster a healthy compliance
culture and compliance processes that are well-integrated into the workflow, while on the one
hand, it is reactive and inconsistent in terms of technology and automated systems. Here, the
prescriptive purpose of the CFMM comes into the picture.

As Feise (2020) describes it, from doing a self-assessment and taking inventory of where the
compliance function stands as of today, low-hanging fruit can be identified, allowing the firm
to develop a plan for addressing the function’s most significant areas of growth. I.e., through
understanding the as-is situation of the firm (its unique starting point), the CFMM will
provide clear guidelines in form of cell descriptions as to how the firm can optimize its
compliance function and organize it to be as effective as possible. From the example above,

17 In the CFMM labeled “Key enablers”.

53
this would involve prioritizing supporting technology and automated processes to optimize
the compliance function and make it more effective.

All processes are Some processes are All processes are All processes are
manual. No supported by supported by and
automated others are
systems in place. automated systems. integrated in one and
manual. same automated
system.

No functional access Defined lines of All business lines Alignment of strategy,

communication and work towards shared processes, technology
and communication
mutual functional goals and initiatives. to shared goals to
with other business access. Lack of improve efficiency.
lines. mutual direction.

Defined and Understood by Integrated in the

Not documented.
documented, but not employees and workflow, continuously
Ad-hoc in response
integrated to the measured, and
to incidents. integrated to the
workflow workflow. improved.

Insufficient resources Appropriate resources Scalable risk-adjusted Continuous monitored

necessary to achieve and effectively adapted
allocated. resource deployment.
compliance. to changes in
Assessment done
compliance
periodically. requirements.

Time is spent Fosters a healthy

Compliance viewed Business ethics and
consulting and compliance culture.
as a necessary evil. values are defined
involving employees in Employees naturally
centrally. promote it.
business ethics and
values

Reactive and Organized Actively Proactive and

inconsistent but reactive managed and integrated
understood

Figure 6: The Compliance Function Maturity Model

The proposed model is further to be tested (ref. Phase 3: Testing) through interviews with a
Chief Compliance Officer in a relevant Norwegian investment firm. This, because the primary
value of model lies in the compact presentation and its practical approach which can guide
firms to improve their compliance maturity (Batenburg et al., 2014). And for that purpose, the
interview will not only be useful for assessing the maturity of the compliance function within
the case firm, but it will also reveal whether the model has relevance to practice (Phase 4:
Evaluation). This will be the focus next, in Part B of this thesis.

54
Part B: Testing the CFMM in practice – An empirical study
In the introduction to this master’s thesis, the main objective was presented as being the
development of a compliance function maturity model for use within Norwegian investment
firms. In part A, the CFMM was developed based on a set of design principles retrieved from
a literature study on maturity models and complementing literature on the field of corporate
compliance.

The accomplishment of the main objective, however, presupposes that the model is
compatible with practice. For that reason, RQ2 was established to make sure that some
underlying - but important - objectives were fulfilled. Namely, that the model was tested and
evaluated in a real-life case. The methodology chapter describes how answering the research
question through a case study and a semi-structured interview helped to accomplish this.

Chosen because of its capacity to exemplify the analytical object of the inquiry, an
examination of the selected case firm contributes to establishing knowledge about the context
in which the compliance function operates. This is important because the model is developed
for assessing the maturity of the compliance function within Norwegian investment firms
specifically. The questions in the interview protocol are therefore formulated so that they first
and foremost capture the information considered important for conducting a maturity
assessment of the firm’s compliance function (See Appendix 2). However, information about
the structure and other characteristics of the firm and its compliance function may also say
something about the usability and usefulness of the model - and hence makes out a basis for
evaluating that.

As previously explained, the interviewee was chosen due to his/her position in the case
company. As Head of compliance and Risk, the interviewee is responsible for the
organization of the compliance function and will thus be a relevant user of the CFMM.
Allowing the interviewee to test the model in practice, without the intervention of the
undersigned, allows for a more objective evaluation of the model. Therefore, at the end of the
interview, the CFMM was also handed out to the interviewee for being tested in the
assessment of the case firm’s compliance function. Having performed this task, the second
part of the interview was conducted. Here, relevant questions on what the interviewee thought
of the model's structure, language, cell descriptions – i.e., information about its usability and
usefulness – was posed.

55
In the chapters to come, data from the interview will be elaborated on and discussed in a way
that allows us to come to some conclusions regarding how we stand in attaining the main
objective of this research project. This starts with an introduction of the case firm and
information that shed light on the firm's processes related to compliance being be presented.
Next, it is mapped how the compliance function of the firm meets the requirements listed in
the CFFM and based on this, a maturity assessment of the compliance function is conducted.

At last, based on both the undersigned's and the interviewee's experience using the CFFM for
the maturity assessment and as an improvement framework – an evaluation of the model itself
is presented.

6 Introduction of case firm

When using the segmentation function on proff.no, it appears that in Norway, 160 firms are
registered under the NACE code 66,120 Securities brokerage (Proff – Segmenteringsverktøy,
n.d.). By filtering further, so that one is left with firms that have over 20 employees18, 40
unique firms remain on the list. On average, these have about 85 employees. In this sense, the
case firm19 is considered representative of the industry with approximately 90 employees.

The client base of the Firm is diversified, including corporations, institutions, non-profit
organizations, and private individuals. Investigating the different firms appearing on the list,
this appear to be a common practice for Norwegian investment firms. Once again, confirming
the relevance of testing the CFMM within the Firm.

Since it was founded in the early 2000s, the Firm has experienced strong growth. It emerges
from the interview that the Firm first became large enough that it was perceived as relevant to
establish a separate compliance function 5 years ago. The person who currently is Head of
Compliance within the Firm was then appointed the position. Considering the period, the first
years’ work was characterized by adapting the business to the requirements of MiFID II.

Until last year, Head of Compliance was alone was responsible for the function. However,
due to changes in the Firm's structure due to its growth, the department has now been
expanded and is expected to consist of 3 full-time positions before the end of 2021.

18 This is done to avoid counting the same employees more than one time, as it appears that the
different branches of the same firms are registered as separate entities as well.
19 Hereafter referred to as the Firm

56
With support from the management and the board, Head of Compliance is concerned with
learning and further developing the firm’s compliance function. Therefore, when requested,
(s)he found it very interesting to participate in the testing the CFMM and talk about the
effectiveness and organization of the function. This has, after all, been in focus in line with
the Firm’s evolvement.

Based on the interviews conducted, the next chapters will be used to present how the
compliance function of the Firm is organized as of today, and thus how mature it is according
to CFMM. Based on this assessment, a proposal will also be presented for how the function
can be further developed in terms of effectiveness - ref. the model’s prescriptive purpose.

6.1 Organization of the compliance function

The area of responsibility for the compliance function is to ensure compliance with laws and
regulations. Within the Firm, the responsibility of the compliance function lies in the “second
line of defense”. That is, it is a post-control function after first-line control20.

The regulations that must be complied with are defined based on which licenses the Firm
holds - and the interviewee confirms that MiFID II is particularly important and sets out a
framework for the organization of the Firm’s business. Thus, The Securities Trading Act, the
Money Laundering Act, and other legislation in which the MiFID II requirements are
implemented, also form the basis for which the Firm’s processes and routines are defined.

Following that, the Firm also defines compliance risk as a separate risk related to which
deviations may occur in connection with breaches of legislation and industry standards such
as the ESMA guidelines. The risks detected appear in the company's risk matrix (an explicit
statement of the overall risk assessment of the firm), where all the various business areas that
may involve such risks are assessed in accordance with the probability of events occurring -
and their following consequences. This matrix further forms the basis for the Firm's internal
control - which provides guidelines for compliance function's work (i.e., monitoring
program/compliance plan).

20 The first line owns the operational risk and must therefore ensure that satisfactory internal control is
carried out by employees in the "line", i.e., advisers, case officers and like. This means implementing
measures to ensure that the business is run in accordance with external and internal requirements.
This includes checking and following up the risk of breaches of compliance, as well as implementing
corrective measures where this is considered necessary to deal with process and control deficiencies
(IIA Norge).

57
Furthermore, it is stated in the job description of Head of Compliance and Risk, that the
function is to report to the CEO, but also directly to the board. The latter to ensure the
independence of the function.

Based on the above mentioned, the compliance function within the Firm can be considered to
at least meet the requirements for the function to be permanent and independent - as described
in ESMA’s guidelines (ESMA, 2020b, p. 6). Still, how effective the function is, is yet to be
figured out.

The interview with Head of Compliance and Risk in the Firm has provided information
related to the Firm's overall integrity, how resources are allocated to the compliance function,
its internal policies and processes, how the compliance function interacts with other business
functions, and the use of technology in its’ workflow. This information will in the further be
analyzed in light of the requirements of the CFMM, and eventually, result in a statement
about the maturity of the function and potential measures for improvement.

6.2 Maturity assessment of the compliance function

6.2.1 Business Integrity

In the CFMM, business integrity is linked to whether the firm "fosters a healthy compliance
culture in which employees naturally promote". That this is important for an effective
compliance function, is in the CFMM justified by the fact that building a compliance culture
in the company is critical for the effective functioning of the compliance initiatives set to live
(Deloitte, 2018, p. 9; Grimstad, 2020).

When asked what the interviewee self puts in the concept of an "effective compliance
function", the answer is that compliance culture is one of the things that should be in focus:

«Fundamental to an effective compliance function is to work preventively and work to create

understanding among both management and employees of why the regulations are formed as
they are. By this, I simply mean that one must constantly focus on building culture».

In connection with building compliance culture, reference has previously been made to what
is called Tone at the Top and Tone at the Middle. This means that a firm's responsibility and
commitment to integrity risk start with the management - and from there, has a triple down
effect on the rest of the firm’s employees. The interviewee views this as a very positive aspect
within the Firm and says that «Tone at the Top is very good. We have a board that is very

58
concerned with compliance and a CEO who also wants things to be done right - and not on
the edge”.

It also appears that the Firm has defined values and ethical starting points that form the basis
for every decision made in the Firm, regardless of business level. According to the CFMM,
for these to function as building blocks in the development of an effective compliance
function, it must also be natural for the Firm's employees to promote these in their daily work
endeavors.

"The fact that the ethical principles form the basis for every decision in the company means
that the management anchors its advice or new processes in these principles, and this, in turn,
leads to all employees in the company being 'forced' to think about them"

The interviewee also emphasizes that the principles serve as a sales argument to the Firm's
customers and points out that employees who want you to build a career in the industry must
retain their authorization and a good reputation.

"I think the employees are seeing more and more that compliance helps with customer
satisfaction as every customer appreciates getting well-documented advice and supporting
explanations”.

Nevertheless, it is also emphasized that although the desire to do the "right thing" is present
among the middle management and employees, it should be noted that in the financial
industry - there is a close connection between salary and the branch's or individual employee's
performance. Further, performance is normally measured primarily in the form of quantitative
goal achievement or results controls (i.e., financial measures). The problem, however, which
is often elucidated in connection to this, is that financial results controls (especially those who
focus on current-period accounting profits) can cause employees to become excessively short-
term oriented, or myopic, in their decision-making (Merchant & Van der Stede, 2017, p. 449).
According to the interviewee, this is something that is being worked on preventively within
the Firm.

“For example, we have a remuneration scheme that hits managers and employees in the front
office quite hard. If controls show that they are not compliant with rules and regulations and,
for example, give poor advice to a client this is at the expense of the ‘thickness of their
wallet’”.

59
According to the law firm Erling Grimstad AS, which assists their clients with regulatory
compliance in anti-money laundering and privacy, many of the firms that succeed in
developing compliance culture, carry out quality control of employees' compliance with
routines and procedures.

“The fact that errors and shortcomings are captured by the employees' closest managers, or
through quality controls, means that employees receive concrete feedback on which tasks are
to be solved and what the individual must improve” (Grimstad, 2020).

In other words, when employees know that they are being measured and understand what they
are being measured by, their attention and expectations are focused accordingly.

To this extent, in terms of the CFMM, it can be argued that the Firm is mature when it comes
to business integrity. This, because they have a board and management that is focused on
building compliance culture within their firm, and where there is a doubt as to whether rules
and regulations come before any wish for monetary value, control systems are in place to
ensure the right priorities to be made. In the words of the interviewee,

“We are secured through soft values and harsh punishments, in the sense that if you are not
compliant, you lose your bonus. This is part of laying the foundation for good compliance
assessments to be made”.

Figure 7: Maturity assessment related to business integrity (Excerpt taken from the CFMM)

6.2.2 Resources

The number of resources allocated to the compliance function can often be reflected in what
has so far been discussed and evaluated as mature - namely the Firm's, and then especially the
management's overall attitude towards compliance.

Until now, it has been announced that the Firm has a board and management that are very
concerned about compliance - and it is therefore not unexpected that the interviewee can

60
inform that both the board and management are responsive when it comes to allocating
resources to the compliance function when needed. The number of resources and the types of
resources that are to be allocated are considered once a year through budget negotiations.
However, this is also monitored on an ongoing basis, should there occur any changes that are
not considered in the budget negotiations. The interviewee refers to an example that illustrates
this:

"The company was actually supposed to put in place an extra resource in the compliance
function already in April this year, but the person concerned went on parental leave. As
resources were needed it was then arranged so that another person, who was not really to be
admitted until August, got to start earlier”.

Based on this information, it can be assumed that the Firm does not consider having a
compliance function a "necessary evil". Rather, the interviewee informs that appropriate
resources are allocated to the function, both in terms of a risk-adjusted resource deployment
through budgeting, and ad-hoc in accordance with changes in compliance requirements. This
coincides with the cell description in Level 4, related to resource allocation.

Figure 8: Maturity assessment related to resource allocation (Excerpt taken from the CFMM).

6.2.3 Policies and processes

To arrive at an effective compliance solution, having well-defined processes and policies that
mitigate compliance risk are helpful. This presupposed that they are understood and followed
by employees (Feise, 2020).

According to the informant, the Firm has defined policies and processes that are documented
and available to all employees. It is also added that "We know that it takes more than making
the pile of instructions and routines available for employees for these to be integrated into
their daily work tasks". The Firm, therefore, arranges for policies and processes to be

61
understood by the employees through various channels. Work with this starts already in the
onboarding process for new employees and is followed up through the employment
relationship through a prepared training plan that applies to all employees.

The compliance function is considered to be proactive when it comes to building a

compliance culture, and it seems like business integrity is implemented in the Firm’s code of
conduct. As part of this, it is viewed as important that compliance is involved in defining new
routines to ensure that processes are carried out in accordance with relevant laws and
regulations.

What is described as even more important, however, is that "most often we try to include an
employee from each office when new routines are to be defined". This, both to get input from
those who actually sit with the processes in practice - but also to ensure training and
understanding.

"If you have a person who feels responsible for the routine out in the branches, it is more
likely that he or she will stick to the ‘case’ and create focus on it among the rest of the
employees".

The fact that compliance also performs checks on the employees' performance in connection
with established processes also leads to training and follow-up of each employee individually.
Also, “these kinds of controls have often shown to reveal gaps in routines that require them
to be updated”. This entails that the Firm's processes and policies are continuously updated.

According to the interviewee, updates are not only done in response to incidents but also
constantly, in line with new interpretations and circulars that come from the FSA. "For
example, the Firm's guidelines were updated and approved by the board last autumn, prior to
the Firm applying for a new license".

From the above discussion, one can argue that the Firm’s policies and processes are integrated
into the workflow through instructions and routines in which the employees are expected to
follow in their daily work endeavor. Further, training programs and controls carried out
ensures that the processes are understood and continuously improved. Hence, also in terms of
policies and processes, the Firm’s compliance function can be labeled proactive and
integrated.

62
Figure 9: Maturity assessment related to policy and processes (Excerpt taken from the CFMM).

6.2.4 Coordination

Lack of cooperation and communication between the compliance function and other business
units has been shown to create accountability and communication gaps, as well as
redundancies and confusion (Loh, 2019; PwC, 2004).

Although it is emphasized that there is always room for improvement, the interviewee is
satisfied with how the compliance function interacts with other business lines within the Firm.
For example, it is pointed out that regular weekly meetings with the CEO have been set up, as
well as periodic meetings with the board. Furthermore, Head of Compliance is a permanent
member of what is called the project group for development projects. That, to advise the
group on how the various projects should be prioritized with regard to compliance risks.

One challenge the Firm has faced related to coordination, which has now been improved, is
the lack of a communication channel between compliance and the first line. The interviewee
refers to this channel as "business compliance" or “business support”.

«The fact that the Company has been in great growth has meant that compliance has made
discoveries and identified risks which should be left to the first line of defense to rectify.
However, the first line has been so congested at times that these things have been
downgraded, and compliance has had to be much more involved in the change itself to get
these improvements through. That is not really compliance's task and therefore incorrect use
of resources».

According to the CFMM, concerning coordination, one shall also assess how information is
made available to the compliance function. This is also mentioned by the interviewee as
particularly important, and it is described as a matter of course that compliance must have
access to all documentation available in the firm – quoting: "there should be no barriers".

63
That it is seen as natural, or even taken for granted, that compliance is participating in
management meetings and projects is for the Firm seen as a measure both to ensure proactive
compliance (again, referring to building compliance culture) and to mitigate any information
barriers.

So, when it comes to the key enabler coordination, the Firm is on the ball. It has improved
previous communication gaps that have created congestion for the compliance function in
being left with tasks that were not within their scope of work tasks. Further, regular
interaction with the management, the board, and the project group testify that the Firm has an
overall goal in which business integrity plays an important part. In this way, it can be said that
the interaction and information flow between the various business functions is actively
managed and understood. As the next section will elaborate on, it is positioned at that level
because there is room for improvement when it comes to using technological tools to improve
any friction in how the function is getting a hand on needed information.

Figure 10: Maturity assessment related to coordination (Excerpt taken from the CFMM).

6.2.5 Technology

When it comes to coordination and how the business areas communicate with each other, it is
natural that technology also comes into the picture. As the CFMM shows, a proactive and
integrated compliance function implies that the various business areas work towards a shared
goal. An alignment of strategy, processes, and technology between these will improve the
effectiveness in achieving that.

Until now, the Firm’s compliance function is considered relatively mature in terms of how it
works to enhance business integrity through building compliance culture, how the
management is responsive when it comes to resource allocation, and that policies and
processes are constantly measured and improved. When it comes to coordination, on the other
hand, there seems to be some room for improvement. This seemingly lies in the existence of a
gap between what the interviewee refers to as a dream situation “having a dashboard with

64
access to all relevant information gathered in one place”, and today's solution where “the
information is available and we have access to relevant data, but it can feel a little
cumbersome and convoluted to find”. For example, to control whether a client lies within its
chosen mandate, the interviewee explains that the compliance officer performing the check
physically must enter various data programs and excel lists to assess this.

The thing about technology and automatization is that this is often the last building block that
comes into place when it comes to establishing new business functions. This because
processes must be tested and best practices identified before they are automated (Falck-Ytter,
2021). It can be understood that this also applies to the compliance function within the Firm.
"There is a limit to what is a must-have, and what is nice to have", and according to the
interviewee, this decides what is prioritized first.

However, as understood by the analysis so far, the Firm mostly has what the CFFM describes
as "must-haves" in place. And, according to the interviewee, the Firm is aware that there
exists a gap in terms of technology and communication and has therefore initiated an
infrastructure project.

"Once the project is in place, the compliance function will have access to better reports. For
example, related to order receipt, more automated processes, with systems for flagging or
notifications will require fewer resources from compliance being used in, for example,
controls related to clients’ mandates».

However, this is an as-is assessment of the maturity of the compliance function within the
Firm, and therefore, improvements from the infrastructure project will not have implications
for how the Firm score in terms of technology at this point. From the above information, it
seems like as of today, some processes are automated while others are manual. This seems to
have implications for the capacity of the compliance function, which from a risk perspective
should spend more time and resources on activities of high priority rather than having to
spend time gathering data for routine and repeatable compliance processes. One can say that
in terms of technology, the function is organized – but reactive, because of the many activities
that still are manually handled.

65
Figure 11: Maturity assessment related to technology (Excerpt taken from the CFMM).

6.3 Further effectivization measures

Having assessed the Firm’s compliance function with respect to the given criteria for the
different key enablers defined in the CFMM, Figure 6 can be used for developing a plan
addressing the function’s most significant areas of growth. I.e., it provides guidelines for how
to organize the compliance function to become more effective.

By obtaining information about how the compliance function is organized as of today, from
the CCO within the Firm, the compliance function is assessed to be at Level 3 (Actively
managed and understood). The reasoning is, that despite the fact that three out of five key
processes were evaluated as proactive and integrated (i.e., level 4), scoring at levels 3 and 2 in
regard to coordination and technology implies that there is still room for improvement.

Earlier, it has been stated that using technology as a measure for enhancing efficiency
depends on the maturity of other key process areas. This has had its implications for the
structure of the CFMM, and thus, how assessing the function’s key enablers starts with
business integrity and moves upwards – ending with technology.

The interviewee mentioned that there exists a distinction between “must-have” and “nice to
have”. The same distinction can be interpreted as existing in the CFMM, involving that when
the “must-haves” are in place, what is “nice to have” often comes in form of technology
implemented to enhance efficiency. For example, compliance processes required by law are
first implemented in workflow routines. And, once these are fully integrated – those of them
that are manual (and therefore time-consuming) should be automated, creating capacity for
the compliance function to focus on tasks that, according to the Firm’s risk matrix are of
higher priority.

In short, one can look to the CFMM and advise the Firm to invest in technology that supports
and integrates all compliance processes in one and same automated system. However, as
stated in the introduction to this thesis, such changes cannot be made overnight. This implies

66
that the process of getting to that point must be taken step-vise. For the Firm, this will
according to the cell descriptions in the CFMM (i.e., its guidelines), involve looking into
whether and how processes that currently are manual can be automated - before these are
integrated into one system.

Having access to all relevant information from all business units in one place will enhance
coordination and remove the friction that today steals time from the compliance function.
Therefore, integrating all compliance processes in one system should also involve access to
relevant information from all business units important for monitoring and assessing these
processes.

Figure 12: Maturity assessment of the case firm’s compliance function using the CFMM.

67
7 Discussion
The following chapter will be divided into two parts. The first part concerns an evaluation of
the CFMM. This is considered an important part of the discussion chapter because it makes
out the basis for evaluating the development process. Not only that of the CFMM specifically
but also for maturity models in general as the current process was inspired by ideas from
existing development framework suggested in research.

7.1 Evaluation of the CFMM

An important phase in the development process of a maturity model is model evaluation. This
phase naturally follows the model being tested in practice, as feedback on whether the model
fulfilled its defined success criteria for usability and usefulness is provided (A. M. Maier et
al., 2012).

Ideally, model evaluations are conducted within companies or institutions that are
independent of the development (A. M. Maier et al., 2012, p. 152). This, because it is the
choices made during the planning and design phases that are tested. Hence, as part of the
interview with Head of Compliance in the case firm, the CFMM was handed out for it to be
tested in practice.

Together with a set of questions posed at the start of the interview, before any CFMM-related
information was presented, this allowed for the model to also be evaluated by someone other
than the undersigned who has posed as the decisionmaker during the development process.

7.1.1 Success criteria 1: Usability

In the planning phase (See chapter 5.2.1) it was stated that the CFMM was intended to be
used by investment firms in the Norwegian financial market. As such, success criteria for
usability pertains to things such as whether the cell descriptions are understandable and
relatable and that the structure of the model is intuitive for industry professionals - not
demanding prior knowledge of maturity models for its use. In short: the model must be tested
for validity and relevance (A. M. Maier et al., 2012).

First, proving the relevance of the CFMM includes there being some degree of agreement on
what particular elements need to be included in, or excluded from, the model. According to

68
Maier et al. (2012), this is part of justifying the theoretical framework underlying the selection
of process areas.

Allowing for an element of subjectivity, this was looked into through questioning the
interviewee to name what elements (s)he considered most important in establishing an
“effective compliance function”. This question was posed early in the interview, to avoid any
bias due to questions related to the content of the model being asked later on.

Comparing the elements named by the interviewee to the key enablers defined in the CFMM,
there are many similarities to them. One of the first elements called out as particularly
important by the interviewee is the establishment of a compliance culture within a firm. This
is thought of as elementary because it lays a basis for other important elements such as
resource deployment, access to information, and interaction with and across business units.
Seeing a well-established compliance culture as elementary for an effective compliance
function coincides with naming the first key enabler in the CFMM “Business Integrity”. As
Koehn (2005) stated, “integrity properly understood is not only some add-on feature for
business; it is at the core of sound business” (p.134). And, in sense, a sound business is what
the compliance function strives towards.

In the CFMM the next key enabler listed is “Resources”. This is not mentioned directly by the
interviewee but rather incorporated into the discussion by highlighting “staffing” as another
important element.

«One must make an overall assessment related to staffing within the compliance function
where one assesses what kind of risks the company is exposed to…. and which areas are in
focus at the FSA. Based on the overall assessment, the firm must look into what is sufficient in
terms of staffing”.

As such, it can be understood; that in connection with staffing and other resources allocated to
the compliance function, the interviewee sees having the proportionality principle in the back
of mind as important for effectiveness. Interpreting the cell descriptions of the CFMM, one
can understand that this is also used as a basis in the structuring of the model. For example,
through the upper levels focusing on processes and resource allocation being continuously
measured, and subsequently improved or increased. This underlying thought, seemingly
shared with the interviewee, also helps to validate the theoretical basis for the different levels
and corresponding cell descriptions.

69
That a healthy compliance culture forms the basis for whether the compliance function has
access to all relevant information comes from it mitigating barriers between the compliance
function, the management, and other business units. As such, when the interviewee is
mentioning the element of having “access to all documents and information in the firm”, this
can arguably be seen as corresponding to the cell descriptions related to the key enabler
“Coordination” in the CFMM.

Not explicitly in the model, however, is there a key enabler that considers whether members
of the compliance function have an eye for business.

"Personally, I believe that being conscientious and wanting to do things right, but, at the
same time being able to see the business part of it all, is one of the key requirements for an
effective compliance function".

As an example, the interviewee shows to having worked in many companies where Head of
Compliance have come straight from working as a lawyer.

“Things then are often seen from a very narrow point of view and the legislation is not
adapted to fit the business. Compliance then is suddenly considered more of a brake pad and
goodwill from the organization is consequently lost”.

Previously it was stated that for the effective functioning of the compliance initiatives set to
live, there should be an underlying compliance culture that all employees support (Deloitte,
2018, p. 9; Grimstad, 2020). If employees feel that the compliance function does not “play at
the same team”, one can assume that such support and culture will weaken. For example, in
such situations, it is more likely that the employees will work their way around established
compliance routines that would require extra effort from them (Merchant & Van der Stede,
2017). Based on this, incorporating a distinct key enabler that considers whether compliance
is striving to adapt legislation to go hand-in-hand with firms’ business endeavors could be
relevant for the CFMM.

However, one could also argue that this is an element that is already implemented to the
model under the umbrella term, “Coordination”. That, because coordination is very much
about the alignment of strategy in the attempt to reach common goals. This does not only go
one way. The compliance function must align its strategy with that of the firm, just as much as
the firm must align its strategy - and consequently processes - to answer to certain compliance
objectives.

70
After having had the opportunity to test it in practice, the interviewee provided feedback on
the architecture of the model as well. Overall, it was considered easy to understand both in
terms of its structure and content. According to the interviewee, clear cell descriptions made
the overall assessment easier.

However, an interesting question related to the key enablers chosen for the model was raised
after the interviewee had gotten more acquainted with its’ structure.

“What if the assessor finds it that the compliance function scores at the highest level for all
the key enablers named in the CFMM – but there is lack of knowledge among its employees –
can the function really be mature, then?”

The reason why this question is found interesting is that it touches upon the underlying notion
of maturity in the model. As a consequence of the model being developed based on the
researcher’s subjective interpretations of existing literature, the model first and foremost says
something about what that person sees as drivers and barriers for maturation (Poeppelbuss &
Roeglinger, 2011).

On the one hand, subjectivity can be seen as weakening the usability of the model because the
assessor might feel confused with assessing the function when a component, he or she sees as
important, is missing. However, the model also leaves room for subjective interpretations
from the assessor’s side. For example, when it comes to how he or she chooses to understand
each key enabler and related cell descriptions. So, on the other hand, subjective interpretations
can also be seen as strengthening usability. This, because it makes it easier for different
assessors to use the model when it can be adapted and understood in a way that fits firms’
various situations.

However, to comment on “knowledge” as a missing element, one can start by showing to the
underlying notion of maturity in the CFMM which concerns improved processes and learning
related to the compliance function (See Figure 5). What lies behind this, is the thought that
existence and adherence to structured compliance processes as well as the compliance
function being proactive, is what drives its’ effectiveness. The latter is discussed up against
what measures the firm takes that perpetuate a healthy and sustainable growth of the business.
As part of this, resource allocation comes into the picture (Harvey, 2004).

In choosing “Resources” as one of the key enablers for an effective compliance function –
human resources were discussed. Not only in terms of capacity but also capability. The latter

71
refers to how resources are allocated in terms of training in order to maintain the knowledge
of compliance employees (ESMA, 2020; FSA Norway, 2015). Using the word “maintain”
comes from it being a prerequisite for having established a compliance function in the first
place, that compliance employees have the necessary level of knowledge and/or expertise.
This is for Norwegian investment firms, the responsibility of the firm’s board when they are
appointing the CCO (Cf. Article 22(3)(a) of MiFID II Delegated Regulation).

In short – knowledge not being explicitly mentioned in the model does not mean that it is not
considered an important element. Rather it is seen as a prerequisite for the compliance
function, and therefore it is thought of as incorporated in the discussion on resources instead
of being a distinct key enabler in the model.

Nevertheless, the overall verdict related to usability is that there is correspondence between
the author’s findings and the understandings of the interviewee. This verdict is based on the
similarities found between the author’s and the interviewee’s statements regarding elements
considered important in organizing an effective compliance function. Having discussed the
aspect of “knowledge” as brought fore by the interviewee, it can be argued that such a
correspondence also applies to the theoretical rationale underlying the structure of the model -
as this component, in the model, is seen as a prerequisite. In short – the CFMM can be
considered relevant and valid.

7.1.2 Success criteria 2: Usefulness

The next success criteria, usefulness, pertain to whether the model shows out the be helpful.
This is linked to whether it triggers reflection and learning among its audience (A. M. Maier
et al., 2012, p. 153). In other words – it is about whether its intended users would consider
using the CFMM as a tool for mapping its function per se, and further use it as an
improvement framework.

After getting acquainted with the model, the interviewee tells that (s)he is in favor of using
this kind of model in any future work on improving the effectiveness of the compliance
function. (S)he also sees it as relevant that other parts of the administration use the model -
especially the top management.

"I believe that the model can make the top management aware of what it actually takes for the
compliance function to work effectively. By using the model in an assessment, one is forced to
think about each aspect of this".

72
Based on this, it can be understood that the CFMM at least stimulates learning effects, as
Maier et al. (2012) refer to. However, for the model to be useful and worth spending time on
for a firm, it should also lead to effective plans for improving a certain situation (e.g., raise the
level of maturity in terms of technology). In the existing literature, maturity models have been
criticized for being too simplistic to be useful (Lasrado et al., 2015, p. 7). To some extent, this
is also brought fore by the interviewee.

“Maybe that is the way it’s supposed to be, but I feel like the model would be even more
useful if it came with an appendix – or like – that provided greater details on how to get from
one level to another”.

Here, the interviewee refers to how the cell descriptions are meant to be used as guidelines for
planning further work to enhance the function’s effectiveness. I.e., the prescriptive purpose of
the CFMM. Although the cell descriptions themselves are considered "absolutely relevant
guidelines", the interviewee finds them a little too simple. (S)he would want even more
detailed information on how to proceed from having positioned the function at level 3, as is,
and plan for it to move towards a higher level.

“If compliance is seen as a necessary evil, how should one specifically initiate the work of
defining business ethics and values?”.

7.1.3 Sub-conclusion

As a step towards model verification, the CFMM has now been evaluated against the success
criteria and requirements defined during Phase 1 - planning (A. M. Maier et al., 2012, p. 152).
The overall verdict, based on feedback from the interviewee, is that the CFMM was both user-
friendly and useful. However, there is always room for improvement, and points that have
been made regarding the usefulness and usability of the model will be taken into
consideration in the next subchapter discussing the development process of maturity models.

7.2 The development process of maturity models

In chapter 1, it is announced that the main objective of this research project is the
development of a compliance function maturity model. In connection to this, RQ1 was
formulated as follows: How can the effectiveness of the compliance function within
Norwegian investment firms be evaluated using a maturity model?

73
To answer that question, a literature study on the modeling process of maturity models was
initiated. Here, criticism towards maturity models and their development was looked into to
ensure that these were tried encountered in the attempt to develop a compliance function
maturity model. For that reason, ideas from pre-existing research suggesting different
procedures for the modeling processes were used as inspiration for the development process.

7.2.1 Meeting criticism

In conducting the literature review, it became evident that researchers have struggled with the
development of maturity models, facing challenges related to them being both theoretically
and empirically validated (Benbasat et al., 1984; Lasrado et al., 2015; Solli-Sæther &
Gottschalk, 2010). As such, it was understood that in the development of a compliance
function maturity model - these were problems that needed to be met wisely.

The first problem in developing maturity models is related to them lacking a theoretical
foundation (Lasrado et al., 2015, p. 6). This, for example, in terms of developers simply
adapting to their model the structure of models that already have wide acceptance - but that
may have been developed for other purposes. Looking to how this problem is tried solved in
previous research (A. M. Maier et al., 2012; Solli-Sæther & Gottschalk, 2010), an established
body of knowledge in the field of corporate compliance were looked to when decisions
related to what key enablers, maturity levels, and related cell descriptions to include in the
CFMM were made.

Existing literature on the field of corporate compliance proved to be rich and cross-references
were found concerning aspects of organizing an effective compliance function. Together with
a comparison of existing maturity models concerning corporate compliance and governance (a
step suggested by Becker et al. (2009)), it was possible to conceptually ground the structure of
the CFMM in theory.

However, that the model is theoretically founded does not help if it is not empirically
validated. For this purpose, suggested development frameworks for maturity models propose
different methods. For example, Solli-Sæther & Gottschalk (2010, 2015) propose carrying out
a survey for the elements of the conceptual model to be empirically tested. Maier et al (2012)
follow another strategy, which includes synthesizing viewpoints from future users through
model applications in eight relevant firms.

74
As Part B of this paper presents, an attempt has been made to validate the CFMM empirically
by using a case study method. Instead of sending out a survey, as suggested by Solli-Sæther &
Gottschalk (2010, 2015), or test the model in various relevant firms (A. M. Maier et al.,
2012), the CFMM was tested in an assessment of the compliance function within one chosen
case firm. This, through interpreting data from an interview with Head of Compliance and
Risk within that firm, and also letting that person test the model in practice. As the Firm was
selected because of its capacity to offer “exemplary knowledge” (Thomas, 2011), the findings
could provide implications to whether the model could be validated for use in practice.

However, as indicated earlier, the way the development process has foregone has implications
for the final result – and remarks made by the interviewee after testing the CFMM may point
to steps in the development process that should be revised.

7.2.2 Revision based on feedback

The remarks made by the interviewee first and foremost concern decisions related to what
elements the CFMM presents as key enablers for an effective compliance function, and how
the model could be “true” if one important element is overlooked. These concerns can be
related to the success criteria of usability - which again pertains to the architecture of the
model.

The model’s architecture, i.e., its stages, key enablers, and cell-descriptions, significantly
impacts its use (A. M. Maier et al., 2012, p. 150). During the design phase, it was argued how
each of these elements being distinct, well-defined, and show logical progression would ease
both the prescriptive and descriptive purpose of the model (de Bruin et al., 2005; A. M. Maier
et al., 2012). As a means to attain such a result, it was looked to de Bruin et al. (2005), who
recommends choosing between a top-down or bottom-up approach in structuring key enablers
and maturity stages of the model.

As pointed out above, evidence on what represents maturity (or effectiveness) related to the
compliance function could be found in existing literature in the field of corporate compliance.
This allowed for a bottom-up approach, whereas key enablers in the CFMM were first
selected before the rest of the model was built based on how these elements can be measured
(de Bruin et al., 2005, p. 6).

Many that have researched the modeling process of maturity models find such a practice to
only be sufficient in providing a theoretical starting point (See: Becker et al., 2010; A. M.

75
Maier et al., 2012; Solli-Sæther & Gottschalk, 2010). According to these, other means of
identification are necessary to provide a comprehensive list of possible key enablers for the
developer to choose from. Often repeated are panel interviews or focus group interviews
where one is to synthesize the elements mentioned most often - or the elements that are
considered most critical. However, when the developer has limited access to resources, de
Bruin et al. (2005) argues that the most important issue when populating a model is to select
the combination of research methods throughout the process that is most appropriate for
model development in the context of earlier scoping decisions and desired model outcomes
(p.8).

As for the development process of the CFMM, the options related to the key enabler selection
process were limited due to both the time frame of the project and pandemic-related
restrictions. These limitations were identified before starting the research project, and scoping
decisions were made well-knowing of them. As the model’s scope was decided to be domain-
specific, a “theoretical starting point” was seen as providing necessary insight into the
peculiarities of corporate compliance. These peculiarities were looked more deeply into, not
only with reference to research but also to relevant legislation and ideas from practitioners in
the field (e.g., financial authorities and consultant agencies).

As the desired outcome was a model for use within Norwegian investment firms, one of the
last steps towards validation in the development process consisted of a “testing phase”. This
included discussing the most prominent elements selected for the model in an interview with
an industry professional. In the foregoing chapter, this was also described as a way of meeting
the criticism of maturity models lacking empirical validation.

In the frameworks reviewed as part of the literature study, the testing phase is considered an
important part of the development process of maturity models being referred to as iterative
(e.g., Becker et al., 2010; de Bruin et al., 2005; Maier et al., 2012; Solli-Sæther & Gottschalk,
2010). Referring to the process as iterative implies that once the suggested model has been
presented and tested, it should be “revised” based on the feedback received. However, studies
conducted by these scholars, are commonly lengthy. See e.g., Solli-Sæther & Gottschalk
(2015), whose “Stages-of-growth model for outsourcing, offshoring and backsourcing” was
developed over several years. In contrast to a research project lasting approximately 20
weeks, this allows for more extensive testing of the model.

76
In preparing their development framework, Solli-Sæther & Gottschalk (2010) refers to
previously developed maturity models. They point especially to how conceptual models have
been based on interviews or their practical insight into the field of investigation, and to a
lesser extent have had these tested and revised (p. 284). Therefore, they suggest including an
exploratory survey in the testing phase. For their maturity model, such a survey was
conducted among 133 major firms considered relevant. Only 50 of the responses were
considered usable in revising the model.

Maier et al. (201) also make a point regarding this last phase. According to their research,
evaluations may be continued until a saturation point is reached. I.e., until no more significant
changes are being suggested by participants and/or until evaluation results are satisfactory (p.
151).

From the above, one can argue that only having tested the CFMM in one relevant firm and
discussed its elements and architecture with one industry professional solely, is not sufficient
for moving forward to revise the model. Hence, this phase is not completed for the CFMM.

7.2.3 Sub-conclusion

Given the research context, it is reasonable to argue that steps have been taken to ensure well-
informed decisions related to model architecture. With a lengthier timeframe for the project,
however, the CFMM could be tested in more than one case firm and modified based on
feedback. This could enhance both its usability and usefulness.

Still, the overall verdict when it comes to the attainment of the success criteria defined for the
CFMM - is that these are attained.

8 Conclusion

The suggested model – the CFMM – indicates a path of evolution whereas the compliance
function matures from being reactive and inconsistent to it becoming a proactive and
integrated part of a firm’s business endeavors. With this as a basis, the CFMM has been used
to assess the state of the compliance function within the selected case firm as of today and to
provide general guidelines on how it can be organized to become more effective.

As such, both RQ1 and RQ2 have been answered - and in doing so, this research project has
made both theoretical, practical, and methodological contributions.

77
8.1 Contributions

8.1.1 Theoretical contributions

This research project has presented a comprehensive overview and comparison of existing
frameworks for the development process of maturity models. Subsequently, a compliance
function maturity model has been developed following various phases suggested in these. In
doing so, this research project offers the opportunity to also comment on existing research in
which those frameworks are founded.

The development process of the CFMM has been evaluated based on how the proposed model
was thought to attain its defined success criteria of usability and usefulness. Findings related
to this align with those of other scholars, emphasizing the importance of developing maturity
models that are both theoretically founded and empirically validated.

To be able to conceptually ground the structure of the CFMM in theory, it was resorted to
measures suggested in previous research by Solli-Sæther & Gottschalk (2010), Maier et
al.(2012), and Becker et al. (2009). The measures, involving the researcher looking to an
established body of knowledge on corporate compliance and previously developed maturity
models for the compliance function, helped with the accomplishment of this. As such, the
current research project also affirms these scholars’ work on how to meet with established
criticism on maturity models lacking theoretical foundations.

Further, aiming for empirical validation of the model, the CFMM was tested in a relevant case
firm. The model was considered both usable and useful by a representative from its intended
audience. This implies that the findings of this study can not only affirm the specific measures
to meet criticism. Also, the different development phases suggested in previous research can
be acknowledged. This, because the phases resorted to consist of various steps towards
attaining the criteria of usability and usefulness.

A note to this, however, is that the development of the CFMM was not based on one specific
framework solely. Rather, ideas from different frameworks were used. As such, the current
research project cannot acknowledge the work of one specific scholar. On the other hand,
these findings may imply that a canon of theory to which all scientists refer is emerging in
research on maturity model development. This brings new light to previous research, like that
of Wendler (2012), who identified a gap in the literature when it came to theoretical
reflections on the concept of maturity.

78
The reasoning behind this statement can be explained as follows. In conducting an extensive
literature review on the different development frameworks that existed in literature, it was
disclosed how all of these were built to achieve the same purpose. Namely, to develop
maturity models that can be theoretically and empirically validated, and therefore can be
considered usable and useful for its intended audience. Aiming for the same goal, the
suggested frameworks also consist of many of the same elements, only defined and described
differently. This implies that future developers of maturity models could look to any of the
suggested frameworks and still get many of the same advice regarding underlying theories,
quality criteria, or circumstances supporting successful usage of their model (Wendler, 2012,
p. 1331).

8.1.2 Practical contributions

For practitioners, the CFMM represents an improvement framework in which can help with
identifying where a firm’s compliance function stands as of today, and further provide
guidelines for its improvement.

Through assessing specific characteristics of the function’s key enablers, users of the model
are provided with a set of considerations that deserve special attention (Solli-Sæther &
Gottschalk, 2015, p. 93). Findings from this research project confirm that this attribute is
particularly important and suggest that it can lead to better understandings of what is needed
for managing and planning the evolution of the compliance function.

For the maturity models usable and useful in practice, however, it follows their key enablers
must be of relevance in their intended area of application. The key enablers selected for the
CFMM are based on current legislation and regulations applying to all Norwegian investment
firms. This speaks for the model being of relevance to its intended area of application.
Further, by comparing the key enablers defined in the CFMM to elements considered most
important by the interviewee (who represents the model's intended users), the similarities
between these further confirm that.

However, in reviewing existing maturity models for assessment of firms’ risk functions (See
Appendix 1 for an overview of these), this study finds that many of those lack sufficient
empirical evidence for them to be validated. Despite what was just stated above, this is a
concern that neither the CFMM comes without. For that reason, practitioners should be aware
of what maturity model they choose to use. The CFMM and this study pose as a good
example of why. Even though legal requirements in the industry are the same for all firms,

79
practitioners should also pay attention to the individual research context and compare that to
the situation of their firm before applying the model.

8.1.3 Methodological implications

As for the methodological implications, we look to the decisions made regarding the research
design and methods chosen for this research project. As this paper is divided into Part A and
Part B consisting of different research methods – the methodological implications will be
discussed accordingly.

For the literature study, searches for potentially relevant articles were done through various
databases (see chapter 3.2). As research on maturity models is conducted by researchers
within diverse disciplines (Wong et al., 2013), using a narrative approach was thought to be
the better choice to ensure that potentially relevant literature wasn’t left out because of any
pre-specified inclusion criteria. Such a comprehensive search resulted in a vast array of
relevant articles. However, the number of articles that were eventually analyzed was relatively
low.

For the narrative literature review, a four-staged process suggested by Demiris et al. (2019)
was looked to. Based on experiences from adhering to that process in selecting relevant
literature for this study, methodological implications for conducting similar studies can be
made.

First, the identification of keywords was not only are relevant to extend the search, as
suggested by Demiris et al. (2019). It also proved helpful in narrowing down the number of
articles considered relevant, as those who did not contain specified keywords could be
weeded out. This, through the use of different filtering options in the databases. Second, it
was decided to document the literature review (see
Table 2) even though there aren’t any rules for narrative review processes demanding such.
This was first and foremost done for the sake of transparency for the reader– and can be
viewed as a measure to maintain research quality (Demiris et al. 2019). However, an overview
of the articles which also included the most important points made in each was also useful for
the researcher to look back at in discussing findings of the current study.

Further, findings from the literature study indicated that research on maturity models is
anticipated to involve some kind of empirical proof. As such, researchers developing maturity
models should substantiate these with both a theoretical foundation and empirical evidence.

80
The fact that established criticism of maturity models also relates to this, emphasizes the
importance of the methodological implication below.

Part B represents the empirical study conducted for his research project. Here, a qualitative
approach involving a single case study was used to test the model developed in Part A. This,
as part of establishing empirical proof to validate the model’s suitability to practice. This
paper concluded with the CFMM being valid and of relevance to its intended area of
application.

Using a single case study for such a purpose, when there is that little foundation for what
concerns external validation of the findings, is a well-known concern (Bryman et al., 2019).
However, what this research project and its findings have shown, is that this might be an
unnecessary concern. Even though data from one single interview is thought of as being too
little to base model modifications on – the findings that emerged from it provide the basis for
concrete and context-dependent knowledge, which is of importance to the type of research
problem investigated in this research.

8.2 Limitations and further research

Based on what implications have emerged from this research project – suggestions for further
research can be provided. Some of these come as a result of limitations to this study, while
others are suggested to extend and improve the state of knowledge in the field - where room
for such has been identified.

In evaluating the quality of the current research project in regard to Lincoln and Guba’s
(1985) four quality criteria (See chapter 3.4), threats towards the respective were also
mentioned.

First, mentioned as a threat towards the credibility of the findings produced, is that of the
researcher’s own experiences and viewpoints being methodologically biased. An example of
this is when the researcher focuses on data confirming his or her thoughts, expectations, or
personal experiences (Formplus, n.d). I.e., data that favors their own “hypothesis”. To deal
with this threat, findings from the literature study were tested in a case study. The researcher’s
interpretations from the case study were then validated through member checking. Still, it has
been mentioned that case studies cannot offer scientific rigor in the same way as, for example,
formal experiments do. And this could be seen as a limitation of this research project.

81
The first suggestion for further research also emerges from limitations emerging from the case
study method used for validating the model. As mentioned in the discussions on the
development process of the CFMM, it was decided not to revise the model based on feedback
from one interview and testing solely. The decision was based on points made in previous
research, that enough evaluations should be assessed to be able to reach a point where no
more significant changes are being suggested by participants. As the “revision phase”
contributes to enhancing the usability of the model developed, it is suggested that the CFMM
is tested in more cases and modified based on feedback from those. This, because multiple
case studies - for example, cross-case studies - to a greater extent are thought to justify some
confidence in the propositions derived from its analysis (Brookes et al., 2014, p. 242).

Another suggestion – this one related to enhancing the usefulness of the CFMM – is to
conduct a longitudinal study whereas the researcher follows the process from the CFMM
being used for an as-is assessment and further through the improvement process. This would
be interesting because the current research project has not conducted studies that can say
anything about the correlation between the guidelines presented in the model and the actual
improvement of the compliance function’s effectiveness.

At last, to improve the state of knowledge within research on maturity models in general –
two more suggestions are provided.

Throughout the literature study conducted in Part A of the current research project, it became
evident that there exist several conceptual descriptions for the development process of
maturity models. However, empirical evaluations of such frameworks are fewer – and if they
exist, they are often undertaken by the same researchers who proposed the framework (e.g.,
Becker et al., 2010; Solli-Sæther & Gottschalk, 2015).

To some extent, the development of the CFMM can be viewed as an attempt to provide
empirical evidence that these frameworks are sound. However, it is based on different ideas
from various of these, and therefore, it is not just one specific framework that is tested. Hence,
a suggestion for future research could be to address one of these frameworks specifically - and
test it step by step – to find evidence that could confirm, contradict, or bring new light to
previous research. If testing the whole process is too comprehensive, testing of distinct phases
can also be relevant. For example, it could be looked into whether different steps of the design
phase suggested by Maier et al. (2012) ensures that the model attains its defined success
criteria related to usability and usefulness.

82
Also – as part of the theoretical contributions - indications were made that a canon of theory
in the field of maturity models could be seen as emerging. This was thought to bring new light
to previous research like that of Wendler (2012). However, for this to be more than just an
assumption, a more thorough literature review should be conducted. As a suggestion for
further research, it is therefore encouraged to replicate the study of Wendler (2012), aiming to
structure and analyze the available literature in the field of maturity model research to identify
the state-of-the-art research.

83
References

ACFE. (n.d.). Tone at the top: How management can prevent fraud in the worlplace.
Association of certified fraus examiners. Retrieved February 24, 2021, from
https://www.acfe.com/uploadedFiles/ACFE_Website/Content/documents/tone-at-the-
top-research.pdf
BAHR. (2017). MiFID II og norske aktører (6th ed.).
https://issuu.com/bahr1/docs/mifid_ii_og_norske_akt_rer
Barney, J. (1991). Firm Resources and Sustained Competitive Advantage. Journal of
Management, 17(1), 99–120. https://doi.org/10.1177/014920639101700108
Bassey, M. (1999). Case study research in educational settings. Open University Press.
Batenburg, R., Neppelenbroek, M., & Shahim, A. (2014). A maturity model for governance,
risk management and compliance in hospitals. Journal of Hospital Administration, 3.
https://doi.org/10.5430/jha.v3n4p43
Becker, J., Knackstedt, R., & Pöppelbuß, J. (2009). Developing Maturity Models for IT
Management. Business & Information Systems Engineering, 1(3), 213–222.
https://doi.org/10.1007/s12599-009-0044-5
Becker, J., Niehaves, B., Poeppelbuss, J., & Simons, A. (2010, January 1). Maturity Models in
IS Research. 18th European Conference on Information Systems, ECIS 2010.
Benbasat, I., Dexter, A. S., Drury, D. H., & Goldstein, R. C. (1984). A critque of the stage
hypothesis: Theory and empirical evidence. Communications of the ACM, 27(5), 476–
485. https://doi.org/10.1145/358189.358076
Blog, F. (nov 12). Research Bias: Definition, Types + Examples.
https//www.formpl.us/blog/research-bias
Blum, D. (2020, February 17). Security maturity assessments focus on people, process, and
technology. Security Architects Partners. https://security-architect.com/how-to-assess-
security-maturity-and-roadmap-improvements/
Brookes, N., Butler, M., Dey, P., & Clark, R. (2014). The use of maturity models in
improving project management performance: An empirical investigation. International
Journal of Managing Projects in Business, 7(2), 231–246.
https://doi.org/10.1108/IJMPB-03-2013-0007
Bryman, A., Bell, E., & Harley, B. (2019). Business research methods (Fifth edition). Oxford
University Press.
Byrne, J. A. (2016). Improving the peer review of narrative literature reviews. Research
Integrity and Peer Review, 1(1), 12. https://doi.org/10.1186/s41073-016-0019-2
C. Verschoor, C. (1998). A Study of the Link between a Corporation’s Financial Performance
and Its Commitment to Ethics. 9.

84
Compliance Week and Thomson Reuters—The Compliance Maturity Survey. (2009).
https://www.iia.nl/SiteFiles/CW_COMPLIANCE_MATURITY_SURVEY_RESULT
S.pdf
COSO. (2004). COSO’s Enterprise Risk Management – Integrated Framework | ERM -
Enterprise Risk Management Initiative | North Carolina State Poole College of
Management. https://erm.ncsu.edu/library/article/coso-erm-framework
Creswell, J. W. (1998). Qualitative Inquiry and Research Design: Choosing Among Five
Traditions. SAGE Publications.
https://books.google.no/books/about/Qualitative_Inquiry_and_Research_Design.html?
id=bjO2AAAAIAAJ&redir_esc=y
Crotty, M. (1998). The Foundations of Social Research: Meaning and Perspective in the
Research Process. SAGE.
de Bruin, T., Freeze, R., Kulkarni, U., & Rosemann, M. (2005). Understanding the Main
Phases of Developing a Maturity Assessment Model. Australasian Conference on
Information Systems.
Deloitte. (2017). Compliance modernization is no longer optional—How evolved is your
approach. https://www2.deloitte.com/content/dam/Deloitte/pe/Documents/risk/us-
compliance-modernization%20(1).pdf
Deloitte. (2018). Compliance Risk Management Powers Performance.
https://www2.deloitte.com/content/dam/Deloitte/nl/Documents/risk/deloitte-nl-risk-
compliance-risk-management-powers-performance.pdf
Demiris, G., Oliver, D. P., & Washington, K. T. (2019). Chapter 3—Defining and Analyzing
the Problem. In G. Demiris, D. P. Oliver, & K. T. Washington (Eds.), Behavioral
Intervention Research in Hospice and Palliative Care (pp. 27–39). Academic Press.
https://doi.org/10.1016/B978-0-12-814449-7.00003-X
DFØ. (2009). Internrevisjon og intern kontroll i statlige virksomheter—En kartlegging (p.
58). Direktoratet for forvaltning og økonomistyring.
https://dfo.no/filer/Fagomr%C3%A5der/Rapporter/Arkiv/R0409-Internrevisjon-og-
intern-kontroll-i-statlige-virksomheter-en-kartlegging.pdf
Directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on
markets in financial instruments and amending Directive 2002/92/EC and Directive
2011/61/EU Text with EEA relevance, 32014L0065, EP, CONSIL, OJ L 173 (2014).
http://data.europa.eu/eli/dir/2014/65/oj/eng
Domingues, P., Sampaio, P., & Arezes, P. M. (2016). Integrated management systems
assessment: A maturity model proposal. Journal of Cleaner Production, 124, 164–
174. https://doi.org/10.1016/j.jclepro.2016.02.103
Drnevich, P. L., & Kriauciunas, A. P. (2011). Clarifying the conditions and limits of the
contributions of ordinary and dynamic capabilities to relative firm performance.
Strategic Management Journal, 32(3), 254–279. https://doi.org/10.1002/smj.882

85
EBA. (2019, July 4). Interpretation of the concept of senior management laid down in Article
3(1)(9) of CRD IV. European Banking Authority. https://www.eba.europa.eu/single-
rule-book-qa/-/qna/view/publicId/2018_4286
Eisenhardt, K. M. (1989). Building Theories from Case Study Research. The Academy of
Management Review, 14(4), 532–550.
ESMA. (2020a). ESMA provides guidance on the compliance function under MiFID II.
https://www.esma.europa.eu/press-news/esma-news/esma-provides-guidance-
compliance-function-under-mifid-ii
ESMA. (2020b). Final Report Guidelines on certain aspects of the MiFID II compliance
function requirements (p. 43).
EY. (2015). The world of financial instruments is more complex. Time to take action. Capital
markets reform: MiFID II. https://eyfinancialservicesthoughtgallery.ie/wp-
content/uploads/2015/06/EY-MiFID-II-Client-Brochure-MiFID-II-Time-to-take-
action-LR.pdf
Falck-Ytter, K. (2021, March 4). Visma-sjef: – Dette er hva digitalisering egentlig handler
om. Visma Blogg - om teknologi, regnskap, skatt, lønn, innkjøp, HR.
https://www.visma.no/blogg/vidar-evensen-digitalisering-intervju/
Feise, J. (2020, November 4). Compliance Program Maturity Model: How Do You Rank?
GAN Integrity. https://www.ganintegrity.com/blog/compliance-program-maturity-
model/
Finanstilsynet. (2017, December 4). MiFID II / MiFIR. Finanstilsynet.
https://www.finanstilsynet.no/
Fraser, P., Moultrie, J., & Gregory, M. (2002). The use of maturity models/grids as a tool in
assessing product development capability. IEEE International Engineering
Management Conference, 1, 244–249. https://doi.org/10.1109/IEMC.2002.1038431
Frigo, M. L., & Anderson, R. J. (2009, February). A strategic framework for governance, risk,
and compliance. Strategic Finance, 90(8), 20+. Gale Academic OneFile.
Gay, P. D., & Gay, G. P. and A. D. of the P.-P. P. P. D. (2005). The Values of Bureaucracy.
Oxford University Press.
Green, B. N., Johnson, C. D., & Adams, A. (2006). Writing narrative literature reviews for
peer-reviewed journals: Secrets of the trade. Journal of Chiropractic Medicine, 5(3),
101–117. https://doi.org/10.1016/S0899-3467(07)60142-6
Grimstad. (2020, July). Advokatfirmaet Erling Grimstad AS. governance.
https://www.governance.no
Hammer, M. (2007, April 1). The Process Audit. Harvard Business Review.
https://hbr.org/2007/04/the-process-audit
Harvey, J. (2004). Compliance and Reporting Issues Arising for Financial Institutions from
Money Laundering Regulations: A Preliminary Cost Bene®t Study. 14.
ISO. (2020). ISO/CS : Information for visitors. 7.
86
ISO - About us. (n.d.). ISO. Retrieved April 27, 2021, from https://www.iso.org/about-us.html
Karp, B., Sacksteder, E., O’Brien, J., Bergman, M., Gonzalez, R., & Buergel, S. (2018,
October 5). The Financial Crisis 10 Years Later: Lessons Learned. The Harvard Law
School Forum on Corporate Governance.
https://corpgov.law.harvard.edu/2018/10/05/the-financial-crisis-10-years-later-lessons-
learned/
Kazanjian, R. K., & Drazin, R. (1989). An Empirical Test of a Stage of Growth Progression
Model. Management Science, 35(12), 1489–1503.
Keen, R. (2019, August 16). ISO 9001 Requirements. Https://Www.Iso-9001-
Checklist.Co.Uk/. https://www.iso-9001-checklist.co.uk/iso-9001-requirements.htm
Kenton, W. (n.d.). The Ins and Outs of Financial Instruments. Investopedia. Retrieved
January 23, 2021, from https://www.investopedia.com/terms/f/financialinstrument.asp
Kenton, W. (2019). Governance, Risk Management, and Compliance (GRC) Explained.
Investopedia. https://www.investopedia.com/terms/g/grc.asp
Kenton, W. (2020). How Cost-Benefit Analysis Process Is Performed. Investopedia.
https://www.investopedia.com/terms/c/cost-benefitanalysis.asp
Kharbili, M., Sebastian, S., Markovic, I., & Pulvermüller, E. (2008). Towards a framework
for semantic business process compliance management. CEUR Workshop
Proceedings, 339, 1–15.
Koehn, D. (2005). Integrity as a Business Asset. Journal of Business Ethics, 58(1–3), 125–
136. https://doi.org/10.1007/s10551-005-1391-x
Kohlegger, M. (2009). Understanding Maturity Models. 11.
Lasrado, L., Vatrapu, R., & Andersen, K. N. (2015). MATURITY MODELS DEVELOPMENT
IN IS RESEARCH: A LITERATURE REVIEW.
https://doi.org/10.13140/RG.2.1.3046.3209
Laufer, W. S. (1999). Corporate Liability, Risk Shifting, and the Paradox of Compliance.
Vanderbilt Law Review, 52, 1341.
Lincoln, Y. S., & Guba, E. G. (1985). Naturalistic Inquiry. SAGE.
Loh, G. (2019). GRC Silos and Principled Performance. Linkedin.
https://www.linkedin.com/pulse/grc-silos-principled-performance-grace-loh-2d
Maier, A., Kreimeyer, M., Hepperle, C., Eckert, C., Lindemann, U., & Clarkson, P. (2008).
Exploration of Correlations between Factors Influencing Communication in Complex
Product Development. Concurrent Engineering Research and Applications, 16.
https://doi.org/10.1177/1063293X07084638
Maier, A. M., Moultrie, J., & Clarkson, P. J. (2012). Assessing Organizational Capabilities:
Reviewing and Guiding the Development of Maturity Grids. IEEE Transactions on
Engineering Management, 59(1), 138–159.
https://doi.org/10.1109/TEM.2010.2077289

87
March, S. T., & Smith, G. F. (1995). Invited Paper Design and natural science research on
information technology.
Merchant, K. A., & Van der Stede, W. A. (2017). Management control systems: Performance
measurement, evaluation and incentives (Fourth Edition). Pearson.
Mettler, T. (2011). Maturity assessment models: A design science research approach.
International Journal of Society Systems Science, 3(1/2), 81.
https://doi.org/10.1504/IJSSS.2011.038934
Mitchell, S. L. (2007). GRC360: A framework to help organisations drive principled
performance. International Journal of Disclosure and Governance, 4(4), 279–296.
https://doi.org/10.1057/palgrave.jdg.2050066
Morse, J. M. (2008). Does Informed Consent Interfere With Induction? Qualitative Health
Research, 18(4), 439–440. https://doi.org/10.1177/1049732307313614
Moultrie, J. (2009). Developing maturity grids for assessing organisational capabilities:
Practitioner guidance.
https://www.academia.edu/3391266/Developing_maturity_grids_for_assessing_organi
sational_capabilities_Practitioner_guidance
Msib, A. S., & Foster, P. L. (2019). An Implementation Guide for the Healthcare Provider
Industry. 36.
Noble, H., & Smith, J. (2015). Issues of validity and reliability in qualitative research.
Evidence Based Nursing, 18(2), 34–35. https://doi.org/10.1136/eb-2015-102054
Nowell, L. S., Norris, J. M., White, D. E., & Moules, N. J. (2017). Thematic Analysis:
Striving to Meet the Trustworthiness Criteria. International Journal of Qualitative
Methods, 16(1), 1609406917733847. https://doi.org/10.1177/1609406917733847
NSD. (n.d.). Norwegian Centre for Research Data. NSD. Retrieved May 30, 2021, from
https://nsd.no/en
Oded, S. (2013). Corporate Compliance. Edward Elgar Publishing.
Paulk, M. (1994). A Comparison of ISO 9001 and the Capability Maturity Model for
Software.
Paulk, M. C., Curtis, B., Chrissis, M. B., & Weber, C. V. (1993). Capability Maturity
Model(SM) for Software, Version 1.1. 82.
Poeppelbuss, J., & Roeglinger, M. (2011, June 9). What makes a useful maturity model? A
framework of general design principles for maturity models and its demonstration in
business process management. 19th European Conference on Information Systems,
ECIS 2011.
Proff® – Segmenteringsverktøy. (n.d.). Retrieved March 21, 2021, from
https://proff.no/laglister?i=66.120&samplerFilter=true
Pullen, W. (2007). A public sector HPT maturity model. Performance Improvement, 46(4), 9–
15. https://doi.org/10.1002/pfi.119

88
PwC. (2004). Integrity-Driven Performance—PDF. https://docplayer.net/9573578-Integrity-
driven-performance.html
PwC State of Compliance Study 2016—Laying a strategic foundation for strong compliance
risk management. (2016). 22.
Ramakrishna, S. P. (2015). Enterprise compliance risk management: An essential toolkit for
banks and financial services. http://www.books24x7.com/marc.asp?bookid=82428
Roeglinger, M., Poeppelbuss, J., & Becker, J. (2012). Maturity Models in Business Process
Management. Business Process Management Journal, 18, 328–346.
https://doi.org/10.1108/14637151211225225
Rosemann, M., & de BRUIN, T. (2005). Application of a Holistic Model for Determining
BPM Maturity. 21.
RSA Archer® Regulatory & Corporate Compliance Management. (n.d.). 9.
Rummler, G. A., & Brache, A. P. (1990). Improving Performance: How to Manage the White
Space on the Organization Chart. Wiley.
Savin-Baden, M., & Major, C. H. (2012). Qualitative research: The essential guide to theory
and practice. Routledge.
Schjødt. (2018). MiFID II inntas i norsk lov fra årsskiftet – Særnorske egenhandelsregler er
historie. https://www.schjodt.no/news--events/nyhetsbrev/mifid-ii-inntas-i-norsk-lov-
fra-arsskiftet--sarnorske-egenhandelsregler-er-historie/
Singh, D. (2005). Basel Committee on Banking Supervision: Compliance and the compliance
function in banks. Journal of Banking Regulation, 6(4), 298–300.
https://doi.org/10.1057/palgrave.jbr.2340198
Snyder, H. (2019). Literature review as a research methodology: An overview and guidelines.
Journal of Business Research, 104, 333–339.
https://doi.org/10.1016/j.jbusres.2019.07.039
Solli-Sæther, H., & Gottschalk, P. (2010). The Modeling Process for Stage Models. Journal
of Organizational Computing and Electronic Commerce, 20(3), 279–293.
https://doi.org/10.1080/10919392.2010.494535
Solli-Sæther, H., & Gottschalk, P. (2015). Stages-of-Growth in Outsourcing, Offshoring and
Backsourcing: Back to the Future? Journal of Computer Information Systems, 55(2),
88–94. https://doi.org/10.1080/08874417.2015.11645760
Stake, R. E. (1995). The Art of Case Study Research. SAGE.
Steinberg, R. M. (2011). Keys to Getting It Right - Governance, Risk Management, and
Compliance: It Can’t Happen to Us—Avoiding Corporate Disaster While Driving
Success. Wiley. https://learning.oreilly.com/library/view/governance-risk-
management/9781118102572/chapter01.html
TechTarget. (2014). What is compliance risk ? SearchCompliance.
https://searchcompliance.techtarget.com/definition/compliance-risk

89
Teece, D. J., Pisano, G., & Shuen, A. (1997). Dynamic capabilities and strategic management.
Strategic Management Journal, 18(7), 509–533. https://doi.org/10.1002/(SICI)1097-
0266(199708)18:7<509::AID-SMJ882>3.0.CO;2-Z
Teo, T. S. H., & King, W. R. (1997). Integration between Business Planning and Information
Systems Planning: An Evolutionary-Contingency Perspective. Journal of Management
Information Systems, 14(1), 185–214. JSTOR.
Thomas, G. (2011). A Typology for the Case Study in Social Science Following a Review of
Definition, Discourse, and Structure. Qualitative Inquiry, 17(6), 511–521.
https://doi.org/10.1177/1077800411409884
Torraco, R. J. (2016). Writing Integrative Literature Reviews: Guidelines and Examples:
Human Resource Development Review. https://doi.org/10.1177/1534484305278283
VComply Editorial. (2017). What is principled performance and how to achieve it? The
Governance Blog. https://blog.v-comply.com/principled-performance/
Vicente, P., & Mira da Silva, M. (2011). A Conceptual Model for Integrated Governance,
Risk and Compliance. In R. King (Ed.), Active Flow and Combustion Control 2018
(Vol. 141, pp. 199–213). Springer International Publishing.
https://doi.org/10.1007/978-3-642-21640-4_16
Wendler, R. (2012). The maturity of maturity model research: A systematic mapping study.
Information and Software Technology, 54(12), 1317–1339.
https://doi.org/10.1016/j.infsof.2012.07.007
Wong, G., Greenhalgh, T., Westhorp, G., Buckingham, J., & Pawson, R. (2013). RAMESES
publication standards: Meta-narrative reviews. Journal of Advanced Nursing, 69(5),
987–1004. https://doi.org/10.1111/jan.12092
Yin, R. K. (2018). Case study research and applications: Design and methods (Sixth edition).
SAGE.

90
Appendix 1: An overview of the maturity models for the compliance domain reviewed
for this study
The table provides a summary of six maturity model reviewed for this study. The sample
consists of maturity models developed by academic researchers, industry, and consulting
firms, provided they meet the criteria for the literature review in comparison of existing
maturity models, as set out in the methodology chapter.

Who is behind the model Maturity levels Description

Carnegie Mellon University 1. Initial The CMM for Software describes the
Software CMM 2. Repeatable principles underlying software process
3. Defined maturity and is intended to help
CMU is a global research 4. Managed software organizations improve the
university known for its 5. Optimizing maturity of their software processes in
interdisciplinary programs: arts, terms of an evolutionary
business, computing, engineering, path from ad hoc, chaotic processes to
humanities, policy and science. mature, disciplined software processes.
Each maturity level is decomposed into
several key process areas that indicate
the areas an organization should focus
on to improve its software process.
Key process areas identify the issues
that must be addressed to achieve a
maturity level (M. Paulk, 1994)

ISO 9001 1. ISO Certified ISO 9001 sets out the criteria for a
2. Not ISO Certified quality management system, based on a
ISO (International Organization for number of quality management
Standardization) is an independent, principles including a strong customer
non-governmental international focus, the motivation and implication
organization with a membership of of top management, the process
164* national standards bodies.
Through its members, it brings
approach and continual improvement.
together experts to share knowledge When the quality management
and develop voluntary, consensus- principles are complied with by
based, market-relevant International companies, they can be certified. This
Standards that support innovation and reassures clients that the company has
provide solutions to global challenges established a proper Quality
(ISO, 2020). Management System (ISO - About Us,
n.d.; Keen, 2019)

RSA Archer® Regulatory & 1. Siloed The RSA Archer Maturity Model for
Corporate Compliance Management 2. Transition Regulatory and Corporate Compliance
(2020) 3. Managed Management focuses on building key
capabilities over time, implementing a
4. Transform
RSA Archer is a for profit company broad strategy with tactical, intelligently
that provides organizations with 5. Advantages designed processes. The key capabilities
technology to address challenges involve understanding of business context,
across security, risk management and effective adaption to changes in compliance
fraud prevention in the digital era- requirements (regulatory obligations),
aligned and functional governance across
the organization, and an end-to-end solution
in operational controls.

Compliance Week and Thomson 1. Siloed and inconsistent The goal of the survey was to ascertain the
Reuters - The Compliance Maturity 2. Organized but reactive functional, historical, process, and system
Survey (2009) 3. Actively Managed and maturity of companies’ compliance
program. Focus on the compliance
proactive
programs being coordinated, orchestrated

91
Compliance Week, published 4. Fully integrated and and managed in unison, offering complete
by Wilmington plc, is a business embedded visibility across the global enterprise (p.4).
intelligence service on corporate
governance, risk, and compliance that
features daily news and analysis, a
quarterly print magazine, proprietary
databases, industry-leading events,
and a variety of interactive features
and forums.

Thomson Reuters is a provider of

solutions for governance, risk and
compliance (GRC) including
comprehensive software solutions,
training, and expert GRC professional
services.
Compliance Program Maturity Model 1. Developing Maturity model consisting of five critical
(2020) 2. Defined elements that are strong indicators of a
3. Structured program’s development. Each of these
elements impacts a compliance program’s
4. Optimized
GAN is provider of the Risk and ability to foster a culture of compliance,
Compliance Portal which is home to 5. Efficient distribute compliance communications
country risk assessment reports, across the organization, and gain executive
regulatory compliance guides, and buy-in and support. Elements: Defined
compliance best practices. processes, resources and autonomy,
connected technology, analytics and
reporting, business value.

The modernized Compliance Risk 1. Nonexistent The framework is underpinned by eight key
Management Framework, Deloitte 2. Minimal organizational compliance elements:
(2017) 3. Reactive governance, policies and procedures, risk
assessment and regulatory change,
4. Evolving
Deloitte is one of the world's largest monitoring and testing, data, measurement
providers of professional services in 5. Proactive and reporting, escalation, investigation and
auditing, consulting and legal services 6. Optimized resolution, communication, awareness and
training, and regulatory interaction and
coordination. Enablers are people, process,
technology and analytics (p.13).

92
Appendix 2: Interview protocol
Part 1 of the interview – before testing the model:
Subject Suggested questions Notes
Introduction • Information about the study and
how the interview will unfold.
• General information about the
interviewees position and areas of
responsibility in the company
General information on • Has the company defined what
internal control and lies in the concept of Compliance
compliance risk?
→ If yes - how is it defined?
• What do you put in the term «an
effective compliance function»?
• How far would you say the
company has come in the work of
establishing an effective
compliance function - since
MiFID II was implemented in
Norwegian law in 2019?
More about the compliance • Which resources / capabilities /
function processes do you consider most
important for a well-functioning
compliance function?
→ How would you briefly and
concisely define an effective
compliance function based on
these?
Questions related to key enablers as described in the model:
«Business integrity» • How would you describe "Tone
at the top / middle" in the
company, in terms of
compliance?
• Does the company have defined
values and ethical starting points
for business management?
→ Are all of the company's
employees familiar with these?
→ Is it natural for employees to
follow these? How would you
say the compliance culture in the
firm is?
«Resources» • Are necessary/sufficient
resources allocated to the
function?
→ If additional resources are
needed, will these be allocated?
• What is the basis for assessing
the need for resources?
→ How often are these
assessments made?
→ Budget negotiations...

93
 «Policy and processes» • Does the firm have defined
compliance policies and
processes?
→ How is it arranged for these to
be understood and followed by
employees?
→ Are they integrated in the
workflow?
→ When/how are they updated?
«Coordination» • How does the compliance function
interact with other business
functions?
→ Is there any communication
gaps?
→ Overlaps?
• Defined lines of communication?
• Common goals and direction?
«Technology» • How is technology used to make
the compliance function more
efficient today?
→Automated processes?
→A common/integrated system?
Model evaluation
Usability • How do you think the points we
have been through so far represent
important elements for an
effective compliance function?
• How did you think the structure of
the model works in terms of
usability?
• Is the language of the model
understandable?
Usefulness • After being presented with/tested
the model:
→ Would you consider using such
a model in future work with
improving the effectiveness of the
compliance function?
→ Do you consider the “cell
descriptions” to be relevant
“guidelines”
→ Has the model in any way
triggered reflection or learning?
Concluding • Thank you
• What happens next?
→ Member check

Part 2 of the interview – getting acquainted with the model/testing:

94
Interview Part 2

Using the model below, a firm's organization around the compliance function as it is today can be assessed with
regard to given criteria for the various process areas. This, in order to map its «maturity» (efficiency).

In short, one considers each individual key enabler (see the Y-axis) and evaluates this against the criteria in the
model (the descriptions in each of the boxes). One then ticks off for the description that best matches the current
situation in the ones firm.

When the exercise has been performed for each of the key enablers, the idea is that cell descriptions at a higher
level (along the x-axis) than the one “ticked off” can be used as "guidelines" in further efficiency work.

An example of this could be that the function is considered reactive and inconsistent when it comes to
technology and automated systems (Level 1). In that case, you look at the next box, which gives indications of
what it takes to get to a higher level. Here, a start would be to automate processes that seems to be ready for
such.

Based on this brief introduction, and the proposed model:

- How do you think the structure of the model works in terms of usability?
- Is the language in the model understandable?
- Would you consider using this type of model in future work with improving the effectiveness of the
compliance function?
- Do you consider the "cell descriptions" to be relevant "guidelines"?
- Did the model in any way trigger reflection or learning?

NB: As the case company is Norwegian, and the interviewee is Norwegian speaking, the interview was held in
Norwegian. A Norwegian version of the information sheet belonging to part 2 was also sent to the interviewee.

95
Appendix 3: Information and consent form

96
97
98