This is not a failure of organisational design. Legal, compliance, and enterprise risk were never really three separate things – they are three views of the same corporate picture. The troubles start when these functions forget that and start behaving as though they are three separate teams with three separate scorecards and three separate relationships with the business.
Ironing out the overlaps
Legal advises on what the law requires and what exposure looks like when the law is not followed. Compliance builds and monitors the policies, controls and training that keep the business inside the day-to-day guardrails. Risk sits above both, thinking about likelihood and impact across the whole enterprise, financial, operational, reputational, strategic.
In a well-run organisation, the three functions are not competing for the last word before the board - they are having one conversation from three vantage points and arriving at one coherent answer.
In practice, the same issue can land on all three desks in one day. A new product launch raises a legal question about contractual liability, a compliance question about whether existing controls cover the new risk and a risk question about what it does to the organisation's overall risk appetite. Handled well, you will have three perspectives converging quickly into one clear recommendation. Handled badly, you have three functions, each doing their own analysis in isolation, but arriving on three different timelines - leaving the business sponsor genuinely unsure who they should listen to.
At one organisation, a new digital onboarding product needed signing off by all three functions within a tight six-week deadline. Legal cleared the contractual terms in week one. Compliance was still validating the KYC controls in week four, having not previously seen the final product design. Risk only saw the complete picture in week five, at the steering committee meeting, by which point its concerns about concentration risk arrived too late to influence anything except the launch date. The product still launched - three weeks late, with a Risk sign-off that felt like a formality.
How silos form
Nobody sets out to build a silo. They form quietly, for reasons that may make sense at the time. Legal, Risk and Compliance often sit in different reporting lines, sometimes reporting into different C-suite executives. They use different vocabularies: Legal talks about liability and privilege, Risk talks about appetite and heat maps, Compliance talks about controls and attestations. They are measured differently too. Legal is often judged on deal velocity and litigation outcomes; Compliance on audit findings and training completion rates; Risk on the quality of its reporting to the board. None of those incentives are wrong in isolation. But when stacked against each other without properly effective coordination, they are pulling in three different directions.
Add in a dose of history, hangover from a merger, a regulatory enforcement action that reshuffled reporting lines, a Compliance function bolted on after Legal had already built its own way of doing things, and the silo further hardens. Everyone still says the right things about collaboration. The org chart and the day-to-day reality tell a different story.
What it costs when the silos hold
The cost of that gap rarely shows up as a single dramatic failure. It shows up as friction: the business team that gets contradictory guidance from Legal and Compliance on the same transaction and quietly starts routing round both; the risk register that doesn't reflect what Legal already knows is coming down the regulatory pipeline; the policy Compliance rolled out that Legal never had the chance to stress test for enforceability. It shows up as duplicated (even triplicated) effort, three functions each running their own due diligence on the same third party, and as gaps, an emerging risk that everyone assumed someone else owned.
Three functions in the same organisation each ran their own due diligence on the same outsourcing supplier in the same year, none aware the other two had already done it. Between them, they asked the supplier for largely the same information three times, in three different formats, on three different timelines. The supplier's account manager, not unreasonably, began asking the business sponsor why the same company left hand did not know what its two right hands were doing…
And it shows up, most damagingly, how the business perceives the three functions. When Legal, Risk and Compliance operate in silos, they do not act as a coordinated second line of defence. They present three separate hurdles which must be cleared before anything can get done. That perception is corrosive. It is how "the lawyers" and "the compliance people" become shorthand for delay rather than partnership, and it is how good risk intelligence stops reaching the people who need it, because nobody wants to be the fourth conversation in a process that already feels like three too many.
Building relationships which actually work
None of this is inevitable and fixing it does not require reorganisation. It just requires Legal, in particular, to take the lead in building a relationship with Risk and Compliance, based on partnership rather than marking of territory.
Start with a shared view of the risk landscape. If Legal is tracking regulatory change, litigation trends, or contractual exposure that Risk and Compliance do not see until there is already a problem, that relationship is already breaking down. A shared risk register, or even just a standing conversation where the three functions compare notes on what is coming down the pipe, does more to prevent duplication and gaps than formal policies.
In one case, a regular call between the General Counsel, the Head of Compliance and the Chief Risk Officer, with no fixed agenda beyond ‘what’s coming’, was enough to surface a regulatory change affecting a major contract renewal three months before it would otherwise have come to light - simply because Legal mentioned it in passing and Risk immediately recognised what it meant for a deal already in motion.
Get involved early and invite Risk and Compliance to do the same. The single biggest driver of friction between these functions is not disagreement, but timing. If Legal is brought in after Compliance has already committed to an approach, or Compliance is asked to build controls around a deal Legal has already signed off, this will always feel like rubber stamping rather than contribution. Early, joint involvement turns three sequential reviews into one collaborative conversation, and it is very hard to be an obstacle to something you helped design!
Agree, explicitly, on who leads when. Overlap doesn't have to mean confusion if the functions have taken the time to agree, in advance, which of them takes the lead on which categories of issue, and how they hand off or escalate between each other. That conversation is worth having before the difficult case arrives, not during it.
Invest in a shared vocabulary. It sounds small, but a lot of apparent disagreement between Legal, Risk and Compliance is often just three functions using the same word to mean different things, or three different words to mean the same thing. Time spent building common vocabulary and shared training pays for itself many times over.
And be generous about credit. Legal has a natural advantage in most organisations: it usually has the loudest voice in the room and the closest relationship with the board. Using that position to amplify what Risk and Compliance are doing, rather than to compete with them for airtime, is one of the fastest ways to turn a wary relationship into a real and effective partnership.
Organisations who get this right
The organisations who manage this well do not eliminate the overlap between Legal, Risk and Compliance. Simply put, they stop treating it as a problem. They treat it as three sets of expertise trained on the same target, coordinated closely enough that the business experiences them as one voice rather than three. That does not happen by accident, and it does not happen through an org chart redesign either. In my experience, that only happens when people in each function choose to build a relationship with each other and do not compete for the same seat at the table.
If you work in Legal and you still describe Risk and Compliance as functions you work alongside rather than functions you work with, those are the key relationships in which you need to invest. Before it is too late.
