Historically, compliance was a function of audit, risk management -- if it was performed at all-- was a function of management, and governance generally didn't exist as a discipline outside of Wall Street and the banking industry until Sarbanes-Oxley (SOX) made it a requirement for publicly traded companies.