2024 Compliance Program Effectiveness Assessment Planning Tips
One of the major planning steps for Compliance Officers for the new year is to have an assessment of the Compliance Program to document and evidence progress to date, identify opportunities for improvement and have action steps to enhance program effectiveness. Regular, rigorous, and consistent review of compliance programs is expected. Both the OIG and DOJ have noted that compliance programs are always a work in progress, never completed, responding to the ever-changing regulatory, legal, and business environment, and “One hallmark of an effective compliance program is its capacity to improve and evolve. In their November 2023 “General Compliance Program Guidance,” the OIG calls for the Management Compliance Committee to oversee compliance program assessments with the board evaluating the results. The DOJ, in their “Evaluation of Compliance Programs,” noted that “implementation of controls in practice will necessarily reveal areas of risk and potential adjustment.” They highlight the importance of “effective implementation and evaluation measures” to determine if the compliance program is a “paper program” or one that is fully “implemented, reviewed, and revised, as appropriate, in an effective manner.” Their prosecutors are directed to ask, “Does the company evaluate periodically the effectiveness of the organization’s compliance program?” The following are best practice tips when planning for an Independent Compliance Effectiveness Assessment:
- Educate the board and leadership that the OIG and DOJ consider all programs to be works in progress and that assessments provide a means to identify ways to enhance the program’s effectiveness.
- See that the board and leadership understand the responsibility for initiating compliance program assessments is theirs, not the Compliance Office. To do otherwise undermines the credibility of results and suggests it is merely a self-serving exercise.
- Scope of work should include evidencing and documenting the progress of the Compliance Program, identifying opportunities for improvement, and providing recommendations and suggestions for enhancing program effectiveness. This will orient the result in a positive manner.
- Request the Assessment Report be organized to follow the seven standard elements of an effective compliance program with relevant cited authority preceding the presentation of findings and recommendations. This will assist in evaluating the significance of what is being reported.
- Ensure the Assessment focuses on outcome and not process outputs as might be in a “gap analysis.” The whole purpose of an independent assessment is to validate effectiveness levels in meeting the goals and objective of the program in reducing the likelihood of unwanted events that could give rise to liabilities, including enforcement actions.
- Verify that the consultants identified to do the proposed work have extensive experience and expertise in conducting such reviews in the sector to which the organization functions. Determine years of experience for the firm in healthcare compliance and credentials of their staff, and debrief the proposed team leaders on their experience in performing this work.
- Ensure that the consultant organization being considered will attest that they will adhere to the basic principles of confidentiality, integrity, objectivity, independence, due diligence, competence of those assigned, and proper documentation of work; and all recommendations will arise from findings that, in turn, will be supported in the work papers.
- Have the consultants performing the Assessment certify they will attest to meeting the independent and objectivity standards as set forth by the General Accountability Office “Generally Accepted Government Auditing Standards (GAGAS)” for operational reviews and audits.
- Include in the annual compliance work plan actions as a result of findings from the Assessment and act promptly.
- Annual independent compliance program assessments can be expensive and of limited value. In alternate years, consider far less expensive evaluations using validated compliance knowledge and culture surveys administered independently, benchmarked against the universe of those using the same instrument. Further benchmarking can be done if the same survey is used again. However, it is not recommended that this type of survey be conducted annually.
Contact [email protected] for more information on planning and developing the scope of work, methodology, time, effort, and costs for having independent compliance program evaluations.
