It is often said an effective compliance program is difficult to measure, but experienced compliance professionals “know it when they see it”. This is not much comfort to many compliance professionals. A key outcome of having a compliance program is that it is effective. This is even less comfort to individuals who have limited resources for their compliance program. But even with limited resources, there are still ways to demonstrate effectiveness. It just requires more creativity and leveraging of other resources that may not be part of the compliance department.
As we think about the seven elements of an effective compliance program there are considerations in most if not all of them for leveraging work done by others to demonstrate effectiveness. The compliance department does not need and really should not own “compliance”. That is really a component of the organizational culture. If compliance is embedded in the culture and operations of an organization there may be multiple ways to demonstrate effectiveness through the work of others. Let’s take just one example – how the organization handles credit balances. Please note, not every one of the seven elements of an effective compliance program will be applicable to the example.
Policies, Standards, and Procedures
The Revenue Integrity Office may have a policy on the handling of credit balances. This is a policy that has compliance implications but is often not “controlled” or “owned” by compliance. Assuring that a policy exists, and it meets regulatory obligations, is the important part. This and other policies may be owned by other operational departments, but this still ties into demonstrating effectiveness. Having knowledge of them and working with the business unit owner to assure the policies accurately reflect the current state of regulatory obligations and organizational practices will help the compliance officer articulate why the program is effective.
Reporting on the state of a credit balance may not be the responsibility of the compliance professional. Knowing that updates are being provided and what is being reported by someone too senior leadership and/or the governing body is important for the compliance professional to track. Tracking down where and by whom information on credit balance is reported will give the compliance professional the ability to demonstrate this is an important issue to senior leadership and appropriate oversight is being performed.
Training and Education
Has compliance assured all appropriate staff is trained on the credit balance policy? Again, the training may not be performed or recorded by compliance. Compliance needs to be aware that the training exists, staff have completed the training, it is documented and they know where to get the data on this if needed. The records may be maintained by the department or human resources. It does not need to be the responsibility of the compliance department. The compliance department simply needs to assure the training is there and the documentation exists. They can leverage the work of others to help demonstrate effectiveness.
Auditing and Monitoring
Compliance can verify with the Revenue Integrity Department that they are following the credit balance policy by asking for routine reports (some of which the department may already be generating for their own KPIs) such as the rolling credit balance. The compliance officer may also want to look at reports that show the aging of credit balance. This will help demonstrate the credit balances, which may not be getting smaller over time, are being promptly worked. The balance may not fluctuate much over time, but the fact that it is not getting older demonstrates the net additions are balanced against the accounts being resolved. To the extent the compliance professional can leverage work, reports or processes already occurring it helps demonstrate effectiveness without significantly increasing the burden on operational units.
Compliance may also look at credit balance audits performed by Internal Audit. If Internal Audit has not done an audit, compliance may be able to coordinate with them to do an audit in this finance related area. When compliance has no resources for auditing, coordination with Internal Audit can be a way to have some compliance auditing performed. When compliance has some resources for auditing but the resources are limited, coordinating with Internal Audit may be a way to expand the number of areas audited. Internal Audit can be leveraged for audits within their expertise while compliance focuses on those where other expertise is appropriate.
Response and Prevention
If an issue regarding credit balance if either identified through monitoring, auditing, internal reporting or an external review it must still be dealt with as a compliance issue. The burden does not need to rest solely on the compliance department. This may be an opportunity to work with the Revenue Integrity Department to pull records, Internal Audit to assist in reviewing the records and legal counsel to research and provide guidance on the organization’s obligations.
A key factor is for the compliance professional to learn as much as possible about the “normal” operations of the business to make it easier to leverage existing processes and to spot the abnormal. Was a process changed? Did the reporter misunderstand the regulatory obligations? What do the aging reports show? Have the balances of credit balances increased over time or have they shifted between payors? While it is ideal to have a compliance function that has as much independence and objectivity as possible, with limited resources other avenues may need to be explored.
One aspect of assessing effectiveness articulated by the DOJ memo issued in 2017 is whether the compliance program is appropriately resourced. Some would interpret this to mean the budget of the compliance office. However, understanding all of the resources that may be utilized to make a compliance program effective may mean looking beyond just the compliance office budget. Being prepared to show an outside party where all compliance activities are occurring may help the organization that does not have a huge compliance office still demonstrate it has an effective compliance program. Building relationships and leveraging the activities, expertise, and resources of other departments will help to do this.