Chasing the goal: How do you know if your compliance program is truly effective?

Debbie Troklus ( is President of Troklus Compliance Consulting, Louisville, KY. Sarah M. Couture ( is Managing Director, Ankura Consulting, Chicago.

If you are new to compliance, you may have noticed that compliance officers talk a lot about compliance program effectiveness. That is for good reason. According to the Federal Sentencing Guidelines, which provide the reasoning and framework for compliance programs, effectiveness is the expectation.[1] That’s the goal! An effective compliance program can help to “mitigate the ultimate punishment of an organization.” It is not enough to simply have a compliance program. That compliance program must be effective. So, what does that mean? According to Merriam-Webster, when something is effective, it produces “a decided, decisive, or desired effect.”[2] In a compliance program, the desired outcome is preventing and detecting fraud, waste, and abuse. That is the whole purpose of a compliance program. If a compliance program is not effective, that is, it does not effectively prevent and detect fraud, waste, and abuse; it will not meaningfully decrease organizational culpability as outlined in the Federal Sentencing Guidelines. In other words, your compliance program must work!

So, how do you know your compliance program is effective? Before 2017, there was plenty of discussion in the compliance profession about effectiveness, and it was obvious what ineffective compliance programs looked like. But what the government thought about compliance, how it viewed and defined it, and what it should look like in practice were a little more amorphous. Since compliance program effectiveness is the expectation of the government and the measurement against which a compliance program will be judged, it was challenging to know whether a compliance program would be up to par with the seemingly subjective goal. But in 2017, the U.S. Department of Health & Human Services Office of Inspector General (OIG), in collaboration with the Health Care Compliance Association (HCCA),[3] as well as the U.S. Department of Justice (DOJ)[4] published guidance documents that gave us insights into how the government viewed effectiveness. Since then, the DOJ guidance has been updated twice, in 2019 and in 2020, and the compliance profession has had more of a glimpse into how the government views effectiveness. While these guidance documents provide insights into compliance program effectiveness expectations, determining whether a program works is not a simple or one-dimensional endeavor. True effectiveness cannot be confirmed with just a checklist.

The OIG guidance specifically states: “This is not a ‘checklist’ to be applied wholesale to assess a compliance program. An organization may choose to use only a small number of these in any given year. Using them all or even a large number of these is impractical and not recommended. The utility of any suggested measure listed in this report will be dependent on the organization’s individual needs. Some of these suggestions might be used frequently and others only occasionally. The frequency of use of any measurement should be based on the organization’s risk areas, size, resources, industry segment, etc. Each organization’s compliance program and effectiveness measurementprocess will be different” (emphasis added).[5]

We must use the guidance documents and other government insights and perspectives, while also adding “soft” elements—including, but not limited to, perceptions, progress toward goals, program evolution, risk prioritization, and culture—that cannot be measured merely by a checklist. Instead, and in the spirit of the OIG’s admonition, we must tailor and prioritize measuring our program’s effectiveness and progress toward that goal in a way that is appropriate and customized according to our organization’s size, resources, areas of business, risk profile, and other company specifics.

This article discusses why effectiveness is important, why it can be challenging to achieve, the hallmarks of effective compliance programs, methods and tools to help gauge effectiveness, and practical pointers as you continue chasing the goal of compliance program effectiveness.

This document is only available to members. Please log in or become a member.

Would you like to read this entire article?

If you already subscribe to this publication, just log in. If not, let us send you an email with a link that will allow you to read the entire article for free. Just complete the following form.

* required field