Debbie Troklus (debbie@troklusconsulting.org) is President of Troklus Compliance Consulting, Louisville, KY. Sarah M. Couture (sarah.couture@ankura.com) is Managing Director, Ankura Consulting, Chicago.
If you are new to compliance, you may have noticed that compliance officers talk a lot about compliance program effectiveness. That is for good reason. According to the Federal Sentencing Guidelines, which provide the reasoning and framework for compliance programs, effectiveness is the expectation.[1] That’s the goal! An effective compliance program can help to “mitigate the ultimate punishment of an organization.” It is not enough to simply have a compliance program. That compliance program must be effective. So, what does that mean? According to Merriam-Webster, when something is effective, it produces “a decided, decisive, or desired effect.”[2] In a compliance program, the desired outcome is preventing and detecting fraud, waste, and abuse. That is the whole purpose of a compliance program. If a compliance program is not effective, that is, it does not effectively prevent and detect fraud, waste, and abuse; it will not meaningfully decrease organizational culpability as outlined in the Federal Sentencing Guidelines. In other words, your compliance program must work!
So, how do you know your compliance program is effective? Before 2017, there was plenty of discussion in the compliance profession about effectiveness, and it was obvious what ineffective compliance programs looked like. But what the government thought about compliance, how it viewed and defined it, and what it should look like in practice were a little more amorphous. Since compliance program effectiveness is the expectation of the government and the measurement against which a compliance program will be judged, it was challenging to know whether a compliance program would be up to par with the seemingly subjective goal. But in 2017, the U.S. Department of Health & Human Services Office of Inspector General (OIG), in collaboration with the Health Care Compliance Association (HCCA),[3] as well as the U.S. Department of Justice (DOJ)[4] published guidance documents that gave us insights into how the government viewed effectiveness. Since then, the DOJ guidance has been updated twice, in 2019 and in 2020, and the compliance profession has had more of a glimpse into how the government views effectiveness. While these guidance documents provide insights into compliance program effectiveness expectations, determining whether a program works is not a simple or one-dimensional endeavor. True effectiveness cannot be confirmed with just a checklist.
The OIG guidance specifically states: “This is not a ‘checklist’ to be applied wholesale to assess a compliance program. An organization may choose to use only a small number of these in any given year. Using them all or even a large number of these is impractical and not recommended. The utility of any suggested measure listed in this report will be dependent on the organization’s individual needs. Some of these suggestions might be used frequently and others only occasionally. The frequency of use of any measurement should be based on the organization’s risk areas, size, resources, industry segment, etc. Each organization’s compliance program and effectiveness measurementprocess will be different” (emphasis added).[5]
We must use the guidance documents and other government insights and perspectives, while also adding “soft” elements—including, but not limited to, perceptions, progress toward goals, program evolution, risk prioritization, and culture—that cannot be measured merely by a checklist. Instead, and in the spirit of the OIG’s admonition, we must tailor and prioritize measuring our program’s effectiveness and progress toward that goal in a way that is appropriate and customized according to our organization’s size, resources, areas of business, risk profile, and other company specifics.
This article discusses why effectiveness is important, why it can be challenging to achieve, the hallmarks of effective compliance programs, methods and tools to help gauge effectiveness, and practical pointers as you continue chasing the goal of compliance program effectiveness.
Why does prioritizing and pursuing compliance program effectiveness matter?
Aside from the obvious answer—mitigating the ultimate punishment of an organization (e.g., potentially lower fines, potentially avoiding a corporate integrity agreement)—there are numerous benefits for an organization that has an effective compliance program. Effective compliance programs can find, address, and fix issues before they grow too large or out of control. The longer the issue exists, the more difficult it is to fix it. Effective compliance programs have educated and informed staff that know how to do their jobs in a compliant and effective way and how to spot and report concerns so they can be addressed. Effective compliance programs have cultures of transparency, where team members are comfortable reporting concerns, and managers and leaders appreciate and act on the reports. Organizations with effective compliance programs are more likely to bill correctly and keep reimbursement dollars, instead of paying back reimbursements when future audits identify overpayments. Evidence of an effective compliance program can help result in favorable business deals, such as in mergers and acquisitions or helping secure better insurance rates. Organizations with effective compliance programs have better communication and better cultures, run more efficiently, provide higher-quality care, and are more likely to protect their brand and reputation by preventing front-page news stories about wrongdoing.
