Because compliance officers often find it challenging to assess the effectiveness of their compliance programs, experts at a compliance consulting firm and a Virginia university joined forces to create a model designed to drill down on various aspects of their programs and determine their level of maturity.
Their “compliance maturity model” (CMM) is based on “capability maturity models,” a concept developed by Carnegie Mellon in the 1980s. It can help organizations determine where their compliance programs stand and how to improve them, Robert Roach, senior adviser at Guidepost Solutions, and Kristine Henderson, director of compliance at University of Richmond LLC, said at a July 27 webinar sponsored by the Society of Corporate Compliance and Ethics.[1]
“A CMM focuses on integration of your compliance programs into organizational business processes by analyzing the ‘maturity’ of your program with levels that range from ad hoc practices to formally defined steps to managed with result metrics to active optimization of processes,” Roach said.
In this concept, the term “maturity” refers to the degree to which an organization’s processes have been formalized, implemented and integrated into its operations, Roach said.
From Ad Hoc to Optimal Levels
Under the compliance maturity model, Roach and Henderson said each building block of a compliance policy is evaluated for its maturity level. According to Roach, this model can provide: (1) a means to assess an organization’s compliance program against recognized standards; (2) a method for identifying next steps to advance the program; (3) a process for measuring progress against internal and external benchmarks; and (4) a tool that can be used to measure progress in specific compliance areas and projects, or the overall compliance program.
For example, when considering compliance program structure under the CMM, the program would be at an “ad hoc” level if there were no formal compliance structure, and at a “fragmented” level if senior management and the board encourage compliance but are not consistent in providing necessary support.
A “defined” level means the compliance structure has been established, with accountability assigned to key risk areas. A “mature” level means compliance responsibilities are reflected in position descriptions and individuals are reviewed annually on compliance responsibilities. Finally, an “optimal” level means a network of identified compliance officers/partners representing every significant operation is in place and they meet regularly to coordinate compliance activities.
