For those of you who have experienced building compliance programs from the ground up, you may have realized the importance of creating and implementing your organization’s audit and monitoring program. For those who have not, this article may help explain the significance. After establishing the hotline, compliance manual, code of conduct, etc., your audit and monitoring program will ensure your organization’s processes are in compliance.
First, it’s essential to have a good understanding of auditing versus monitoring. Audits are customarily larger in scope, can occur monthly, quarterly, and/or annually and are performed by individuals independent of the process.[1] If possible, you want individuals not directly involved in the process to remove any conflicts of interest when performing the audit. Audits can be performed on a statistical sampling of a certain population or can be completely random. In the laboratory space, certain volumes of samples are tested regularly. One audit could take 10% of the sample volume for auditing purposes. Whereas, in another audit, how much to audit could be based on the number of resources available at the time. Monitoring assesses the controls that are in place regularly and is more reflective of your daily business operations. This allows you to consistently check in on the mechanisms you’ve put into place for compliance adherence.
Some examples of monitoring are survey results and compliance training. Employee exit interviews and compliance program surveys may identify potential issues within your program or organization, such as retaliation, a poor compliance culture, the effectiveness of your reporting tools, etc. A compliance training review ensures your employees actively review your company’s compliance manual and code of conduct and attend compliance training. This is important as it allows employees to have visibility into the program and better understand compliance. The most effective monitoring is completely dependent on your organization or industry.
Why is it important to audit and monitor?
-
Measures the effectiveness of your program. In the United States Department of Justice’s (DOJ) Evaluation of Corporate Compliance Programs, prosecutors consider this question: “Does the corporation’s compliance program work in practice?”[2] Auditing and monitoring allows you to check what is or isn’t working.
-
Identifies criminal or malicious conduct. This is extremely important, as criminal conduct may need to be reported to external agencies, and malicious conduct may identify the employees within the organization whose employment may require re-evaluation.
-
Highlights risk areas. Risk areas can vary across specialties and industries. Once your risk areas are identified, your organization can modify accordingly. After identification, you might want to change employee training and/or policies and procedures, implement mitigation steps to various processes to decrease risk, or implement other measures for mitigation.
-
Accountability. Allows all participants in the audit process to be on the same page about who is responsible for each audit or monitoring process. This also allows for transparency between compliance and other departments within the organization.
-
Continuous improvement. You don’t want your program to stagnate; you want to improve and contribute to the business objectives. Additionally, government agencies, like the DOJ or Office of Inspector General, want to see organizations consistently improve their compliance programs.
-
Promotes collaboration. This helps other departments see compliance as partners as opposed to adversaries. Additionally, it can create compliance champions in other departments. This is incredibly valuable if there is a one-or-two-person compliance team.
-
Efforts are rewarded. If a regulatory agency comes knocking on your door, you want to show them that you have been auditing and monitoring; provide examples of how you have improved your program based on your organization’s findings. DOJ prosecutors may reward efforts to promote improvement and sustainability.[3]
