Kelly Lange (klange@bcbsm.com) is Vice President Enterprise Compliance and Privacy Official at Blue Cross Blue Shield of Michigan in Detroit, MI.
Documentation serves an organization beyond the needs of expectation-setting and performance quality. Not only do documented policies set expectation and drive accountability within the workforce, they are fundamental in an organization’s hierarchy of needs and can be a key business enabler, building the trust of your customers and regulators. When your workforce clearly knows what to do with supporting expectations, accountability and engagement will thrive and contribute to business results and compliance effectiveness.
Policies are a key control for companies, enabling compliance with applicable laws, regulations, and standards for operations. They are critical to business audit readiness, that is, policies are generally included in the first set of audit requests and informational requests made. They demonstrate the commitment and buy-in of overarching principles and support defense against fraud, waste, abuse, and misconduct. Policies are also part of risk mitigation and a part of corporate enterprise risk management. Given their importance and value, companies could be underinvesting in their policy governance maturity. After all, we have heard (and perhaps experienced) the old adage, “What is documented is more likely to be followed.”
With the increasing pressures of the “new compliance normal,” which can be defined as the growing industry demands from consumers and regulators and fast-paced implementation needs, there could be more pressure to defer or minimize key process control documentation in policies or procedures. It may also be increasingly difficult to obtain consistency if your organization is expanding or changing. Overall quality of documentation may be an unintended victim of circumstances. When changes are needed fast and furiously to meet demands, it may be tempting to deprioritize policies and other supporting documentation. Unfortunately, if deferred and not completed, it leaves the company exposed to knowledge gaps, missed requirements, and accountability gaps that could ultimately erode the trust of key stakeholders in your compliance program and negatively impact your business reputation and revenue.
Policy requirements
Regulators expect organizations to have corporate policies and standards. The HHS Office of Inspector General (OIG) and other regulatory bodies have reinforced—and even called out—written policies as an expected compliance program element. An organization must have standards of conduct and internal controls reasonably capable of reducing the likelihood of criminal and other improper conduct.[1]
The OIG has issued a number of compliance program guidance documents, all of which emphasize the need for written compliance guidance for employees. They comment that:
At a minimum, comprehensive compliance programs should include…the development and distribution of written standards of conduct, as well as written policies and procedures that promote the [organization’s] commitment to compliance and that address specific areas of potential fraud, such as claims development and submission processes, code gaming, and financial relationships with physicians and other health care professionals.[2]
The United States Sentencing Commission’s Federal Sentencing Guidelines comment that to “have an effective compliance and ethics program..., an organization shall…establish standards and procedures to prevent and detect criminal conduct.”[3]
Policies make it clear to the workforce how they are to act. It is important that the most essential policies and the supporting governance structure are endorsed at senior leadership levels and by the board members. When effective and supported by a strong tone at the top, policies are preventive and target doing the right thing. The most important policy in tone setting is generally the code of conduct. It is oftentimes the policy most collected from organizations by customers and regulatory auditors and, in many cases, is externally facing, communicating the company’s ethical attitude.
As you know from regulatory and customer audit experiences, policies provide insight into the culture and design of an organization’s internal controls. Policies are the windows into your organization. They set decision-making guidance for the company on a daily basis. Often, the policy will set the high-level requirements and answer the question “what.” Procedures are generally more detailed and define how the policies are put into practice. They define lower-level processes, such as day-to-day functions and activities and often answer the detailed questions around “how.”
As compliance professionals, we can help improve the policy infrastructure and strengthen this fundamental element of our programs. Engaging early with our Human Resource partners and other key business champions is first and foremost in importance. Disciplined policy governance and a strong partnership with change champions can lead to enhanced performance accountability, consistent practice, and more effective compliance.
