Healthcare Compliance Forms and Tools

Risk Assessment (p. 2 and 3)

Has the company’s compliance program (CP) been tailored based on a risk assessment and periodically updated?

Risk Management Process (p. 3)

Methodology and metrics collected to address risks?

Risk-Tailored Resource Allocation (p. 3)

Does the company proportionately devote time to high-risk areas vs. low-risk areas?

Updates and Revisions (p. 3)

Is the risk assessment subject to periodic review? Are updates to policies and procedures evident in light of lessons learned?

Policies and Procedures (p. 4)

Are policies and procedures aimed at reducing risk? Does the code of conduct set forth the organization’s commitment? Do policies and procedures incorporate culture of compliance into operations?

Design (p. 4)

What is the process for designing policies and procedures? Who has been involved and have business units been involved prior to rolling out the documents?

Accessibility (p. 4)

Has the company communicated policies and procedures to all employees and relevant third parties? Are language barriers addressed?

Operational Integration (p. 4)

Who has been responsible for policies and procedures rollout? Do employees understand? How are policies and procedures reinforced through internal controls?

Gatekeepers (p. 4-5)

What guidance and training has been provided to gatekeepers in the control process (i.e., those with approval authority)? Do the gatekeepers know how to escalate concerns?

Training and Communication (p. 5)

Has periodic training occurred for all employees and directors? Does training include education on prior incidents?

Risk-Based Training (p. 5)

What training has been offered for employees in control functions? Has there been training that addresses risk where misconduct has occurred? What analysis has been performed to determine the content and risks?

Content and Effectiveness of Training (p. 5-6)

Is the training language appropriate? Is it conducted online or in person or both—and what is the rationale? How does the company measure the effectiveness of the training? How will the company address those that fail the training?

Communication about Misconduct (p. 6)

What has senior management done to let employees know about the position of misconduct? What communications have occurred for the termination of an employee due to a misconduct?

Availability of Guidance (p. 6)

What resources are offered to employees to provide guidance regarding policies and procedures? Has the company assessed whether the employees know when and whom to seek for advice?

Confidential Reporting and Investigation Process (p. 6)

Is there an existent and well-trusted mechanism for employees to report allegations anonymously or confidentially? Has the complaint process created a workplace atmosphere without fear of retaliation and process to protect whistleblowers? Is there appropriate investigation of complaints of retaliation, timely follow-up, and discipline?

Effectiveness of Reporting (p. 6-7)

Does the company have anonymous reporting? How has the reporting been communicated to employees? How has the company assessed the seriousness of allegations? Has the compliance officer had full access to the reporting and investigative information?

Investigation by Qualified Personnel (p. 7)

How are complaints assessed for merit and further investigation? How does the company ensure the investigations are scoped, independent, objective, and properly documented? How does the company determine who does the investigation and who makes the determination?

Investigative Response (p. 7)

Does the company apply timing metrics to ensure responsiveness and monitor outcomes of investigations, ensuring accountability to the findings?

Resources and Tracking Results (p. 7)

Has the company collected, tracked, analyzed, and used information from its reporting mechanism? Are there patterns of misconduct or other red flags?

Third-Party Management (p. 7-8)

Does the company assess and understand the qualifications and associations of third parties (e.g., agents, consultants, distributors)? Is there a business need identified with a third-party transaction? Does the company regularly perform due diligence, auditing, and monitoring? Are annual third-party compliance certifications checked?

Risk-Based and Integrated Process (p. 8)

How has the company’s third-party management process corresponded to the nature and level of the enterprise identified? Has the process been integrated into procurement and vendor management processes?

Appropriate Controls (p. 8)

Is there business rationale for the use of third parties? What mechanisms exist to ensure services are being performed, payment terms are appropriate, and compensation is commensurate with the services rendered?

Management of Relationship (p. 8)

Has the company analyzed compensation and incentive structure for third parties against compliance risks? Does the company exercise its rights to audit books and accounts of third parties? How does the company train its third-party relationship managers about compliance risk? How does the company incentivize compliance and ethical behavior by third parties?

Real Actions and Consequences (p. 8)

Are red flags identified from due diligence of third parties? How are they addressed? For companies terminated or involved with misconduct, are there processes identified to prevent rehiring? Have third parties been suspended, terminated, or audited as a result of a compliance issue?

Mergers and Acquisitions (M&A) (p. 9)

Is pre-M&A due diligence performed on acquisition targets?

Due Diligence Process (p. 9)

Was misconduct identified during due diligence? Who conducted the risk review? How was it done? What is the general process?

Integration in the M&A (p. 9)

How has the compliance function been integrated into the merger, acquisition, and integration process?

Process Connecting Due Diligence to Implementation (p. 9)

Is there a process for tracking and remediating misconduct risks identified during due diligence? Are there policies and procedures for new entities?

Commitment by Senior and Middle Management (p. 10)

Board of directors (BOD) and executives set the tone and demonstrate rigorous adherence by example. Examine how middle management have reinforced standards. Governing authority shall exercise reasonable oversight.

Conduct at the Top (p. 10)

Senior leaders through words and actions encourage or discourage compliance. How have they modelled proper behavior to subordinates? Has management tolerated greater compliance risks in pursuit of new business or increased revenue?

Shared Commitment (p. 10)

What actions have senior leaders and middle management taken to demonstrate their commitment to compliance, including remediation? Have they persisted in that commitment in the face of competing interests or business objectives?

Oversight (p. 10-11)

What compliance expertise has been available on the BOD? Have the BOD and/or external auditors held executive or private sessions with compliance? What types of information have the BOD and senior management examined in their exercise of oversight of misconduct has occurred?

Autonomy and Resources (p. 11)

Has the company allocated sufficient personnel and resources within the compliance function? Is there sufficient seniority within the organization, sufficient resources, and sufficient autonomy from management; direct access to the BOD?

Structure (p. 11-12)

Where is the compliance function housed? To whom does the compliance function report?

Seniority and Structure (p. 12)

How does the compliance function compare with other strategic functions in terms of stature, compensation, rank/title, reporting, resources, and access to key decision-makers? Has there been turnover for compliance? What role does compliance have in operational decisions? Have there been transactions or deals that were stopped, modified, scrutinized as a result of a compliance concern?

Experience and Qualifications (p. 12)

Do compliance employees have the appropriate experience and qualifications for their roles and responsibilities? Has the level of experience/qualification changed over time? Who reviews the performance of the compliance function?

Funding and Resources (p. 12)

Has there been sufficient staffing for compliance personnel to effectively audit, document, and act on the results of the compliance efforts? Have there been times when requests for resources by compliance and control functions been denied and on what grounds?

Data Resources and Access (p. 12)

Do compliance and control personnel have sufficient direct or indirect access to relevant sources of data to allow for timely and effective monitoring and/or testing of policies, controls, and transactions? Do any impediments exist that limit access to relevant sources of data and, if so, what is the company doing to address the impediments?

Autonomy (p. 12)

Do the compliance and relevant control functions have direct reporting lines to anyone on the BOD? How often do they meet with the directors? Are members of senior management present for these meetings? How does the company ensure the independence of the compliance and control personnel?

Outsourced Compliance Functions (p. 13)

Has the company outsourced all or part of its compliance function(s) to an external firm or consultant? Who is responsible for overseeing the consultant? What level of access does the consultant have to company information? How has the effectiveness of the outsourced process been assessed?

Incentives and Discipline (p. 13)

Are disciplinary procedures in place enforced consistently and commensurate with the violations? Has it been communicated to the employees that unethical conduct will not be tolerated? Are incentives in place to promote the compliance program?

Human Resources Process (p. 13)

Who participates in making disciplinary decisions, including the type of misconduct at issue? Is there a consistent process? If not, why? Are reasons for disciplinary actions communicated to employees? Are there legal or investigative relations for restricting information?

Consistent Application (p. 13)

Are disciplinary action and incentives consistently applied across the organization? Are there similar instances of misconduct that were treated disparately, and if so, why?

Incentive Systems (p. 14)

How does the company incentivize compliance and ethical behavior? Are there examples of actions taken as a result of compliance and ethics considerations? Who determines the compensation, bonuses, discipline, and promotion of compliance personnel?

Does the CP work in practice? Has the company made significant investments in and improvements to the corporate compliance program and internal controls? (p. 14-15)

In assessing whether a company’s CP is working effectively at the time of misconduct, did the company perform a root cause analysis to understand what contributed to the misconduct and what remediation efforts should be implemented to prevent such action from reoccurring?

Continuous Improvement, Periodic Testing and Review (p. 15)

Has the company engaged in meaningful efforts to review its CP and ensure that it is not stale? Gauging the compliance culture, evaluating the strength of controls, and periodic audits and evaluations are crucial. Are revisions to the CP evident on lessons learned?

Internal Audit (p. 15)

What is the process for determining where and how frequently audits are performed? What were the findings? How have the management and the BOD followed up? How often are assessments in high-risk areas conducted?

Control Testing (p. 16)

Has the company audited its CP in the area relating to the misconduct? What testing of controls, analysis of data, and interviews have been undertaken? How are the results reported and action taken?

Evolving Updates (p. 16)

How often has the company updated its risk assessment, policies, procedures, and practice? Has a gap analysis been completed regarding policies, controls, or training? What steps have been taken to make sure the policies, procedures, and practices make sense for business segments?

Culture of Compliance (p. 16)

How often does the company measure its culture of compliance? Is input obtained from all levels of employees? What steps are taken in response to the measurement of the culture?

Investigation of Misconduct (p. 65)

Does the company have an effective means of documenting the company’s response, disciplinary action, or remediation?

Properly Scoped Investigation by Qualified Personnel (p. 16)

Have the company’s investigations been used to identify root causes, system vulnerabilities, and accountability of lapses, including among supervisory managers and senior executives?

Response to Investigations (p. 16)

Have the company’s investigations been used to identify root causes, system vulnerabilities, and accountability lapses, including senior management and executives? What has been the process?

Analysis and Remediation of Any Underlying Misconduct (p. 17)

Does the company perform a root cause analysis of misconduct and remediate the cause? Do the number and level of corporate employees involved, seriousness, duration, frequency, and any remedial action (including disciplinary action against past violators) include revisions to the corporate compliance program in light of lessons learned?

Root Cause Analysis (p. 17)

What is the company’s root cause analysis of the misconduct at issue? Were systemic issues identified? Who in the company was involved in making the analysis?

Prior Weaknesses (p. 17)

What controls failed? Were policies and procedures effectively implemented that should have prohibited the misconduct? Were functions that had ownership of the policies and procedures held accountable?

Payment Systems (p. 17)

How was the misconduct in question funded (e.g., purchase orders, employee reimbursements, discounts, petty cash)? What processes could have prevented or detected improper access to these funds? Have those processes been improved?

Vendor Management (p. 18)

If vendors were involved in the misconduct, what was the process for vendor selection, and did the vendor undergo that process?

Prior Indications (p. 18)

Were there prior opportunities to detect the misconduct in question, such as audit reports identifying relevant control failures or allegations, complaints, or investigations? What is the company’s analysis of why such opportunities were missed?

Remediation (p. 18)

What specific changes has the company made to reduce the risk that the same or similar issues will not occur in the future? What remediation has addressed the issues identified in the root cause and missed opportunity analyses?

Accountability (p. 18)

What disciplinary actions did the company take in response to the misconduct? Were they timely? Were managers held accountable? Was disciplinary action for failure to supervise imposed? What is the company’s record (number and type) of employee discipline relating to the types of conduct at issue? Has the company ever terminated or disciplined (e.g., reduced or eliminated bonuses, written warnings) for the type of misconduct at issue?