Catherine Boerner (cboerner@boernerconsultingllc.com) is President of Boerner Consulting LLC in New Berlin, WI.
The title and purpose of this column is to “Exhale,” but I don’t always write about topics to help with that. This might be the right topic. Compliance is a stressful job, especially when someone is just starting in the profession or is even new to an organization. There are so many skill sets needed, and it is important to build your team on a diverse set of strengths and weaknesses to allow collaboration and the best opportunity to be successful as a compliance department. This is, of course, assuming you are not a team of one. There are a lot of open positions right now in compliance and privacy, and many are still working remotely, which is an ongoing adjustment as well.
It is easy to get worked up or become emotional when compliance risk is discovered and has not been properly mitigated in the organization. Before getting too far into the weeds of the issue, step back and determine what facts you need to know. Think about how to prepare for bad facts even before you uncover them. What is the process and workflow? What is an acceptable timeline? Who should you include in the discussion?
In order to stay factual, it is important to have a conversation with experienced internal and/or external legal counsel so you have a strong workflow and process before applying a factual situation to the process. Compliance issues can get complicated fast, and uncertainty and anxiety can creep in early on in the investigation. Working the facts and having a clear process to guide you is the key. Stay positive—no matter what the outcome, the organization will do the right thing and fix the issue and, for example, do a six-year look back, as necessary, to understand and pay back any overpayments.
In some circumstances, do not do this alone; bringing in experienced legal counsel or a consultant to help guide the investigation may be warranted. Outside eyes can help keep the emotion out of the situation and objectively analyze the facts. The more prepared compliance professionals can be before a difficult compliance issue arises, the better the process will work. When compliance programs were starting, more than 20 years ago, I would often say, “Do not do a compliance risk assessment until you have your infrastructure in place to deal with the results.” This is still true today.