Examining Independent Compliance Program Assessments in Response to the Updated OIG and DOJ Guidance Documents
Compliance Effectiveness Evaluations, Gap Analysis, and Knowledge/Culture Surveys
Both the U.S. Department of Health and Human Services Office of Inspector General (OIG) and the U.S. Department of Justice (DOJ) updated and revised their guidelines for compliance programs on what it takes to provide convincing “evidence” of effectiveness. The OIG’s new General Compliance Program Guidance states that an effective compliance program should incorporate periodic reviews of the program to evidence and benchmark its effectiveness. These self-assessments are viewed as ongoing monitoring, something all programs should be responsible for doing. However, they are not considered independent evaluations in that they are not conducted by parties independent of the function being reviewed. The DOJ Evaluation of Corporate Compliance Programs underscore this importance and ask whether the company’s compliance program recently underwent a credible effectiveness evaluation. Organizations cannot rely on self-assessments as effective independent evidence, and these assessments may be seen as self-serving, biased, and lacking credibility. Independent evaluations by parties outside the control of the compliance office are viewed as far more credible in evidencing the status and progress of the compliance program. Since the DOJ’s involvement results in investigating the organization for violations of law, they would distrust representations made by the entity or the compliance officer that are unsupported by independent evidence. To be viewed as credible and trustworthy, results must come from evaluations by independent parties. Credibility will also depend on sources of information, the conditions under which data was collected, the reliability of measurement methods, the validity of interpretations, and the adherence to quality control procedures.
Engaging outside experts to conduct independent compliance program assessments can provide a lot of benefits, including (a) identifying and evidencing to leadership and the Board progress of the program; (b) bringing “fresh eyes” to view the operations of the program; (c) conducting work without being influenced by prior decisions or differences in viewpoints; (d) identifying ways to enhance program effectiveness; (e) flagging ways to increase the efficiency of operations with available resources; and (f) documenting any needed resources for meeting compliance obligations. Methods for obtaining independent information on the status of the compliance program include Compliance Program Evaluations, Compliance Program Gaps Analyses, and validated Compliance Knowledge and Culture Surveys.
- Compliance Program Effectiveness Evaluations are recognized by experts as the best method to evidence how well the program is functioning. It is a validation assessment that measures outcome by conducting a 360-degree evaluation that includes: (a) full document examination and review; (b) on-site review and testing of operations in action; (c) interviews of Board members, executives, selective key staff; and (d) focus group meetings with selected front-line staff. The focus is not on the process (outputs) but the results from the process (outcome). If done properly, the resulting reports will be sixty to eighty pages that include findings and observations, along with recommendations and suggestions for improvement in efficiency and effectiveness.
- Compliance Program Gap Analyses are more limited reviews and are primarily a document “checklist” review, verifying the existence of documents and processes related to program operation. It also focuses on output metrics (outputs) rather than how well the program functions (outcome). It is best used with organizations with new or incomplete programs desiring assistance in identifying elements needed to complete the development of their program. It can identify gaps for inexperienced compliance officers but lacks details on how this can be accomplished. A more limited scope of work is therefore done at about half the cost of a full compliance program evaluation. However, the reduction in costs is matched by the diminished value of the results.
- Compliance Surveys are independently developed, validated, and administered compliance knowledge and culture surveys of employees and are another process for gaining insights on program effectiveness. It is the least expensive method, yet it can produce highly credible and useful results to advance the development of the program. The use of surveys has long been advocated by regulatory bodies, including the Federal Sentencing Guidelines, OIG Compliance Program Guidance, and DOJ Guidelines. These organizations advise using surveys of employees to gauge how well the program is functioning. Surveys anchored in a large database of organizations using the same instrument can permit benchmarking an organization to the universe of users. Compliance knowledge surveys test knowledge of the compliance program structure and operations and can provide very credible empirical evidence of the advancement of program knowledge and understanding. Compliance culture surveys focus on employee beliefs, attitudes, and perceptions concerning compliance and are useful in measuring the extent to which individuals, coworkers, supervisors, and leaders demonstrate commitment to compliance. Both types of surveys should be considered as they are useful in benchmarking and measuring change in the compliance environment over a period and provide different dimensions and perspectives on a compliance program.
