Kusserow on Compliance: 35 Questions that Board Compliance Committees Should be Asking

Compliance guidance from the HHS Office of Inspector General (OIG) calls for a Board-level committee to oversee the Compliance Program (CP).  HHS Inspector General Dan Levinson has noted that the best Boards are those that are active, are questioning, and exercise (constructive) skepticism in their oversight.  He further stated that Boards have a duty to ask probing questions about the operation of the CP, including how the compliance reporting system works and what reports they can expect on the reporting of compliance issues. The problem for most Boards is to know what type of questions they should be asking.  Compliance Officers (Cos) should assist them with this problem; however, COs in turn should be prepared to provide full and complete answers to Boards.  The OIG and the American Health Lawyers Association developed specific suggested questions that Boards should be asking about the CP that the CO should be prepared to provide proper responses to them.  They jointly produced “Corporate Responsibility and Corporate Compliance: A Resource for Health Care Boards of Directors” and “Corporate Responsibility and Health Care Quality (2007): A Resource for Health Care Boards of Directors.” The following are drawn from these advisory documents:

  1. Does the CO have sufficient authority to implement the CP?
  2. What is the level of resources necessary to properly implement operate the CP?
  3. Has the CO been given the sufficient resources to carry out the mission?
  4. Have compliance-related responsibilities been delegated across all levels of management?
  5. What evidence is there that all employees are held equally accountable for compliance?
  6. How has the Code of Compliance (Code) been incorporated into corporate policies across the organization?
  7. What evidence is there that the Code is understood and accepted across the organization?
  8. Has management taken affirmative steps to publicize the importance of the Code to all of its employees?
  9. Have compliance-related policies been developed that address operational compliance risk areas?
  10. Are there policies and procedures for the CP operation, and how often are they reviewed and updated?
  11. What kind of CP document management is necessary to ensure compliance-related documents are up to date?
  12. What is the scope of compliance-related education and training?
  13. What evidence is there of the effectiveness of CP training?
  14. What measures are there to enforce training mandates and to provide remedial training as warranted?
  15. What evidence is there that employees understand what is expected of them regarding compliance?
  16. How are compliance risks identified?
  17. What is the evidence that identified compliance risks are being addressed?
  18. Is the Board being kept up to date on regulatory and industry compliance risks?
  19. How is the compliance program structured to address such risks?
  20. How are “at risk” operations assessed from a compliance perspective?
  21. Is conformance with the CP periodically evaluated?
  22. Does the CP undergo periodical independent evaluation of its effectiveness?
  23. What is the process for the evaluation of and response to suspected compliance violations?
  24. What policies address the protection of employees reporting suspected wrongdoing?
  25. What kind of training is provided to those who conduct investigations of reported violations?
  26. How do the CO, Human Resources department, and Legal Counsel coordinate in resolving compliance issues?
  27. What are the policies to ensure preservation of relevant CP documents and information?
  28. What policies address protection of “whistleblowers” and those accused of misconduct?
  29. What are the results of ongoing compliance monitoring by all program managers?
  30. How is ongoing compliance auditing being performed, and by whom?
  31. How often is sanction-screening conducted, and with what results?
  32. Are the results from sanction-screening included in a signed report by the responsible parties?
  33. Has the CP been evaluated for effectiveness by a qualified independent reviewer?
  34. What evidence is there concerning effectiveness of hotline operation and follow-up investigations?
  35. What are the metrics being used to evidence CP effectiveness?

More information regarding available tools and resources to answer all these questions is available at the Compliance Resource Center.

Richard P. Kusserow served as DHHS Inspector General for 11 years. He currently is CEO of Strategic Management Services, LLC (SM), a firm that has assisted more than 3,000 organizations and entities with compliance related matters. The SM sister company, CRC, provides a wide range of compliance tools including sanction-screening.

Connect with Richard Kusserow on Google+ or LinkedIn.

Subscribe to the Kusserow on Compliance Newsletter

Copyright © 2015 Strategic Management Services, LLC. Published with permission.