Measuring Compliance
Program Effectiveness:
A Resource Guide
ISSUE DATE: MARCH 27, 2017
HCCA-OIG Compliance Effectiveness Roundtable
Roundtable Meeting: January 17, 2017 | Washington, DC
MeasuringComplianceProgramEffectiveness–AResourceGuide
HCCA-OIGComplianceEffectivenessRoundtable
RoundtableMeeting:January17,2017
WashingtonDC
Introduction
OnJanuary17,2017,agroupofcomplianceprofessionalsandstafffromtheDepartmentofHealthandHumanServices,OfficeofInspector
General(OIG)mettodiscusswaystomeasuretheeffectivenessofcomplianceprograms.Theintentofthisexercisewastoprovidealarge
numberofideasformeasuringthevariouselementsofacomplianceprogram.Measuringcomplianceprogrameffectivenessisrecommended
byseveralauthorities,includingtheUnitedStatesSentencingCommission(see,Chapter8oftheUnitedStatesSentencingGuidelines).Thislist
willprovidemeasurementoptionstoawiderangeoforganizationswithdiversesize,operationalcomplexity,industrysectors,resources,and
complianceprograms.
DuringthemeetingonJanuary17,theparticipantsbrokeinto4groupsof10attendeestodiscuss2elementsofacomplianceprogramatatime.
Duringfoursessions,everyparticipanthadachancetosuggestideasabout“whattomeasure”and“howtomeasure”withrespecttoallseven
elementsofacomplianceprogram.Weusedthefollowingcategories,fromtheHealthCareComplianceAssociation’sCHCCandidateHandbook:
DetailedContentOutline,asaguidetoensurethatallelementsofacomplianceprogramwerecovered:
ComplianceProgramElements:
1.
Standards,Policies,andProcedures
2.
ComplianceProgramAdministration
3.
ScreeningandEvaluationofEmployees,Physicians,VendorsandotherAgents
4.
Communication,Education,andTrainingonComplianceIssues
5.
Monitoring,Auditing,andInternalReportingSystems
6.
DisciplineforNon-Compliance
7.
InvestigationsandRemedialMeasures
Wehavelistedbelowmanyindividualcomplianceprogrammetrics.Thepurposeofthislististogivehealthcareorganizationsasmanyideasas
possible,bebroadenoughtohelpanytypeoforganization,andlettheorganizationchoosewhichonesbestsuititsneeds.Thisisnota
“checklist”tobeappliedwholesaletoassessacomplianceprogram.Anorganizationmaychoosetouseonlyasmallnumberoftheseinany
givenyear.Usingthemallorevenalargenumberoftheseisimpracticalandnotrecommended.Theutilityofanysuggestedmeasurelistedin
1
thisreportwillbedependentontheorganization’sindividualneeds.Someofthesesuggestionsmightbeusedfrequentlyandothersonly
occasionally.Thefrequencyofuseofanymeasurementshouldbebasedontheorganization’sriskareas,size,resources,industrysegment,etc.
Eachorganization’scomplianceprogramandeffectivenessmeasurementprocesswillbedifferent.Somemaynotapplytotheorganization’s
environmentatallandmaynotbeused.
Anyattempttousethisasastandardoracertificationisdiscouragedbythosewhoworkedonthisproject;onesizetrulydoesnotfitall.
Element1:Standards,Policies,andProcedures
A.Conductperiodicreviewsofpolicies,procedures,andcontrols.
B.Consultwithlegalresources.
C.Verifythatappropriatecodingpoliciesandproceduresexist.
D.Verifythatappropriateoverpaymentpoliciesandproceduresexist.
E.Integratemission,vision,values,andethicalprincipleswithcodeofconduct
F.Maintaincomplianceplanandprogram.
G.Assurethatanonretribution/nonretaliationpolicyexists.
H.Maintainpoliciesandproceduresforinternalandexternalcomplianceaudits.
I.Verifymaintenanceofarecordretentionpolicy.
J.Maintainacodeofconduct.
K.Verifymaintenanceof:
1.Aconflictofinterestpolicy
2.Appropriateconfidentialitypolicies
3.Appropriateprivacypolicies
4.Policiesandprocedurestoaddressregulatoryrequirements(e.g.,theEmergencyMedicalTreatmentandLaborAct(EMTALA),ClinicalLaboratory
ImprovementAmendments(CLIA),Anti-Kickback,research,laborlaws,Starklaw).
L.Verifyappropriatepoliciesoninteractionswithotherhealthcareindustrystakeholders(e.g.,hospitals/physicians,pharma/devicerepresentatives,vendors).
M.Assurepoliciesandproceduresaddressthecomplianceroleinqualityofcareissues.
N.Verifymaintenanceofapolicyongiftsandgratuities.
O.Verifymaintenanceofstandardsofaccountability(e.g.,incentives,sanctions,disciplinarypolicies)foremployeesatalllevels.
P.MaintainaComplianceDepartmentoperationsmanual.
Q.Verifymaintenanceofpoliciesonwaiversofco-paymentsanddeductibles.
R.Assuregovernancepoliciesrelatedtocomplianceareappropriatelymaintained.
Source:CHCCandidateHandbook:DetailedContentOutline
2
Element1:Standards,Policies,andProcedures
WhattoMeasure
HowtoMeasure
Access:
Accessibility
•
•
•
•
•
1.2
ActualAccess
Audithowmanyactual"hits"onpoliciesandprocedures
1.3
Accessiblelanguageforcode,standardsandpolicies
FleschKincaidmeasuringstandard–nomorethan10thgradereadinglevel
1.1
1.4
•
Complianceprogramawarenessandcommunication
•
Reviewlinktoemployeeaccessiblewebsite/intranetthatincludestheCodeofConduct
Survey-Canyoureadilyaccessorreferencepoliciesandprocedures?(Yes/No/Don'tknow)
Survey-Howandwheredoemployeesactuallyaccesspoliciesandprocedures?
Testkeywordsearch(searchable)
Auditandinterviewstafftoshowpolicies
Surveyemployeestodeterminetheextenttowhichthecodeofconductandother
compliancecommunicationsareavailabletoemployees
Reviewtoensurethestandards,policies,andawarenessmaterialisupdatedanddistributed
withinorganization’sguidelines
1.5
Impairedordisabledaccessibility
Reviewaccessibilityoptions.Lookatmethodsandspeaktoindividuals.
1.6
Policycommunication
Communicationstrategyofpolicies
1.7
Availabilityofpolicycontent
Conductsurveysandobservation
Accountability:
1.8
Accountability
PolicyCoordinatordesignated
Ownershipandaccountabilityofpolicies
Auditprocessofhowpoliciesgetenforcedbychainofcommandwhencomplianceisnotthefinal
approver.Ismanagementtakingresponsibilityforimplementingandfollowingpolicies?
Routinepoliciesandprocedures
Confirmthatlistedownerofeachpolicyandprocedureistheactualowner.
1.9
1.10
3
Review/ApprovalProcess:
1.11
AnnualreviewandBoardapprovalofCompliance
Plan
Audit:ReviewofBoardminutes
1.12
Compliancedocumentationoperationsmanual
Complianceorotheroversightcommitteetoreviewannuallytoensureitisuptodate.
1.13
Maintenanceofpolicies
Checklastrevieworrevision
Numberofpoliciesreviewedandisthereviewtimely
Processreview/audit.Usechecklisttoensureallbasicpolicyelementsareinplace,updated
consistentlyandreviewed/approvedbyappropriateparties.
Policyapprovals
Checklistaudit.Createlistofpolicies,reviewcommitteeandboardminutestoensureall
approvalshavebeenobtained.
1.16
Policyreviewprocess
Auditprocessbywhichpoliciesandproceduresareprepared,approved,disseminated,etc.
1.17
Processforensuringfullorganizationalparticipation
inpolicyandproceduredevelopment
Reviewdocumentation/minutestoverifyinputconsideredandsolicitedforpolicyandprocedure
developmentandreview
1.18
Processforreviewandapproving
Checkforwrittenprocess
Quality:
1.19
Arepolicies(andprocedures)asgoodasindustry
practice
Peerreviews
1.20
IntegrityofProcessfordevelopingandimplementing
Auditpolicyandprocedureonpolicyandprocedures
policiesandprocedures
1.14
1.15
1.21
1.22
1.23
Languageandreadinglevelofpolicies
Arepolicieswritteninplainlanguage,appropriategradereadinglevelandwritteninapplicable
languagesfororganization?Policyreview,Wordgradelevelreviewandinterviewsofstaffto
makesuretheyunderstand.
Languagetranslation
Auditorprocessreview.Arepoliciesandthecodeofconducttranslatedintoappropriate
languagesfororganization?
Usefulness
SURVEY-Dodepartmentpoliciesandproceduresassistyouindoingyourjobeffectively?
(Yes/No/Don'tknow)
4
1.24
Needforpoliciesthatdon’texist
Interviewstafftodetermineiftheyneedthecertainpoliciestostrengtheninternalcontrols.
1.25
Policiesandprocedures
Requestreviewfromexternalexperts
Assessment:
1.26
Assessmentofallcompanypolicies
Checklistofpolicies;whicharecomplianceandwhicharebusiness
1.27
Essentialcompliancepoliciesandproceduresexist
Canstaffactuallyarticulatepoliciesandprocedures;teststaff
1.28
Existenceofproceduretosupportpolicy
Auditforproceduretosupportpolicy
Fundamentalpoliciesandproceduresinplace
Havefocusgroupsofworkunits/departmentstodeterminewhethertheyunderstandthepolicies
andproceduresnecessarytodotheirjobs.
Identifiability
•
•
1.31
Listofpoliciesareapplicabletoemployees
Supervisorstoassessdirectstaff
1.32
Arethoseaffectedbypolicygiventheopportunityto
Focusgroupsandinterviewsofthoseaffectedbypolicy.
weighinonpolicywhendeveloped?
1.33
Listofrequiredpolicies
Createchecklisttomakesureminimumpoliciesareinplaceandthenauditagainstthelist.
1.34
Effectivenessofpolicies
Effectivenessofpoliciesbasedonthesubmissionhotlinecalls
Policiesandproceduresthathavebeenidentifiedas
partofcorrectiveaction
Processreview.Conductannualmeetingwithcomplianceandlegaltolookatdatabasesand
controlandprioritizereviewtoensureimplementationandongoingcompliancewithpoliciesand
procedures.
1.36
Policiesforhighriskandoperationalareas
Audit
1.37
Policies,standardsandproceduresarebasedon
assessedrisks
Riskassessment,policyexistsforeachriskidentifiedintheriskassessment(coverageofaspecific
risktopic)
1.38
Policyinventorytoensurenooverlapand
contradictionofpolicies
Createinventoryandanalyzeinventory.Analyzeandreviewpastefforts.Lookatvarious
departmentsthatmighthaveoverlappingpolicies.
Policyreviewfollowinginvestigation/issue
Toppoliciesimplicatedinaninvestigationarereviewedtodetermineifpolicyambiguous,
complex,failstoadequatelysafeguardissues.Validatethroughaudit.
1.29
1.30
1.35
1.39
Indexofpoliciesavailableandcurrent
Numberedpolicies,notjusttitles
5
1.40
Routinepoliciesandproceduresareaddressedand
filterdown.
Reviewdepartmentandcommitteeagendastoensurepoliciesareaddressed
CodeofConduct:
CodeofConduct
Audit:Reviewdates,boardapprovals,distributionprocesses,attestations,surveyemployeesfor
understanding,conductfocusgroups.
Complianceprogramawarenessandcommunication
SurveyemployeestodeterminetheextenttowhichtheyknowthecontentoftheStandardsof
Conduct(SOC)andhowtoaccessit.
Integratemission,vision,values,andethical
principleswithcodeofconduct
Comparecodewithmissionandvisionstatementstoseeifitincludeselements/statements.Check
toseeifcodeisaccessibletoemployees
Maintenanceofcodeofconduct
Iscodewritten,postedforemployees,documentedfrequencyofreviews,andsurvey/test
employeesonabilitytolocateit
Distribution
DocumentationofCodeofConductdistributiontrackingandresultsoverpasttwoyearsforall
employees,employedphysicians,alliedhealthprofessionals,independent(contracted)physicians,
volunteersandvendors/contractor/consultantsintheorganization
Orientation
AudittoensureallemployeesreceiveorientationtotheSOCandcompliancepolicieswithin30
daysofhire.
1.47
Staffunderstandingofcodeofconductandpolicies
andprocedures
•
•
Updates:
Complianceprogramcommunicationofrulechanges
Reviewperiodicallyandatrulechanges–Audittoensurethereisadequatecommunicationto
employees,includingchangesinpolicy/procedure.
Newandupdatedpolicydistributionandeducation
ofappropriatestaff
Processreview-Doesorganizationhaveformalprocesstomakeworkforceawareofnewpolicies
orchangesinpolicies?
Practicesimplementedafternewpolicy
Auditpracticesandreviewcommitteeminutesandotherdocumentationtodeterminehownew
policiesareimplemented.
Understanding:
1.51
UnderstandingofPolicies/Procedures
•
1.41
1.42
1.43
1.44
1.45
1.46
1.48
1.49
1.50
Reviewtestscoresaftertraining.
Conductinterviews.
Conductsurveysand/orfocusgroupsonspecificpolicies
6
•
1.52
Auditadherencetopolicy/procedure
Orientation
Ensureemployeesareprovidedinstructionbyknowledgeablepersonnelforquestions/clarity
Policiesreflectpractice
Usepoliciesasaudittoolandtheninterview,observeandconductdocumentreviewtoensure
policiesarebeingfollowed.
Questionsaskedbyemployees
Systeminplacetotrackemployeequestionsandconcernstoensureconsistentguidance.Track
departmentswherequestionscomefromtodeployadditionaleducationwherenecessary.
Understandabletoboardandc-suite
Testboardandc-suiteonlocationandunderstanding
Understandabletoemployees
•
•
•
CompliancePlan:
1.57
Maintaincomplianceplanandprogram
Reviewwrittenplanorwrittenscheduleofcomplianceactivities
Maintaincompliancedepartmentoperationsmanual
•
•
1.53
1.54
1.55
1.56
1.58
Readingcomprehensiontest
Situationaltests
Testoflocation
Auditexistenceofwrittenmanual,handbook,orreferenceguide
Testwhetherthemanualiscurrent
ConfidentialityStatements:
1.59
Verifymaintenanceofappropriateconfidentiality
policies
•
•
Enforcement:
1.60
Compliancewithpolicies
Conductinterviews,observation.
1.61
Policyviolations
Auditpolicyandprocedurestomakesurepracticeconsistentwithpolicy.
1.62
Adherencetopoliciesandproceduresforcases
involvingpatientharmandreportingtoregulatory
agency
Reviewpoliciesandproceduresandcasesinvolvingpatientharmandvalidateproperreportingto
regulatoryagency
Auditprocedureforobtainingconfidentialitystatementsfromemployees
Auditemployeefilesforsignedconfidentialitystatementsfromemployees
7
Element2:ComplianceProgramAdministration
A.Maintainacompliancebudget(e.g.,contributetoplanning,preparing,andmonitoringfinancialresources).
B.Reportcomplianceprogramactivitytothegovernanceboard/committee.
C.Coordinateoperationalaspectsofacomplianceprogramwiththeoversightcommittee.
D.Collaboratewithotherstoinstitutebestcomplianceprogram.
E.Coordinateorganizationaleffortstomaintainacomplianceprogram.
F.Definescopeofcomplianceprogramconsistentwithcurrentindustrystandards.
G.Assurethatthecomplianceoversightcommittee’sgoalsandfunctionsareoutlined.
H.Evaluatetheeffectivenessofthecomplianceprogramonaperiodicbasis.
I.Maintainknowledgeofcurrentregulatorychangesandinterpretationoflaws.
J.Assurethecredibilityandintegrityofthecomplianceprogram.
K.Recognizetheneedforoutsideexpertise.
L.Overseeacomplianceeducationprogram.
M.Verifytheorganizationhasdefinedtheauthorityofthecomplianceofficeratahighlevel.
N.Verifythegoverningboardunderstandsitsresponsibilityasitrelatestothecomplianceprogramandculture.
O.Assurethattheroleofcounselinthecomplianceprocesshasbeendefined.
P.Definetheresponsibilities,purpose,andfunctionforallcompliancestaff.
Q.Assurestaffingforthecomplianceprogram.
R.Verifycomplianceriskassessmentsareconductedperiodically.
S.Participateinthedevelopmentofinternalcontrolsandsystemstomitigaterisk.
T.Incorporaterelevantaspectsofregulatoryagencies’focusintocomplianceoperations.
U.Overseeintegrationofthecomplianceprogramintooperations.
V.Developanannualcomplianceworkplan.
W.Demonstrateindependenceandobjectivityinallaspectsofcomplianceprogram.
X.Maintainanindependentreportingstructuretothegoverningbody(e.g.,Board,PhysicianPracticeExecutiveCommittee).
Source:CHCCandidateHandbook:DetailedContentOutline
8
Element2:ComplianceProgramAdministration
WhattoMeasure
HowtoMeasure
BoardofDirectors:
2.1
•
ActiveBoardofDirectors
•
2.2
2.3
•
Reviewoftrainingandresponsibilitiesasreflectedinmeetingminutesandotherdocuments
(trainingmaterials,newsletters,etc.).Dominutesreflectboard’sunderstanding?
Review/auditboardeducation–howoftenisitconducted?Conductinterviewstoassess
boardunderstanding.
Boardunderstandingandoversightoftheir
responsibilities
•
Appropriateescalationtooversightbody
•
Reviewminutes/checklistincomplianceofficerfiles
•
•
Reviewcomplianceprogramresources(budget,staff).
Reviewdocumentationtoensurestaff,boardandmanagementareactivelyinvolvedinthe
program.
Conductinterviewsofboard,managementandstaff.
2.4
Commitmentfromtop
•
2.5
ReviewminutesofmeetingswhereComplianceOfficerreportsin-persontotheAuditand
ComplianceCommitteeoftheBoardofDirectorsonaquarterlybasis
Conductinventoryofreportsgiventoboardandapplicablecommittees.
Processforescalationandaccountability
Processreview(documentreview,interviews,etc.).Istheretimelyreportingandresolutionof
matters?
ComplianceBudget:
2.6
Appropriateoversightofbudget
Reviewcharterofgoverningbody(Board)toverifyitincludesapprovalofcompliancebudget
2.7
Budgetisbasedonanassessmentofriskand
programimprovement/effectiveness
IstheBoard’sapprovalofthebudgetbasedonidentifiedrisksandeffectiveness
evaluation/programimprovement?
2.8
Sufficientcomplianceprogramresources(budget,
staffing)
Reviewbudgetandstaffingtoensuresignificantrisksaremanagedappropriately
ComplianceCommittees:
9
2.9
Activeinvolvementofcompliancecommittee
members
Trackpercentageofattendanceofeachcompliancecommitteememberoverthelastyear
2.10
Assurethatthecomplianceoversightcommittee
goalsandfunctionsareoutlined
Reviewcharterofcommittee
Committeestructure
Reviewdocumentationofstructureofcommitteesaswellascharters.Ensurenoconflicting
charters.
2.11
2.12
Compliancecommitteecompositionandattendance Reviewcharterandminutestoassureattendance.
2.13
Cascadeadministrationofcomplianceprogram
throughouttheorganization
Differentoperationalareasgivesomecertification/disclosuretothecomplianceoffice
2.14
CompositionofComplianceCommittee
Revieworganizationalcharttovalidatecorrectcomposition
Effectivenessofcompliancecommitteemeetings
Keepexecutivereportcardbymemberqualitative/quantitativewithindicatorsofcontributionon
topics
Engagement
Inthelasttwoyears,havethecompliancecommitteemeetingsbeenheldinaccordancewiththe
charter?
EngagementofDirectors/Managers
Reviewcommitteestructuretoevaluatehowdirectors/managersareparticipatinginCompliance
OperationalCommittee(s)meetingincludesagenda,minutes,attendanceandreportsfrom
subcommittees
ExecutiveLeadershipengagedinCompliance
Program
Reviewfrequencyofmeetings,membership,attendance,agendaandminutesoverthepastyear
oftheComplianceExecutiveCommitteetoincludeallmembersoftheSeniorExecutiveteam
receivinginformationdirectlyfromtheComplianceOfficer
Accountability:
Leadershipaccountability
Auditdocumentationandconductinterviews.Someexamplesmightinclude:
• Employeeeducationcompletionrates
• Demonstrationofpromotionofcompliance(e.g.,townhallmeetingpresentations,
newsletters,etc.)
• Completionofauditorreviewactionitemswithinestablishedtimeframe
Managementaccountabilityforcompliance
Processanddocumentreviewandinterviews.
• Isthereamappingofoperationalormanagementresponsibleforchampioningcompliance?
2.15
2.16
2.17
2.18
2.19
2.20
10
•
2.21
•
Isthereamappingofmanagementresponsibleforkeyareasofcompliancetoensure
accountability?
Doestopmanagementsupportthecomplianceteam?
•
•
Certification(CHC,CHPC,CHRC)
Annualevaluation,coaching,correctiveaction,professionaldevelopment
•
Reviewparticipationofcomplianceofficerinstrategicplanningprocessandduediligence
processes.
•
•
Processreview,includingreviewoforganizationalcharttoensurecompliancecaptures
enterprise-wideentities.
Interviewswithcomplianceandothercommittees.
Complianceindependence/compliancestructure
•
•
Doesthereportingstructurereflectsthe"express"authorityrequired?
Auditprogramcharters(complianceprogramorAuditcommittee)
Complianceintegration
Audittodeterminetheextenttowhichcomplianceofficerisinvolvedintraining,policy
development,marketingandotheroperationalaspectsofthebusiness
ComplianceOfficer:
Competency
2.22
Isthecomplianceofficerakeystakeholderinthe
strategicinitiativesoftheorganization
2.23
Compliancedepartmentinvolvementinenterprisewideinitiatives/entities/strategies(e.g.,involvement
orpenetrationinjointventureinitiativesandother
organizationalinventory)
2.24
2.25
2.26
ComplianceOfficerreportingstructureandoversight
toensuredirectaccesstoCsuiteandboard
•
•
•
2.27
•
•
Complianceofficer’sindependence/objectivity
•
•
•
•
•
Documentreview-Lookatorganizationalchartandconductinterviews.
ReviewboardminutesanddocumentationthatthereareregularmeetingswithCEOandor
appropriateparties.
Ensurecomplianceofficerhasauthorityandiscomfortabletogotoboard.
Reviewcomplianceofficer’sjobdescription.Doess/hereportdirectlytoCEO,board(notCFO
orLegal)?Conductinterviews,focusedgroups,audit.
Seatinglocationofcompliancewiththebusiness,seniorteamsaretogether,anddottedline
onorgchart
Interviewcomplianceofficertoseeiftheyfeeltheyhaveindependence,dotheydocument
disagreements,isthereexecutivesessionforauditcommittee.
Interviewtheboard,reviewminutes,andinterviewtheCCO
Reviewofwrittenorganizationalstructure
VerifytheComplianceOfficerhastheindependentauthoritytoretainoutsidelegalcounsel
ReviewifthereisscreeningofcomplianceofficermaterialtotheBoardofDirectors
11
•
2.28
Credibilityofcomplianceofficer
RegularexecutivesessionoftheComplianceOfficerwiththeAuditandCompliance
CommitteeoftheBoard
JobDescriptionreview,ongoingtrainingofcomplianceofficer,basiccompetencies,certifications,
reportingstructure
2.29
•
•
•
Haveneededchangesbeenmade,andifnot,whynot?
Whatauthoritydoesthecomplianceofficerhaveandhowdoesheorsheexerciseit?
Whereisthecomplianceteamwithregardstoidentifyingworkinggroupstohelpattacka
newcompliancerisk?
Howsupportedthecomplianceofficerfeels
•
•
Interviewcomplianceofficer;
Documentationreview.
Organizationalperceptionofcomplianceofficerand
corporatecomplianceprogram
Surveyemployeesregarding:
• Theirperceptionofthecomplianceofficerrole.
• Whethertheyknowwhothecomplianceteamis,howtogettothemand,whattotellthem.
• Isthecompliancestaffapproachable?
• Arethecompliancestaffsolutionfacilitatorsorlookedatastheorganizationalpoliceforce?
2.32
Complianceproblemsolvingandadequacyof
process
Processreview
Staffing:
Howmuchauthoritydoesthecomplianceofficer
havetostartaworkinggrouptolookatchanges?
2.30
2.31
2.33
Adequacyofstaffingandresources
•
•
•
•
•
•
•
•
2.34
Assuranceofstaffing
Reviewqualificationsofstaff;ratioofcompliancestafftobusiness,compensationtothebusiness
2.35
Adequacyofcompliancestaffbasedonrisk
assessment
Riskassessmentconsidersthenumberandcompetencyofstaffrequiredtoaddressrisk
FTEsassignedtocompliancefunction
Reviewcompliancemattersandiftheyhavebeenaddressedtimely.
Reviewandensurepoliciesandproceduresareimplementedandbeingfollowed.
Reviewdocumentationofreportstocommittee(s)andboard.
Assessstatusofworkplanandanydelays.
Ensuredocumentationofriskassessment.
Reviewdocumentationregardingdiscussionsatboardlevelregardingbudget.
Reviewbenchmarkingdatafromsimilarentities.
12
CompliancePlan:
2.36
Complianceplanassessments
•
•
•
•
•
Complianceplanprocess
Auditprocessfordevelopmentoftheannualcomplianceplan.
Complianceorganization
Assessthepositioningandeffectivenessofthecomplianceorganizationstaff,titles,organizational
chart,pay,promotionrecordscomparedtootherareaswithintheorganization
2.39
Documentthatestablishestheauthorityofthe
program
Documentreview,meetingminutesforapproval.
2.40
Perceptionofcomplianceprogram
Surveyemployees
Culture:
Accountability
SURVEY-Doesthecompliancedepartmenthaveanimpactonhowyoudoyourjob?
(Yes/No/Don'tknow)
AccuracyandTrustinMonitoring
SURVEY:Doyoubelievetheinformationfromyourdepartmentisreportedwithahighdegreeof
integrityandaccuracy?(Yes/No/Don’tknow)
Culture
Conductculturalsurvey(interviews,confidentialsurveys,focusgroups,etc.)andreportfindingsto
compliancecommitteeandboard.Reviewminutestoensurereportoutandactionplan
established.
2.44
Effectivenessofcomplianceprograminthefield
Surveyoffieldcompliancepeople
2.45
Surveys.
• Whatdoescompanyincentivize?
Whatiscompanydoingtodrivecomplianceculture?
• Whatdoesthecompanypromoteandlookdownon?
• Iscomplianceprogramtiedtomission,vision,values?
2.37
2.38
2.41
2.42
2.43
2.46
Employeecommentsfrom“Rounding”
Documentreview,includingcomplianceplanandpolicies.
Isthereanexternalreviewconductedperiodically?
Whatistheroleofinternalauditwithregardingtocompliance?
Howdoesinternalauditinteractwithcompliance?
Benchmarkprogramwithsimilarsizeswithinthesameindustry
Auditthetrackingofwhatemployeesreportwhenproactivelyaskedbycompliancedepartment
(orleadership,etc.)andhowthisinformationismanagedandreported.
13
2.47
Measuringeffectivenessofexecutivecommunication
Trackon-lineengagement(clicks)andsurveyaudience
oncompliance
Incentives:
2.48
Aligningperformancemanagementsystem
(promotionsystem)withethicsandcompliance
objectives
Auditcriteriaofpromotion,bonusesandassignments
2.49
ComplianceandEthicsRole/participationfor
developingtheincentivesystem
Haveanoutsideindependentexpertaudittheincentivesystemandcomplianceofficer's
participation
2.50
Isincentivesystemconsistentwithcompliance
program
EmployeeSurvey
PerformanceEvaluations:
2.51
Properalignmentofcomplianceobjectiveswith
organizationalperformanceincentives
(promotions/performanceappraisals/bonuses)
2.52
• Auditdisciplinaryrecordsandperformanceevaluationsforconsistencywithcompliance
• Audit/Reviewofprocessforperformanceincentives(promotions/performance
appraisals/bonuses)criteriatoincludecompliancecomponents
•
“Compliance”asaperformanceappraisalelement
•
•
•
2.53
2.54
2.55
Auditperformanceappraisals.Someoptionsinclude:
o Acknowledgmentofnodisciplinaryaction
o Educationcompletion
o Documentationofpromotionofcompliance
Aremeritincreasestiedtoperformance?
Doescompletionofcomplianceeducation,promotionofcompliancethroughwords,actions
ornodocumenteddisciplinaryactionand/or,completionofcorrectiveactionplanswithinthe
duedatesplayaroleintothecalculationofmeritincrease?
ComplianceispartoftheannualperformanceevaluationandHRknowshowtoevaluate
issuesforcompliance
Managerperformanceevaluations
Managershaveopendoorpolicy,communicatecompliancedirectives/initiatives,address
compliancemattersandeffectivenessisnotedinperformanceevaluation.
Iscompliancetakenintoaccountinpromotion
decisions?
Reviewpromotionlistsanddocumentationtosupportpromotion.Didtheindividualactively
promotecompliance?
OrganizationalRetaliation
Trackwhistleblowerpromotion,bonuses,sickdays,disciplinary,correctiveactionmeasuresand
exitinterviewoverlongterm
14
2.56
2.57
RiskAssessments:
ComplianceResourceknowledgeandcompetence
Survey,focusgroupsandinterviews
Compliancestaffknowledgeofcurrentregulatory
changesandlaws
Documentreviewandinterviews.Reviewcertificatesofattendanceatconferences/other
educationalevents,“tools”usedtokeepcompliancestaffcurrent,compliancebudget(tosupport
accesstocurrentregulatorychangesandlaws).
Monitoringofregulationsthatimpactthe
organization
Documentandprocessreview,interviews.
• Isthereapolicyandprocedure?
• Isthereevidencethatregulations,etc.aredisseminatedandimplemented?
• Aretheredesignatedindividual(s)thatmonitorlaws,regulations,policiesthatimpact
organization?
• Howdotheygettheinformationandwhatdotheydowithittomakesureitgetstotheright
people?
2.58
2.59
2.60
•
•
RiskAssessmentCycle
Auditadherencetoriskassessmentcycle
Annualdocumentedriskassessmenthasbeencommunicatedtooversightcommittee
Riskbasedworkplanthatcoverscomplianceplan
elementswithboardapprovalandregularreporting
onthoseprojectstoboard
ComplianceCommitteeandboardminutesreview.
2.61
Workplandevelopmentbasedonriskassessment
Processanddocumentreview.
2.62
Prioritizationofriskandconsultationwithapplicable
riskpartners(i.e.,legal,HR,IT,riskmanagement,
Documentationandprocessreview.Isthereariskbasedplan?Howwasitdeveloped?
etc.)
2.63
Exitinterview
Complianceconcernsthatcomeupinexitinterviewsareaddressed
ComplianceWorkPlan:
2.64
Complianceworkplan
Audittoensuretheworkplanisdevelopedandimplementedanditisfollowed-throughand
outcomesarereportedtocompliancecommitteeortogoverningbody
15
2.65
Effectivenessofcomplianceprogram
Writtenannualworkplanthatincludesminutes
LegalCounsel'sRole:
2.66
Roleofcounselincomplianceprocess
Interviewcounselregardingtheirinvolvement.
• Whentheyarebroughtintomatters?
• Whereiscounselsituatedinrelationtocomplianceofficeronorganizationalchart?
2.67
Existenceandadherencetopolicyoninvolvementof
Reviewpolicyandsampleareasthatwerereferredtolegalfollowedthepolicy
legalinhandlingmattersunderprivilege
Other:
2.68
Jobdescriptionsofmanagement
Reviewofmanagementjobdescriptions.Domanagershaveconcretecompliancedeliverables
otherthantrainingandabidingbyCodeofConduct?
Element3:ScreeningandEvaluationofEmployees,Physicians,VendorsandotherAgents
A.Assureorganizationhasprocessesinplacetoidentifyanddiscloseconflictsofinterest.
B.Assureinclusionofcomplianceobligationsinalljobdescriptions.
C.Assureinclusionofcomplianceaccountabilitiesasanelementofperformanceevaluation.
D.Verifybackground/sanctionchecksareconductedinaccordancewithapplicablerulesandlaws(e.g.,employment,promotions,credentialing).
E.Assurecompliance-sensitiveexitinterviewsoccur.
F.Monitorgovernmentsanctionlistsforexcludedindividuals/entities(e.g.,OIG,GSA,SDN,SDGT).
G.Verifyduediligenceisconductedonthirdparties(e.g.,consultants,vendors,acquisitions).
H.Assurecorrectiveactionistakenbasedonbackground/sanctioncheckfindings.
Source:CHCCandidateHandbook:DetailedContentOutline
16
Element3:ScreeningandEvaluationofEmployees,Physicians,VendorsandotherAgents
WhattoMeasure
HowtoMeasure
Accountabilityforscreening:
3.1
Theindividual(s)responsibleforexclusionscreening
hasclearaccountabilityforthescreeningfunction.
•
•
Auditthejobdescription,trainingmaterial,orientationmaterial,andannualperformance
evaluationoftheindividual(s)responsibleforexclusionscreeningtoensurethisresponsibility
isclearlyarticulatedandperformanceismeasured.
Annuallyreview/discusstheexclusionscreeningprocessindividuallywitheachperson
responsibleforsanctioncheckscreening;reviewthedocumentretentionprocessestoensure
documentationofthescreeningfunction,responsetofindings,andcorrectiveactionsare
adequatelymaintained.
ConflictofInterest:
3.2
Potentialconflictsofinterestaredisclosed.
Audittheconflictofinterestdisclosuresforcompletenessandtheextenttowhichthosewho
completethedisclosureinformation.
3.3
Theorganizationconductseffectiveeducationon
ConflictofInterest(COI)
•
•
Employeeaccountability:
3.4
Theextenttowhichemployeesaremadeawareof
complianceexpectations.
Conductfocusedinterviewswithemployeesandaudittheperformancereviewprocesstoensure
complianceexpectationsarewellunderstoodandemployeesareheldaccountableforthese
expectations.
3.5
3.6
Reviewtrainingmaterialsandinterviewstafftodeterminetheeffectivenessoftheeducation.
Auditcompletedattestationsordisclosurestoensueindividualsaredisclosingconflicts
accordingtoeducationprovided.
Accountabilityforcomplianceisclearlyarticulatedin Auditperformanceevaluationstoensurecomplianceobligationsareclearlyarticulatedand
employeeperformanceevaluations.
performanceagainsttheserequirementsismeasured.
Accountabilityforcomplianceisclearlyarticulatedin Auditjobdescriptionstoensurecomplianceobligationsareclearlyarticulated.
employeejobdescriptions.
17
3.7
3.8
3.9
3.10
3.11
3.12
3.13
Employeesareprovidededucationregardingtheir
complianceobligationsandtheyunderstandthese
requirements.
•
Employeedisclosure:
Theorganizationhasestablishedapolicythat
requiresprospectiveandcurrentemployees,and
prospectiveandcurrentvendorstodisclosetothe
organizationiftheyareormaybeexcluded.
•
Auditandconductadocumentreviewtoensuredisclosurerequirementsareclearly
articulatedinthepolicyanddisclosuresarebeingmadeasrequired.
•
Conductapolicyreviewtoensurethatthatimmediatereportingisarequirementfor
employeesandaprovisioninvendoragreements.
Employeescreening:
Allemployeesarescreenedpriortohire.
Audithumanresourcefilestoensuredocumentationsupportsthatnewlyhiredemployeeswere
screenedpriortotheirfirstdayworked.
Screeningconsidersothernames/aliasandStates
usedbyaprospectiveemployee.
Reviewapplicationsforeachtypeofscreening(criminal,OIG,SAM,State,SSN,etc.)andauditto
determineifscreeningwascompletedagainstothernames/statesusedbytheprospective
employee.
Theorganizationhasdefinedwhichemployees,
vendors,medicalstaff,andotherswillundergo
criminal,financialand/orotherbackgroundchecks
priortohire.
•
Theorganizationhasdefinedcriteriaforreviewof
criminal,financial,and/orotherbackgroundchecks
andhiringdecisionaremadebasedonthis
establishedcriteria.
Performassessment/audittoensuretheorganizationhasestablishedcriteriatoevaluatethe
acceptabilityofacandidatebasedonfindingsofcriminal,financial,orotherbackgroundcheck(s)
usedbytheorganization.
Employeesareprovidededucationregardingthe
organization’sscreeningprocess.
Interviewemployeesandconductdocumentationreviewstoconfirmthatemployeesunderstand
theimportanceofnotlettinglicensesexpireandtheeffectofexclusion.
•
•
•
Auditemployeeeducationfilestoensureeducationisbeingprovidedaccordingtothe
organizationstrainingplansand/orpoliciesandprocedures.
Reviewpost-teststoconfirmunderstanding.
Interviewemployeestoconfirmtheirunderstandingoftheircomplianceobligationsand
responsibilities.
Performassessment/audittoensuretheorganizationhadidentifiedwhichindividualsreceive
criminal,financial,SocialSecuritytrace,drugscreening,orotherbackgroundchecks.
Audittoensuresuchbackgroundchecksarebeingperformedandreviewedpriorto
employment.
18
3.14
3.15
3.16
3.17
3.18
3.19
Theorganizationensuresthatapplicantsfor
employmentunderstanddisclosurerequirements.
Reviewemploymentapplicationstoensuredisclosureismadetoprospectiveemployees,including
exclusionandbackgroundscreeningrequirements,andthesescreeningsarecompleted.
Theorganizationhasestablishedapolicyregarding
thefrequencyofscreening.
•
Performadocumentreviewtoensurethefrequencyofscreeningisbeingdoneinaccordance
withpolicy.
•
Auditthescreeningprocesstoensurescreeningisbeingcompletedaccordingtopolicy.
•
Audit,performdocumentreview,interviewsstaffandvendors,andconductdataminingto
determineifsufficientcontrolsareinplacetopreventtheorganizationfromhiringan
“ineligible”individualorentity.
•
Usedata-miningtocomparelistsofnewemployeeswithduediligencelists.
•
Ensurethevendormasterfileisupdatedwithvendorsthathavebeenscreened.
Theorganizationhasestablishedsufficientcontrols
inthehiringprocessandvendorengagement
processtopreventtheorganizationfromhiringan
ineligibleindividualorentity.
Theorganizationhasestablishedascreening
programthatisconsistentwithalllawsand
regulations.
Conductalegalreviewandanalysisofscreeningprocesstoensureitisbeingadministeredina
mannerconsistentwithfederalandstatelaws.
Theorganizationhasestablishedaprocesstoscreen
employeesandotherrelevantindividualsatleast
monthly.
Auditscreeningprocesstoensurescreeningofemployeesandotherrelevantindividualsisbeing
conductedatleastmonthlyandaccordingtopolicy.
Theorganizationhasestablishedapolicyand
•
procedurewhichdefinesthescreeningrequirements
foremployees,vendors,medicalstaffandothers.
•
Thepoliciesincludedescriptionofthedatabasesthat
individualswillbescreenedagainstandthe
•
frequencyofscreening.
3.20
Theorganizationhasaprocesstodeterminewhen
additionalscreeningmaybenecessarybasedon
findingsfromcomplianceinvestigations.(Relevant
event(situational)screening(R.E.S.))
Conductadocumentreviewtoverifythepolicyandprocedurehasbeenestablished,is
complete,andaudittoensurescreeningisbeingconductedconsistentwithpolicy.
Performassessment/audittoensureorganizationhasidentifiedwhichliststocheckandhow
ofteneachischeckedandthescreeningsarebeingcheckedperpolicy.
Performassessment/audittoensureallrelevanttypesofindividualsandentities(employees,
temps,vendors,etc.)arebeingscreenedperpolicy.
Conductareviewofcomplianceinvestigationfilestodetermineifconsiderationforadditional
screeningiswarrantedandreviewtheresultsofadditionalscreeningcompletedaspartofthe
investigationprocess(situational)whenapplicable
19
3.21
3.22
3.23
3.24
3.25
3.26
Theorganizationhasapolicyandprocedurewhich
Conductdocumentationreviewandaudittoensurescreeningisbeingcompletedaccordingto
articulatestheprocessforscreening,investigationof policyrequirementsandthatallprocesselementsrelatedtoinvestigation,resolution,tracking,
potential“hits,”actionstakeninresponsetoa
andcommunicationarebeingmanagedaccordingtopolicyrequirements.
positivefinding,trackingexclusions,and
communicationtoappropriatestakeholders.
ExitInterviews:
Employeeawarenessoforganization’scompliance
program.
Revieworganization’semployeeterminationprocesssuchasexitinterviews,surveys,and/or
questionnairestotestforemployeeawarenessoftheorganization’scomplianceprogram.
Employeeexitinterviewsareconductedand
•
employeesareaskedaboutthecomplianceprogram
andanyconcerns,risks,violationsorfailuresofthe
complianceprogram.
•
rd
Revieworganization’semployeeterminationprocesssuchasexitinterviews,surveys,and/or
questionnairestoensurecomplianceprogramquestionsareincorporatedintoexitinterviews
andtheexitinterviewsarereviewedandevaluated.
Audittoensureallterminated/separatingemployeeshavecompletedanexitinterviewand
thatcompliancequestionsareincludedandevaluated.
Vendorsandother3 partiesareinterviewedatthe
terminationoftheengagementandaskedabout
theirawarenessofthecomplianceprogramandany
concerns,risks,violations,orfailuresofthe
complianceprogram.
Revieworganization’svendortermination/off-boardingprocesssuchasinterviews,surveys,
and/orquestionnairestoensurecomplianceprogramquestionsareincorporatedintotheprocess
andinterviews/resultsarereviewedandevaluated.
Theorganizationhasestablishedapolicyand
procedureforconductingexitinterviewsfor
employeesleavingtheorganization.Theexit
interviewprocessincludesquestionsrelatedto
complianceobligationsandanyknownviolationsof
law,policies,orprocedures.
Reviewpolicyandproceduretoensuretheorganizationhasanestablishedprocess.Auditexit
interviewfilestoensureinterviewsarebeingconductedaccordingtopolicy.Reviewtoensure
thatanyidentifiedviolationsoflaw,policyorprocedurearethoroughlyinvestigated.
HighRiskScreening:
Theorganizationhasestablishedapolicyidentifying
highriskpositionsintheorganizationthatmay
requireadditionalscreening.
Conductpolicyreviewtoensurehighriskpositions(e.g.,cliniciansworkingwithchildrenor
mentalhealth,cashhandlers)areidentifiedinpolicy,andthepolicyincludesadescriptionofany
20
additionalscreeningrequirements(fingerprinting,financialbackgroundchecks,etc.).Review
employmentandvendorfilestoensuretheadditionalscreeningisoccurringaccordingtopolicy.
3.27
3.28
3.29
3.30
3.31
3.32
3.33
Licensure:
Theorganizationhasaprocesstoensurethat
individualswhotransferpositionswithinthe
organizationareappropriatelylicensedand
credentialedforthejobtheywillbeperforming.
Auditandconductadocumentreview,audittoensureaprocessforexaminationoflicensesand
credentialsisestablishedforemployeestransferringpositionswithintheorganization.Auditto
confirmprocessisbeingfollowedandindividualstransferredhaveappropriatelicenseand
credentialsforthepositiontheyareassuming.
Theorganizationhasestablishedapolicyand
Performdocumentreviewandaudittoensureapolicyforverificationandreviewoflicenseand
procedureforlicensureandcertificationreviews,
certification,includingsourceverification,existsandlicensesandcertificationsareconsistently
includingreviewuponhire,upontransfer,andduring reviewedaccordingtopolicy.
renewalperiods.
ResponsetoExclusion:
Appropriateactionistakeninresponsetopotential
andidentifiedexclusion
Audittoensurerefundsareinitiatedifrequiredandemployment,contract,ormedicalstaffaction
istakenupondiscovery(includingvendors).
ResponsetoScreening:
Theorganizationtakesactionontheresultsof
screening.
Performadocumentreviewtoensurescreeningresultsarebeingevaluatedandappropriate
actionistakenwherenecessary.
Theorganizationhasestablishedaprocessfor
investigationandresolutionofpositive"hits."
Auditprocesstoensure“hits”areinvestigatedandthatfalsepositivesareresolvedwhenthereis
confirmationthattheindividualdoesnotmatchtheexcludedindividual.
Theorganizationhasapolicyandprocedureinplace Conductdocumentandprocessreviewandauditrecentidentifiedsanctionstoensurethe
thatarticulateshowpotentialsanctionswillbe
evaluationandresolutionisconsistentwithpolicy.
evaluatedandresolved.
Vendor:
Vendorsandother3rdpartiesadequatelysatisfy
complianceobligations
Conductauditofvendorsandother3rdpartiestoensuretheyhavedocumentedevidenceof
requiredcompliancetraining,orientationtotheorganizationsStandardsofConduct,orientation
toapplicablecompliancepoliciesandprocedures.
21
3.34
3.35
3.36
3.37
3.38
3.39
Theorganizationhasestablishedaprocesstoensure Conductadocumentreviewandinterviewstoensurethereiscommunicationbetweenlawyers
vendorandotherthirdpartyagreementsare
whodeveloptheagreementsandfacilitylevelpersonnelmanagingtheengagementtomakesure
managedconsistentwiththetermsofthe
itisimplementedandbeingmanagedaccordingtothetermsoftheagreement.
agreement.
Theorganizationrequiresvendorsandotherthird
partiestocertifyscreeninghasbeencompletedas
requiredbytheagreement.
Audittodeterminethatvendorsrespondtorequestforcertification.Reviewprocessto
determinethatactionstakenforfailuretorespondorproviderequiredcertificationsare
consistentwiththeagreement.Ensurethatresponsetocertificationisreviewedbyan
appropriateindividualandcommunicatedtofacilityoperations.Audittoensurethatrenewal
decisionsconsidercompliancewithcertificationrequirements.
Theorganizationhasestablishedapolicyoutlining
Conductdocumentreviewandperformauditstoensurevendorsmeetthecomplianceobligations
thecomplianceobligationsofvendorsandother
required.
thirdparties(includingadherencetotheStandards
ofConduct).Vendoragreementsincludetherightto
auditthevendortoensurecompliancewiththeir
obligations.
Theorganizationhasestablishedapolicyprohibiting Auditexclusionstoensurepolicyisbeingadheredto.
vendorsthatareexcludedfromworkinginthe
organization.
VendorScreening:
rd
Vendorsandother3 partiesareadequately
screenedforexclusion.
Theorganizationhasaneffectiveprocesstoreview
thirdpartyvendors.
•
Auditvendorrecordsandcrosschecktoensurethevendorisadequatelyscreened,in
accordancewithagreementand/orentityrequirements.
•
Developchecklistofcriteriaforvendorcompliancereviewandauditagainstthatlistfor
vendorscreeningrequirements.
•
Surveypeerorganizationstoensuretheorganization’svendorand3 partyscreeningprocess
isconsistentwithindustrypractice.
rd
Auditandconductadocumentreviewtoensure:
•
Thirdpartycontractsallowfororganizationtoreviewvendorfilesforcompliancewith
screeningrequirements.
22
3.40
Theorganizationhasrequirements,viapolicyor
contractualterms,forscreeningoffirst-tier,
downstreamandrelatedentities(contractors)
•
Theorganizationhasrequestedthethirdparty’spolicyandprocedurerelatedtovendor
screeningofemployees.
•
Theorganizationconductsreviewsofthirdpartycontracts.
•
Theorganizationhasestablishedapolicyonhowoftenscreeningsarerequiredtobedoneby
thethirdparty.
•
Theorganizationhasestablishedapolicyrequiringthirdpartiestoproduceproofthatthey
arecheckingtheiremployees.
•
Theorganizationhasestablishedapolicyestablishingwhichdatabasesthirdpartiesare
checking,especiallyregardingpractitioners,includinggeographicspecifics(statedatabases).
•
Theorganizationhasestablishedaprocessforindependentevaluationofwhatscreeningthe
vendorissupplying.
Audittoverityevidencethatcontractorsarebeingscreenedpursuanttocontractual
requirements.
Element4:Communication,Education,andTrainingonComplianceIssues
A.Disseminateregulatoryguidancematerial.
B.Communicatecomplianceinformationthroughouttheorganization.
C.Assurecompliancetrainingoccurs.
D.Distillcomplexlawsandregulationsintoaformatemployeescanunderstand.
E.Assureworkforcestaffareeducatedoncompliancepolicies.
F.Assureamechanismexiststoevaluateemployeeunderstandingofcomplianceresponsibilities.
G.Promoteacultureofcompliancethroughouttheorganization.
H.Encourageemployeestoseekguidanceandclarificationwhenindoubt.
I.Participateincontinuingeducationtomaintainprofessionalcompetence.
J.Verifyparticipationinongoingcompliancetrainingprogramsistracked.
K.Assuregeneralcompliancetrainingisconductedforallemployees,physicians,vendors,andotheragents.
L.Assurerisk-specifictrainingisconductedfortargetedemployees.
M.ProvideHRandmanagementwithtrainingtorecognizecomplianceriskassociatedwithemployeemisconduct.
Source:CHCCandidateHandbook:DetailedContentOutline
23
Element4:Communication,Education,andTrainingonComplianceIssues
WhattoMeasure
HowtoMeasure
Training:
4.1
•
Theorganizationprovidesriskareaspecifictraining
•
toemployeesdesignatedtobeinhighriskpositions.
•
4.2
Theorganizationhasestablishedacompliance
trainingplan.Theorganizationassuresthattraining
iscompletedaccordingtotheestablishedplan.The
trainingplanisperiodicallyupdatedorrefreshed.
4.3
Theorganizationdefinestheappropriateaudience
foreachtypeofcompliancetraining(general,issue
specific,highrisk,etc.).
4.4
TheorganizationoffersCEU’s,whenappropriate,for
itscomplianceeducationandtraining.
4.5
4.6
Theorganizationhasestablishedaprocess,policy
and/orproceduretocommunicateandprovide
trainingtoemployeesonnewlaws,regulations,
policies,andprocedures.
•
•
•
Audittoensuretheorganizationhasdesignatedthepositionsdeemedtobehighrisk(coding,
billing,physicians,etc.)andestablishedtrainingrequirementsforthesehighriskpositions.
Comparerisksposedbythesepositionsagainsttrainingmaterialstoensurespecificrisksare
addressed.
Audithighrisktrainingcompletionrates.
Conductdocumentreviewtoensurethetrainingplanexistsandincludesrequiredtraining,
expectedaudience,topicscovered,andmethodfordeployment.
Auditsign-insheetsorothertrackingtoolstoensureindividualsareattendingrequired
training.
Reviewtoensuretrainingplanisperiodicallyupdated.
•
•
Auditjobcodestoensurethecorrecttraininghasbeenassigned.
Reviewjobcodestoensuretraining,includingjobspecificjobtrainingisbeingconducted
accordingtotheestablishedtrainingplan.
•
Performadocumentationreviewtodeterminetheextenttowhichtheorganizationoffers
CEUsforcompliancetraining.
EvaluatetheeffectofofferingCEUsontrainingcompletionrates.
•
Conductadocumentreviewtoensureaprocessforcommunicatingandtrainingemployeeson
newlaws,regulations,policies,andprocedureshasbeenestablishedandsuchcommunicationand
trainingisbeingconductedconsistentwiththeestablishedprocess.
Theorganizationhasestablishedapolicyrequiring
•
compliancetrainingandeducation.Theorganization
Conductadocumentreviewtoensureapolicyhasbeenestablishedanditisperiodically
updated.
24
regularlyupdatestheeducationpolicyandmonitors
compliancewithtrainingrequirements.
4.7
4.8
4.9
Complianceeducation/informationisincludedinall
educationdeployedthroughoutorganization.
Theorganizationhascreatedtheircompliance
trainingprogramaroundjobfamiliestoaddress
specificrisksidentifiedwithinajobfamily.
Confirmbyauditthatemployeesarecompletingeducationalrequirementsaccordingtothe
policy.
Conductadocumentationreviewtoverifythatatleastonecompliancerelatedtopic/slideis
includedineveryeducationalpresentation,program,ormoduledeployedthroughoutthe
organization.
Theorganizationbasestrainingforindividualswho
aredesignatedtobeinhigh-riskpositionsona
•
formalprocessforassessingriskandevaluating
controlvulnerabilities.Theorganizationdevelops
•
issue-specifictrainingbasedontheresultsoftherisk
assessmentandidentifiedinternalcontrol
weaknesses.
4.10
4.11
•
•
•
•
Conductareviewoftheprocesstheorganizationhasforassessingriskandevaluating
controlweaknesses.
Reviewthetrainingplanandtrainingmaterialstoensurethetrainingaddressesthoseissues
thatareofsignificantriskandthattheorganizationmaybevulnerableto.
Auditthecompliancetrainingprogramtodetermineiftrainingistailoredtotherisks
identifiedandassociatedwithspecificjobfamilies.
Audittoensuretrainingisassignedbasedonjobfamilies.
Theorganizationevaluatespolicyandcompliance
•
failuresandprovidesre-educationtoapplicablestaff.
•
Auditfilesofknownpolicyorcompliancefailurestoensurere-trainingisconsideredaspartof
correctiveaction.
Audittoensurethere-trainingiscompleted.
Trackforreoccurrencestodeterminetheeffectivenessofthere-trainingandemployee
understanding.
Theorganizationtracksdisclosurereports(hotline
calls,directcontactstothecompliancedepartment)
followingemployeeeducationtodeterminethe
extenttowhichtheeducationwaseffectiveat
raisingemployeeawarenessofspecificareasof
vulnerability.
Monitor,auditandreviewdisclosuretrackinglogstoevaluatetheeffectofeducationon
disclosures.
Trackhowemployeesbecomeawareofissuestoanalyzetheeffecttraininghasonemployee
awarenessandreporting.
4.12
•
•
•
Theorganizationmaintainsdocumentationofall
educationprovided.
•
Conductdocumentreviewandaudittoensureallcompliancerelatededucationis
documented,includingmaterialcovered,attendees,anddeploymentmethod.
Audittoensuredocumentationofpost-trainingtestsismaintainedtoevaluateemployee
levelofunderstanding.
25
4.13
Theorganizationstrainingplanisregularlyupdated
toaddressnewlawsandregulations.
4.14
Obtainfromcounsellistofnewlawsandregulationsandauditagainsttrainingplantoensurenew
lawsareadequatelyaddressed.
•
Theorganizationhasconsideredthemosteffective
methodforcomplianceeducationdeployment.
•
4.15
Theorganizationhasestablishedaformalmethod
fororientingnewemployeestothecompliance
programandtheirobligationsandresponsibilities.
4.16
4.17
•
Audittoensureemployeeshavereceivedtheircomplianceorientationconsistentwiththe
orientationpolicy.
Reviewnames,datesandmaterialsusedtoorientnewemployeestothecomplianceprogram
overthepast2years
Theorganizationhasconsideredtheaccessibilityof
complianceeducationtoindividualswithdisabilities
orlanguagebarriersandprovideseducationin
variousformatstoaccommodateindividualswith
disabilitiesorlanguagebarriers.
Surveyemployeeswithcommunicationissuesordisabilitiestoensuretheeducationwas
accessibleandunderstandable.
Employeesoftheorganizationperceivecompliance
educationasusefulandsufficienttoaddressthe
compliancerequirementsintheirjob.
Surveyemployeestounderstandtheirperceptionofcompliancetrainingusefulnessand
sufficiency.
4.18
Theorganizationhasestablishedamethod(s)to
evaluatetheeffectivenessofcomplianceeducation.
4.19
Theorganizationmeasurestheeffectivenessof
trainingthoughtheuseofpost-trainingtestsor
evaluations.
4.20
•
Reviewthetrainingplantoensuretheorganizationhasconsideredthemosteffectivemethod
ofdisseminatingtrainingtoemployees,medicalstaff,contractors,leadership,Board,and
others(on-line,written,in-person,smallorlargegroup,etc.).
Audittrainingrecordstodetermineiftraininghasbeendeployedaccordingtoplan.
•
•
•
•
•
Conductdocumentreviewtodetermineiftheorganizationhasestablishedamethodfor
evaluatingtheeffectivenessofcompliancetraining.
Auditincidentlogsandhotlinereportstoevaluatetheeffecttraininghashadonbehavior.
Conductdocumentreviewtoevaluatetheexistenceofpost-trainingtestsorevaluations.
Reviewtoconfirmtheresultsofpost-trainingtestsorevaluationsareevaluatedandtracked.
Reviewtoconfirmmodificationstotrainingmaterialsconsidersfeedbackfrompost-training
testsorevaluations.
Theorganizationintegratesspecificrisksidentified
Compareriskassessmenttotrainingplantoensurethehighriskissuesidentifiedareincludedin
throughtheriskassessmentprocessintocompliance
thetrainingplan.
training.
26
4.21
4.22
Theorganizationsolicitsfeedbackfromemployees
oncompliancetrainingneeds.Employee
recommendationsareincludedintrainingmodules
disseminated.
•
Theorganizationhasestablishedapolicyregarding
thefrequencyofrequiredcompliancetraining.
Audittraininglogstoensurecompliancerelatedtrainingisdisseminatedandcompletedas
requiredbypolicy.
4.23
Theorganizationupdatescompliancetrainingbased
onnewpolicies,procedures,processes,laws,and
regulations.
4.24
4.25
4.26
4.27
4.28
•
•
•
•
Conductdocumentreviewtoensureemployeessurveyedfortheirtraining/educationneeds
andwhatfeeltheyneedtrainingon.
Interviewstafftoassesseffectivenessoftrainingplan
Confirmthattrainingconsidersemployeefeedback.
Revieweducationupdateprocess.
Verifyissuesidentifiedthroughtheriskassessment,issuetrackingsystem,andotherinternal
andexternaltrackingsystemsareconsideredandevaluatedastrainingprogramsare
updated.
Theorganizationevaluatestrainingeffectiveness.
Conductknowledgesurvey6monthsaftertrainingisdeployed.
Accountability:
Theorganizationhasestablishedanincentive
programthatties,inpart,meetingcompliance
objectivestoincentivepaymentsandotherperks.
Reviewperformanceevaluationstoensuretheyincludecomplianceelementsaspartof
performance,merit,andincentivereview.
Theorganizationhasestablishedmechanismsto
•
ensurethatemployeesareheldaccountablefortheir •
complianceobligations.
Reviewjobdescriptionsandperformanceevaluationsforspecificcompliancemetrics.
ReviewStandardsofConductandotherawarenessinformationtoensurecompliance
obligationsareclearlyarticulated,includingtherequirementtoreportcomplianceconcerns.
Theorganizationhasamechanisminplaceto
evaluatetheextenttowhichemployeesunderstand
theircomplianceresponsibilities.
Surveyemployeestotesttheirunderstandingoftheircomplianceobligationsandresponsibilities.
Theorganizationholdsmanagementemployees
accountableforensuringtheiremployees
understandtheStandardsofConductand
compliancerelatedresponsibilities
Reviewdepartmentmeetingminutesandconductrandomstaffinterviewstodetermineiffirstlinemanagersdiscusscomplianceobligationswiththeirdirectreportsandthatstaffunderstand
specificcompliancerequirementsassociatedwiththeirjob.
27
4.29
4.30
4.31
4.32
Theorganizationhasestablishedapolicyregarding
sanctionsforthoseemployeeswhodon’tcomplete
requiredcompliancetrainingandsanctions
employeesaccordingtotheestablishedguidelines.
Awareness:
•
Documentreviewandaudittoensureapolicyexistsrelatedtosanctionsforfailureto
completecompliancetraining.
Audittoensurepolicyisbeingfollowedasdescribed.
Employeesareawareofandunderstandthe
organization’scomplianceprogramandunderstand
theirresponsibilitiesundertheprogram.
Surveyemployees.
Theorganizationpromotescompliancethrough
activitiessuchasComplianceAwarenessWeek,
ComplianceFairs,orotheremployeeinvolvement
activities.
Reviewifandhowtheorganizationengagesinactivitiesdesignedtopromotecompliance
awareness.
Board:
Theorganizationhasestablishedspecificcompliance
PerformadocumentreviewtoensuresufficientcompliancecompetenciesexistwithintheBoard
competenciesformembersoftheBoard
andappropriategoverningcommitteemembership.
Compositionandappropriategoverningcommittees.
4.33
Theorganizationhasestablishedaformalprogram
toorientnewBoardmembersandseniorleadersto
thecomplianceprogramandtheirobligationsand
responsibilities.
4.34
•
Theorganization’strainingplanprovidesforspecific
educationthatwillbeprovidedtotheBoardand
seniorexecutives.Theplanincludesthetopicsthat
willbecovered,thefrequencyoftraining,includes
currentindustrydevelopmentsandresources,and
provideseducationontheirresponsibilitiesfor
compliance.
•
•
•
Conductdocumentreviewtodetermineiftheorganizationhasformalizedacompliance
orientationprogramfornewexecutivesandnewBoardmembers.
Conductanaudittoensureorientationisprovidedasrequiredbytheorientationpolicy.
Reviewnames,datesandmaterialsusedtoorientnewmembersoftheBoardofDirectors
andseniorleaderstothecomplianceprogramoverthepast2years.
ReviewtrainingmaterialsprovidedtotheBoardandseniorexecutivesandconductpersonal
interviewstoensuretrainingisprovidedpursuanttotheplanandthelevelofunderstandingof
thematerialpresented.
28
4.35
Theorganizationprovidesseniorleadershipand
boardmembercomplianceeducationandthey
adjuststrategyandoperationsinresponsetothe
trainingandotherinformationprovidedtothem.
4.36
Theorganization’sperformanceappraisalsandjob
descriptionsincludetherequirementforemployees
topromotecompliance.Employeesatalllevelsof
theorganizationcananddoarticulatethe
compliance/ethicsmessage.Thereisarequirement
thatmanagersinsertcompliancemessagesinto
meetingsandothercommunicationswithstaff.
Performadocumentreview,conductemployeepersonalfileaudits,andintervieworsurvey
employeestoensuretheorganization’scomplianceprogram,includingexpectationsand
responsibilitiesareformallyandinformallycommunicatedtotheemployeepopulation.
•
Acomplianceprogramcommunicationplanis
developedandimplemented.
4.39
•
•
Conductadocumentreviewtodeterminetheresponses/questionsposedbyseniorleaders
andBoardmembersaftertraining.
Evaluateeffectoftrainingontheorganization’soperationsandstrategy.
TrackquestionsposedbyseniorleadersandBoardmemberstodeterminelevelof
understandingofmaterialpresented.
Communication:
4.37
4.38
•
Thecompliancedepartment/staffregularlypresent
complianceprograminformationandupdatesat
staffmeetings,otherdepartmentmeetings,board
meetings,townhalls,andotherforums.
Theorganizationrequirescompliance
representativestobepresentateverysenior
managementandgovernance-levelmeeting.
4.40
Theorganizationprovidescomplianceinformation,
training,andupdatesinamannerthatis
understandableforemployees(readinglevel,
languages,casestudies,verbalcommunication)
•
•
•
•
•
•
•
•
Reviewtheorganization’scommunicationplantoensuretheplanaddresseskeymessaging
foremployees.
Conductfocusgroupdiscussionsandsurveyemployeesontheeffectivenessofthis
messaging.
Conductadocumentreviewtoensurethecompliancedepartment/staffregularlyprovide
updatestotheorganizationandisavisiblepresenceatvariousmeetings.
Confirmtheorganizationdocumentsandtracksallsuchpresentations.
Conductadocumentationreviewtoverifythereisanexpectationforcompliancetobe
representedatallseniormanagementandgovernance-levelmeeting.
Confirmbyauditthatacompliancerepresentativehasattendedallsuchmeetings.
Surveyemployeestodeterminetheeffectivenessandlevelofunderstandingbyemployeesto
thematerialpresented.
Conductpost-trainingevaluations.
Reviewandtrackquestionsanddisclosuresmadefollowingthedisseminationofinformation
andeducation.
29
4.41
4.42
4.43
4.44
Theorganizationensuresthereisadequatetwo-way
communicationbetweenthecompliance
departmentstaffandemployeessuchasperiodic
check-inswithemployeesandfollow-upwith
employeeswhoreportconcerns.
Surveyemployeestodetermine:
Competency:
Theorganizationhasdefinedthecompetencies
requiredforthecompliancestaffincluding
requirementsforcertificationorotherspecific
skills/expertise.
Reviewjobdescriptionsandpersonnelfilesforallcompliancestafftoensurespecificcompliance
competenciesandcertificationrequirementsaredesignatedandthestaffpossesstherequired
competencies/certifications.
•
Theorganizationrequiresallcompliancestaffto
maintaintheircompetencybyattendingappropriate •
educationalsessions.
•
Theorganizationprovidesfocusededucationto
compliancestaffmemberstoensuretheyare
competentinevaluatingandinvestigatingissues.
4.45
•
•
•
•
•
Conductadocumentationreviewtoverifythatrequirementsforcompliancestaffeducation,
includingprofessionaldevelopment,areestablished.
Audittoverifythatcompliancestaffattendeducationasrequired.
Reviewcompliancedepartmentbudgettoensuresufficientresourcesaredevotedto
providingappropriateeducation(includingconferences)tothecompliancestaff.
Conductdocumentreviewtoevaluatetheeducationprovidedtocompliancestaff.
Reviewtoensurecompliancestaffbeingtrainedonconductinginternalinvestigations,audits,
performingriskassessments,vulnerabilityanalysis,etc.
Developmentplanforcompliancestaff
Reviewdocumentationofdevelopmentplanandmonitortoensurethatplanrequirementsare
completedannuallyorasotherwisespecifiedintheplan
Culture:
4.46
•
Theorganizationhasestablishedacultureof
compliance.
•
theirperceptionofhowaccessiblethecompliancestaffis,
iftheyknowtoreportconcerns,and
iftheybelievetheirconcernsaretakenseriouslyandareadequatelyaddressed.
Incentives:
Surveyallemployeestodeterminetheextenttowhichemployeesbelievethereisacultureof
complianceintheorganizationandemployeeunderstandingofthecomplianceculture.
Reviewtheorganization’scompliancetrainingmaterialtodetermineifscenariobased
trainingand/orotherinteractivetrainingmethodsareusedtopromoteunderstanding.
30
4.47
4.48
4.49
Theorganizationhasestablishedmethodsfor
Reviewincentive,rewards,andrecognitionsprogramstoensuresuccessfulachievementof
rewardingandrecognizingemployeesforcompliance
compliancemetricsareconsideredwhenrecognizingandrewardingemployeesandleadership.
activities.
VendorsandVolunteers:
•
Theorganizationhasestablishedthetraining
requirementsforvendors.
Theorganizationhasestablishedthecompliance
trainingrequirementsforvolunteers.
•
•
•
•
Conductdocumentreviewtoensuretheorganizationhasestablishedtrainingrequirements
forvendors.
Reviewfilestoensurevendorshavecompletedtrainingasrequired.
Conductsitevisitstoreviewvendoremployeecompletionofrequirededucation.
Conductdocumentreviewtoensuretheorganizationhasestablishedtrainingrequirements
forvolunteers.
Reviewfilestoensurevolunteershavecompletedtrainingasrequired.
Element5:Monitoring,Auditing,andInternalReportingSystems
A.Protectanonymityandconfidentialitywithinlegalandpracticallimits.
B.Publicizethereportingsystemtoallworkforcemembers,vendors,andagents.
C.Assuremonitoringoccursforviolationsoflawsandregulations.
D.Conductorganizationalriskassessments.
E.Developworkplanbasedonriskassessment.
F.Maintainreportingsystem(s)toenableemployeestoreportanynoncompliance(e.g.,hotline).
G.Respondtocomplianceconcernsexpressedbyemployeesthroughinternalreporting.
H.Assuretheexistenceofproceduresformonitoringadherencetocompliancepoliciesandprocedures.
I.Conductcomplianceaudits.
J.Analyzecomplianceauditresults(e.g.,track,trend,benchmark).
K.Developanannualcomplianceauditplan.
L.Evaluateresultsofauditsconductedbyexternalentities.
M.Monitorthatretaliationforreportingcomplianceconcernshasnotoccurred.
N.Recognizeneedforattorneyconsultationintheauditing/monitoringprocess.
O.Employauditingmethodologiesthatareobjectiveandindependent.
P.Determinesamplingmethodologyconsistentwithcircumstances.
Q.Assureatimelyresponseismadetoreportedcomplianceconcerns.
31
R.Monitormanagement’simplementationofcorrectiveactionplans.
S.Providetimelyfeedbacktomanagementoncomplianceconcernsbasedonauditresults.
Source:CHCCandidateHandbook:DetailedContentOutline
Element5:Monitoring,Auditing,andInternalReportingSystems
WhattoMeasure
HowtoMeasure
ReportingSystem:
Accessibilityofreportingsystem
Interviews.Surveys.Askemployeesandmanagersifthereportingsystemisaccessibletothem.
Isitavailableinlanguagesthataremostspokenintheorganization?
Adherenceto60-dayoverpaymentrule
Reviewincidenttracker;ensuredaystoopenordaystoclosedonotexceedthattimeframe.Track
effortstoidentify;statusbenchmarksspecificdaystocompletion.
Trustinthesystem
Survey-Doyoufeelyoucanfreelyreportethicsandcomplianceissueswithoutfearofretaliation
frommanagers?(Yes/No/Don'tKnow).
ReportingandInvestigationProcess
Reviewexternalbenchmarkingreports(#ofcalls,timeittakestoclosecases,anonymous,etc.).
Reportingsystem–complianceresponseto
reporters
Documentreview.Focusedgroupsandspeakingwithemployeesabouthotline.
• Arecallsmadethroughreportingsystemresponsivetoreporters?
• Arepoliciesfollowedregardingtheresponsetoreportsreceived?
• Arereportsrespondedtoonregularintervalsandupdatedappropriately?
ReportingSystem:Hotline/Directcontacts
Documentreview,audit.
• Arehotlinecallsormattersbroughttotheattentionofthecompliancedepartment
(directcontacts)categorized,trended,andreportedtothecompliancecommitteeand
boardlevelcommittee?
• Aretheretracking,trendingandreportingofhowthesemattershavebeenresolved?
Reportingtocompliance(hotline,reporttothe
complianceofficers,etc.)
Reportsreflectcommunicationmethods(call,anonymous,email,direct,etc.)?
5.1
5.2
5.3
5.4
5.5
5.6
5.7
32
5.8
Thoroughnessofinvestigationfiles
Review5investigationfilesforsummaryofissue,interviewsconductedandsummaryof
interviews,investigationsummaryandresults/conclusionandcorrectiveaction(asapplicable).
Timetorespondtoincidentreport
Reviewdatereported,dateresponded,dateinvestigationclosed.
Promotionofreportingsystem
Documentationreview.Interviews,visualwalk-throughs.
• Arehotlinepostershanginginconspicuousareas?
• Interviewstaff–dotheyknowhowtoreport?
• Audituseofreportingsystem(howfrequentlyisitused)?Considerinternalorexternal
reportingbenchmarks.
Publishedreportingsystem
Survey.
• Isthereahotline,complianceofficer?
• Howtoreport?
• Howtofindinformation?
Demonstrationofaformalcomplianceprogram
Documentreview.Isthereidentificationofprioritizationofkeycomplianceindicators;reporting
andescalatingtocomplianceoversightcommittee?
Documentationtosupportresolutionofreported
matters.
Audit.Documentreview.
Effectivenessofcompliancedepartment
Documentreview,surveys,interviews,focusgroups.
• Isthereareportcardonassociates’comfortlevel?
• Dotheyknowwhotogotowithconcerns?
• Dotheyknowwhomtotrust?
• Istherefollow-through?
• Whatisthetrustandintegrityaroundmembersofcompliancedepartment?
5.15
Disciplinefornon-compliance
Documentreview,interviews.Monitortoensuredisciplinepoliciesarefollowed.
5.16
EffectivenessofFollow-uptoComplianceConcerns
Interview/surveycallerforsatisfactionwithfollow-upofconcern.
CultureSurvey
Documentreview,assessmentofresponses.Doculturesurveysincludequestionssuchas:
• Doyouknowhowtoreportconcerns?
• Areyouwillingtoreportconcerns?
5.9
5.10
5.11
5.12
5.13
5.14
5.17
33
•
Doyoutrustthatconcernswillbeaddressedfairlywhenreported?
5.18
Awarenessandeffectivenessofinternalreporting
system
Reviewsystemuse.Looktomakesureemployees,vendors,contractorscanreport;gaugethe
levelofretaliation;individualcomfortofreportingsystems;survey.Conductinterviews.
5.19
Awarenessofthediscipline
Survey.
Hotlinereportingsystem/vendor
Monitor.
• Aretestcallsofthesystemconducted?
• Arethecallsanswered?
• Ifexternalvendor,aretheyfollowingtheorganization’sdocumentednotification
protocol?
Internalreportingfrombusinesspartners,
contractors,etc.
Contractreviewandinterviews.
• Iscompliancedepartmentawareofthecontractswithbusinesspartners,contractors,
etc.?
• Isthereaninventoryofpartners?
• Dotheyknowhowtocontactcompliancedepartmentwithissues?
Investigationresolutionandtimeliness
Documentationreview.
• Arereportsclosedtimely?
• Aretherecompletionnotesanddatesmattersandsubmittedtoboard?
PresenceofInternalReportingSystem
Reviewpoliciesandproceduresandmechanismsforinternalreporting.Aremattersbeing
reportedaccordingtopolicy?Whatshouldbereportedupinregardstocompliance?Checktosee
ifithasbeenreportedupappropriately.
Processofhowaconcernishandled
Reviewdocumentationthatreflectsthisprocess;auditcasefilestodemonstratethisdecision
processwasfollowed.Isitamanagementissue,legalissue,other?Isthereatriagetree?
Subordinateconduct
Interviews.Documentreviews.Doesorganizationmeasurewhetherlinemanagersare
monitoringtheconductoftheirsubordinates?
Writtenescalationprocess
Documentationreview.Isthereawrittenproceduretodetermineatwhatpointamattermustbe
reportedtotheboard,committee,orgovernmentagency?
RiskAssessments:
RiskAssessment
Documentation/processreview.
• Isthereadocumentedenterprise-wideriskassessment?
5.20
5.21
5.22
5.23
5.24
5.25
5.26
5.27
34
•
•
•
•
5.28
Whatistheworkplancreationprocess?
Isinternalauditincluded?
Isafraudriskassessmentconducted?
Isthisinformationusedasabasisforcreatingtheauditingandmonitoringplanorwork
plan?
RiskAssessmentProcess
Processmapofriskassessmentprocess.
• Whoparticipates?
• Howaretopicsprioritized?
• Whatistheprocess?
• Howaremitigationstepsdetermined?
• Iseducationprovided?
• Howaretheresultsreported?
Riskbasedwork/auditplan
Documentreview.Isthecompliancework/auditplanbasedonadocumentedriskassessmentand
isitriskbased?
Follow-uptoRiskAssessment
Reviewprocessforfindingsofriskassessmentandwhetherimplemented;auditormonitor
implementation;auditandmonitorasnecessaryafterimplementationtomitigaterisk(closingthe
loop).
5.31
Frequencyofriskassessment,scopeandcoverage
andtoolsusedforriskassessment
Audittheriskassessmentprocessfortheseareas.
5.32
Informationflowfrombusinessunitstocompliance
departmentfortheriskassessmentprocess
Interviews.
Internalauditdepartment’srelationshipwith
compliancedepartment
Documentreview,interviews.
• Isriskassessmentutilizedtocreateannualauditplan?
• Whoparticipatesintheriskassessment?
• Arethereroutineinteractionsbetweencomplianceandinternalaudit?
• Howmanyinternalaudithoursaredesignatedforcompliancerelatedwork?
• Or,howareauditsdelegatedtointernalauditorcomplianceafterriskassessmentis
completed?
Isauditingandmonitoringbasedonriskareas
identifiedinriskassessmentprocess
Reviewriskassessmentprocessandwhatauditsandmonitoringareonworkplans.
5.29
5.30
5.33
5.34
35
5.35
Monitoringeffectiveness
Documentreview.Isthemonitoringplanlinkedtoriskassessmentstomakesurehighestrisk
areasarecovered?
5.36
Verifythatriskreportingisgoingtobusinessleadership;routineinclusionofrisksatcompliance
committee;assessmentofeffectivefollow-upwhenriskresolutionisoff-track.
Participationofbusinessleadershipinriskresolution
MonitoringandAuditingWorkPlan:
Methodtocreateauditplan
Document/processreview.
• Whatinternallyandexternallyareusedtocreatetheriskbasedplan?
• Isareviewofsubmittedcorrectiveactionplansincludedinthereviewandplanning
process?
5.38
Auditandmonitoringbasedonriskassessment
Documentreviewcomparisonofaudit/monitoringplan.
5.39
Approvalprocessofworkplans
ReviewminutesofBoardandComplianceCommitteemeetings.
5.40
Auditingandmonitoringprocess
Documentandprocessreview.Howisannualworkplandeveloped?Whoisresponsibleforit?
Aretheresufficientauditsconducted?
Documentationreview.Lookatauditplan,including“adhoc”auditsthatwereunplanned,but
conductedinresponsetoamatter.
Auditinventory
Documentreview.Isthereaninventoryofallauditsbeingconductedeitherbyinternalstaffor
externalconsultantsintheorganization?
5.43
Compliancedepartmentroleinestablishingaudit
plan
Reviewofauditplanandprocesstoensurecomplianceiskeystakeholderandpartoftheprocess.
5.44
Definedprocesstohireoutsideexpertstoconduct
audit/investigationandreview
Reviewpolicyandproceduresandinterviewdecisionmakersontheprocessandcriteriatotrigger
thehiringofoutsideexpertstoconductaudit/investigationandreview.
Completionrateforcomplianceworkplan
Auditordocumentreview.
• Weretheitemsontheworkplancompletedbytheduedate?
• Ifnot,docompliancecommitteeandboardlevelcommitteeminutesreflectdiscussion
aboutthis?
• Ifworkplanwaschanged,istherecompliancecommitteeandboardcommittee
documentationtosupportthis?
5.37
5.41
5.42
5.45
36
5.46
Periodicreviewsofmonitoringandauditingplan
Documentreview.Ismonitoringandauditingplanreviewedperiodicallyatthecompliance
committeeandboardlevelcommitteetomakesureitisstillfitforpurposeandfocusedonhighriskareasfortheorganization?
5.47
Randomauditingisconductedtoidentifyunknown
risks
Portionoftheauditplanisbasedonrandomselection.
5.48
Effectivenessofgiftpolicyandprocedure
SurveyongiftpolicyawarenessandauditgiftregistryorsystemforcompliancewithP&P.
AuditProcess:
5.49
Theneedfortheadviceofcounselrelatedtoaudits
Reviewofreferralprocesstotrackattorneyreferral.Isorganizationtrackingthatattorneyis
consultedwhenauditfindingsnoteissues?
5.50
Validatetheorganizationisconductingaudits
Processreview.
5.51
Auditresultsandactionsinresponsetoauditis
reportedtothegoverningbody
Reviewofminutes.
5.52
Auditresultsarepartofperformancereportsand/or
Documentationreview.
incentives
5.53
5.54
5.55
5.56
Authoritytoinitiateaudit
Documentreview.Interviews.Audit.
• Istheredocumentationoutliningwhoisauthorizedtoinitiateanaudit,includingthe
engagementofoutsideconsultants?
• Howisthisdone?
• Howthoroughisit?
Auditprocess
Processreview.Documentationreview.Areauditsdefinedwithissue,scope,objectives,and
resources?
Accountability
Createauditreportsforcomplianceauditsidentifyingpurpose,scope,sampleselection(if
applicable),findings,conclusion,andrecommendations.
Auditbenchmarks
Auditofauditsforbenchmarking-Aretheauditfindingsactionable?
Complianceauditresults
Processreviewanddocumentreview.
• Areauditresultsbeinganalyzed,tracked,trendedandreported?
• Forexample,howoftenareeducationorpoliciesandprocedurechangesneeded?
• Ismanagement(notcompliance)responsibleforcorrectiveactionplans?
5.57
37
•
5.58
Iscompliancemonitoringcorrectiveactionplanstocompletionandthenconducting
follow-upauditstoensuretheactionsremaininplace?
Meaningfulnessofaudits
Reviewofaudittool.
Reportresults
Documentationreview.
• Howisresolutionofdeficiencydocumented?
• Howdoesthedepartmentdocument?Howdoesthedepartmenttrackwhatwas
accomplished(metric:spreadsheet-database)?
Reportingofauditresults
Processreview.Documentationreview.
• Areauditresultsarereportedtooperations?
• ComplianceCommittee?
• Governingbody?
CorrectiveActionPlans:
Depthandbreadthofrootcauseanalysis
Auditandinterviewprocesstodetermineifproperdepthandbreadthofrootcauseofconcern
andproperincorporationintocorrectiveactionplan.
5.62
Accountabilityofcorrectiveaction
Reviewagendas,minutesandreportstocompliancecommitteeoncorrectiveactionplans.
5.63
Actionplansinresponsetoanauditfinding
Auditofauditstoensureactionplansaredocumented.
5.64
Areidentifiedrefundstracked,documentedand
returnedtimely?
Auditandreviewofdocumentationtoensurecheckwentout.
Auditandinvestigationtrending
Validationreviewsofcorrectiveactionplans.Areauditandinvestigationfindingstrackedfor
trends?Rootcauseanalysis?Fixforentiresystem?
CorrectiveActionPlans
Documentreview.Audit.
• Isthereadocumentedfollowupprocesstomakesuremanagementhascompleteditems
incorrectiveactionplans?
• Werethecorrectiveactionssuccessfulincorrectingthedeficiency?
• Arefollowupauditsconductedtoensurecorrectiveactionsdonotlapse?
Reportingofuntimelycorrectiveactions
Validationaudits/follow-upaudits.Ifthereareun-timelycorrectiveactions,aretheyreportedto
thecompliancecommitteeandgoverningbody?
Timelycorrectiveactions(newsafeguards/controls)
Audittoensureauditshavecorrectiveactiondocumentedinatimelyfashion.
5.59
5.60
5.61
5.65
5.66
5.67
5.68
38
Auditors:
5.69
Auditingtheauditors
Hirethirdpartytoauditauditorsorindividualcontributors;validateauditresults.
5.70
Auditorsdevelopauditinstructions
Documentreview.Arethereguidelinesinplace?
5.71
Auditorsskillsetandcompetencytoaudittheissue
Reviewauditworkproduct,personnelfiles,etc.
Independence
AuditforIndependence-Reviewtoensurenovestedinterestinoutcomes,meetindependence
requirementasdefinedbyyellowbook.
5.73
Processtoevaluateauditorskillsettoensurethe
rightauditresourcesareselected(internalaudit,
outsideauditor,etc.)
Reviewofauditorbackgroundandskillset.
5.74
Standardizationofauditprocess-auditorsapproach
Auditreviewtomonitorforconsistency.
auditsinthesameway
Non-Retaliation:
5.75
Monitoringforretaliation
Exitinterviews/employeesurveys.
5.76
Retaliation
Surveys,focusgroups,individualquestioning,exitinterviews.
Vendoroversight:
5.72
5.77
•
Vendoroversight
•
Reviewvendorcertifications;trackconsequencesforvendorsnotadheringtocompliance
program.
Ensureallvendorcontractsincludeconsistentcompliancelanguage.
39
Element6:DisciplineforNon-Compliance
A.Recommenddisciplinaryactionwhennoncomplianceissubstantiated.
B.Promotedisciplineproportionatetoviolation.
C.Promotedisciplineconsistentwithpoliciesandprocedures.
D.Verifythatdisciplineisenforcedconsistentlythroughoutalllevelsoftheorganization.
E.Monitorforconsistentdocumentationofdisciplinaryaction.
F.Recommendactionforindividualsandentitiesthathavebeenexcludedfromgovernmentprograms.
G.Verifythatcompliance-relatedviolationsareaddressedindisciplinarypolicies.
H.Coordinatewithmanagementthattimelydisciplinaryactionistaken.
I.Verifythatdisciplinaryactionisreportedtoregulatorybodywhenrequired.
Source:CHCCandidateHandbook:DetailedContentOutline
Element6:DisciplineforNon-Compliance
WhattoMeasure
Consistency:
6.1
HowtoMeasure
Fairnessandconsistencyindisciplinaryprocess
Sample–audit.
• Isthedisciplinaryactionpolicyconsistentlyfollowed?
• Doesthecompliancecommitteereviewandmeasurefairnessandconsistencyinpolicy
application?
• Auditdisciplinepersonnelfiles–considercreatingpredefineddisciplinematricesand
auditagainstthese.
• Interviewonperceptionofdisciplineapplied,surveyonperception.
• Isdisciplinaryactioninproportiontomatter?
• Isthereconsistencyforsimilarmatters?
Approachtodeterminingtypeofdisciplinaryaction
ReviewofP&P.
• Auditing/testingtodeterminewhetherthereisacommonapproachtoanalyzingthe
disciplineaspectofresolution.
• Aretherestepsembeddedintoprotocol?
6.2
40
6.3
Complianceofficerinputintodisciplinaryaction
decisions
6.4
Decision-makingparties
InterviewCCO,outcomesreview,andaudit.Arecomplianceofficer’srecommendationstaken
seriously?
•
•
•
•
6.5
Auditpersonnelfiles.
Policyreview.
Isthereadisciplinaryactioncommitteeapproachtoreviewresultsofinvestigationand
previousactionsandtomakedecisions?
Aretheappropriateparties(e.g.Legal,HR,Compliance,etc.)partofdisciplineactiondecisionmakingprocess?
ThoroughnessofdisciplinaryP&P
Reviewcriteriaofincludingcomplianceviolationsandwell-definedsanctionsforconsistent
applicationofdisciplinarypolicies.
6.6
Timelinessofdisciplinaryaction
HRauditoffiles.Istimelydisciplineandactioncarriedout?
Awareness:
Understanding
Survey-Ispoorperformanceoncomplianceresponsibilitiesgroundsfordisciplinaryaction?
Accuracy
Verifyingthatpersoncompletedthecomplianceexpectationsthatwereattestedto.
Compliancegoals
Documentationreview.Isthereconsiderationofcomplianceactivitiesindailyactivities?Review
performanceevaluations-Weregoalsaccomplished?
Complianceincentives
Processreview;interviewsofleadershipandstaffinterviews.Whatistheroleofcompliance
whenitisimplemented?
Incentivepolicy
Documentreview,interviews,andfocusgroups.
• Doestheorganizationdistributebadgesforcenters,ordepartmentsforparticipationin
compliancetraining?
• Aretherecontestsforcompliancetrainingandpublishingoftestscores?
Distinctionbetweendisciplinaryactionandnonretaliation
Interviews,reviewsofpolicies,etc.Assesstheeffectivenessoftheorganizationaldistinction
betweendisciplineandnon-retaliationandmakesurethereareappropriateprotectionsregarding
non-retaliation.
6.7
6.8
6.9
6.10
6.11
6.12
41
6.13
Educationtoensureemployeesknowexpectations
Auditcommunicationsregardingexpectationsanddisciplinepossible.Comparepolicyand
StandardsofConducttoensuretheyareclearregardingdisciplinaryaction.
Employeeawarenessofdisciplinaryactionpolicy
Interviews,surveys,etc.Doemployeesunderstandtherearedisciplineconsequencesfornoncompliance?
Employee,vendor,contractorknowledgeofcodeof
conductandtheircomplianceresponsibilities
Auditdocumentation.
• Doemployees,vendors,andcontractorsknowtheirresponsibilitiesregardingcodeof
conduct?
• Dotheysignannualattestations?
Transparencyregardinglessonslearned
Documentreview.Arethelessonslearnedfromdisciplinaryactionconveyedandusedasan
educationaltoolfororganization?
6.17
Culture
Survey-Doyoufeelemployeeswhoengageinimproperwork-relatedactivitieswillbecaught?
6.18
Non-retaliationforgoodfaithreporting
Reviewdemotions,terminationsandconductemployeesurveys.
6.19
Proactiveeducationonviolationanddiscipline
Reviewpolicyandprocedureandeducationandtraining
Recognitionandappreciation
Focusgroups,interviews.
• Arethererecognitionandappreciationprogramsthatdonotincludeincentivizingwith
money?
• Forexample,aretherenewsletters,reportstogoverningbody,websiteannouncements
torecognizethoseforexhibitingcomplianceandethicalbehaviorsandactions?
Documentation:
Disciplinetransparency
Documentationreview.Arehigh-levelresultsfromdisciplinaryactionpublished(e.g.,#of
terminations,#ofcounseling,#ofsuspensions,and#ofcorrectiveactionplans)?
Oversight
ReviewminutesfornumberofdisciplinaryactionsforcomplianceandHIPAAviolationsinlastyear
reportedtotheComplianceCommittee(dashboard)
Adequatedocumentation
Review/auditdisciplinaryfilesforsupportingdocumentationofdisciplinaryaction.
Complianceinbusinessplans
Document,processreview.
• Istherealeadershipscorecardthatincludescompliancemetrics?
• Aretherecomplianceincentivesbuiltintobusinessplans?
6.14
6.15
6.16
6.20
6.21
6.22
6.23
6.24
42
6.25
Notificationoflicensingboards
HRfileaudit-beforeissueisclosed,isdocumentationpresentandincludedintrackingsystem?
6.26
Policy
Documentreview.Audit.Isthereadocumentedpolicyaddressingdisciplinefornon-compliance?
Policyexceptions
Filereviewofexceptions.Areexceptionstracked,documented,andevaluated?Whogetsto
makethedecisionregardingexceptions?Isthisprocessdocumented?
Reportingtoregulatoryauthorities
Audit.Documentreview.
• Lookatcriteriaforreportingandtimelinessachieved.
• Auditcasesandtrack.
• Ensuretimelyreportingtoregulatoryauthoritiesofpotentialviolationsanddisciplineto
demonstrateorganization’scommitmenttocompliance.
Scopeandinclusionofdisciplinaryactionpertaining
totheculture
Investigatebreadthofdisciplineandinclusion,auditdisciplinaryfiles,andconductinterview.
Doesdisciplineincludethosewhoknowaboutitanddidn'treportitorcausedittohappenbutdid
notactuallydoit?
6.30
Scopeofdisciplinaryaction
Audittoverify-Aretheredisciplinaryactions/consequencesfornotreporting?
6.31
Systemallowsfordocumentationofcompliance
issues
Document/Systemreview.DoesHRsystemhavemechanismforrecordingandtracking
complianceoffenses?
PromotionCriteria:
PromotionCriteria
Reviewifcomplianceconsiderationswereincludedinpromotionprocessandcriteria.
Seniorexecutiveperformancereviews
Process,documentreview.
• Beforepromotion,doescomplianceconductinterviewtoidentifyordiscusscompliance
issues?
• Doesheadofcomplianceparticipateinthereviewsofseniorexecutives?
• Istheretalkaboutcomplianceinitiativeswithregardstoseniorexecutiveperformance
reviews?
Performancereviews
Documentreview.
• Isthererecognitionofcomplianceeffortsinperformancereviews?
• Iscompliancebuiltintotheperformanceevaluationforrewardingemployeesand
disciplinaryaction?
6.27
6.28
6.29
6.32
6.33
6.34
43
Element7:InvestigationsandRemedialMeasures
A.
Communicatenoncompliancethroughappropriatechannels.
B.
Assuredevelopmentofcorrectiveactionplansinresponsetononcompliance.
C.
Monitortheeffectivenessofcorrectiveactionplansinresponsetononcompliance.
D.
Assureremedialeffortsareimplementedtoreducerisk.
E.
Cooperatewithgovernmentinquiriesandinvestigations.
F.
Investigatemattersrelatedtononcomplianceinafair,objective,anddiscretemanner.
G.
Assurerecordsaremaintainedoncomplianceinvestigations.
H.
Participateinnegotiationwithregulatoryagencies.
I.
Assurethatoverpaymentstopayersarerefundedinatimelymanner.
J.
Collaboratewithlegalcounselregardingvoluntarydisclosures.
K.
Coordinateinvestigationstopreserveprivileges,asapplicable.
L.
Facilitateindependentinvestigationswhennecessary.
M.
Recommendmodificationofcorrectiveactionplans.
N.
Recognizeneedforsubjectmatterexperts.
O.
Assuredocumentsrelevanttoaninvestigationarepreserved.
P.
Assureinvestigationpersonnelhavethenecessaryskillsets.
Q.
Instituteimmediatemeasuresasnecessarytomitigateongoingharm.
R.
Recommendmeasurestoaddresssubstantiatedincidenceofretaliation.
Source:CHCCandidateHandbook:DetailedContentOutline
44
Element7:InvestigationsandRemedialMeasures
WhattoMeasure
HowtoMeasure
GuidelinesforConductinganInvestigation:
7.1
Theorganizationhasguidelinesestablishedto
ensurethorough,credible,andcomplete
investigationsaredoneinaconsistentmanner
Reviewguidelines,policyandprocedureand/orprotocolonconductinganinvestigation.
7.2
Effectivenessofinvestigativeprocess
Reviewprocessforcommonstepstoembedintoaprotocol.Conductabaselinereviewto
understandwhatthemandatorypartsoftheinvestigationframeworkareandwhatmaychange
duetosituationorcircumstance.
• Istheoverallinvestigationprocessdrivenbyapolicyandprocedure,subjectmatterresource
involvement,objectivereviewer?
• Istheprocesstransparent(noteverythingplacedunderattorneyclientprivilege)?
• Isthereadocumentedinvestigationsprocessorprocedure?
• Areinvestigationsbeingconductedconsistentwithwrittenprocedures?
• Istheresomethingthattriggersasentinelevent,immediatereporting,theneedforexternal
consultantsorattorneys?
• Whatistheapprovalprocess?
• Whataretimelineswithregardsto60-dayrule?
• Isthereacentralizedprocessforkeepingupwithallinvestigationsinprocess?
• Howmuchflexibilityduetosituationorcircumstancesisappropriateandhowmuchneedsto
becontrolled?
• Nextyear,istheprocesstightenedupgoingforward?
7.3
Individualaccountabilityaspartofinvestigativeplan. Audit.Documentreview.Interviews.
• Isthereabaselineinvestigativeplanthatoutlinescommunicationplanforinterviewing
currentorprioremployees?
• Doestheinvestigativeprocessincludespecialattentiontoindividualaccountability?
• Isthereinvestigativemappingandoutlinetoaskquestionsaboutwhomaybeintheloopso
compliancecanbesuretheyarenotpartofreportinggroup?
• Arethereappropriateprotectionsforpeoplebeinginterviewedandtherepresentationof
organization?
45
•
Istheredocumentationthattheindividualisnotgivenassurancesthatthereareno
repercussionsforhim/her?
7.4
Typeofdocumentationrequiredforremedial
measuresandinvestigation
Reviewpoliciesandproceduresonrecordretentionandtypesofdocumentation
ContentofInvestigationFiles:
7.5
Assurerecordsaremaintainedoninvestigation
Audittoask:
• Isthereapolicyandprocedurefordocumentationthatneedstobemaintained?
• Doinvestigativefilesmatchthepolicyrequirements(determinewhatshouldbeinthe
attorneyfileversustheinvestigationfile)?
7.6
Qualityofthedocumentation
Assesswhetherthewho,what,whenandhowisansweredineveryinvestigation;samplelog
entries
7.7
Assuredocumentsrelevanttoaninvestigationare
preserved
Readwrittenpolicyandprocedureforinvestigationrecords;readinvestigationfilesofHR,
compliance,and/orlegaltoconfirmcompliancewithretentionperiod
QualityandConsistencyofInvestigations:
7.8
Qualityandeffectivenessofinvestigations
Auditinvestigationstolookat:
• qualityofquestionsaskedandcontentconsidered,involvedparties,andreportoutof
findings;
• didtheyinvolvetheappropriatepartsoftheorganization;
• aretheybroadenough;and
• didtheyuseinternalorexternalauditors?
7.9
Thoroughness,timelinessandconsistencyof
investigationprocessamonginvestigators
Auditinvestigationfiles
7.10
Triageprocess
•
•
7.11
ConsistencyofInvestigations
Multipleanonymous(mock)reportsondifferentissuestotestprocess
Auditprocesstoreviewwhetherallegationswereappropriatelyandtimelyhandled
Dryrun,test,mockreport
46
7.12
Credibilityofinvestigationandremediationprocess
tothirdparties
Demonstratingitbymockpresentation(devil’sadvocate)-roleplayingwhataregulatormightask
regardingtheinvestigationandremediationprocess.
TrackingandTrendingInvestigations
7.13
Investigationcategorizationprocessandtrending
Documentationreviewandaudittrackingsystem.Areinvestigationsbeingcategorizedsothey
canbetracked,trendedandreportedtocompliancecommittee,seniormanagementandboard?
7.14
Retainingdocumentationofinvestigationsinrecords Reviewofdocumentationinsystem
managementsystem(tracking,trending,review)
7.15
Documentingwhenissueissubstantiatedornotand Reviewreports/process
reporting/trending
7.16
Compliancelog(logandtrackinvestigations)
•
•
•
EscalationofInvestigations
7.17
Ensureadequateandtimelyescalationof
investigationoutcomes
Auditsampleofinvestigationfiles
7.18
Significantinvestigationsarereportedtothe
governingbody
Reviewboardminutes,reviewpoliciesrelatedtoboardreportingrequirements.
7.19
Investigationreportingtoseniorleadershipand
board
Documentreview,interviews.Areinvestigationsbeingreportedtoseniorleadershipandthe
board?
CommunicationofInvestigationOutcomes
7.20
Theappropriatecommunicationoftheinvestigation
outcomes(education)
•
•
Doesalogexist;
Doesithaveinvestigationsandactionstaken;and
Aretheresupportingfilesforeachentrysothattheycanbereportedon(HR,Billing)toreport
thetrends?
Conductanassessmentattheconclusionofaninvestigationofadditionalcommunicationto
theorganizationfororganizationallearningandcultureofcompliance
Documentreviewofmeetingminutesand/orinterimreports.Wereinvestigationsresults
reportedtoseniorleadershipandboard?Howweretheresultscommunicated?
47
•
Reviewhowresultsofinternalinvestigationsaresharedwiththeorganization'sgoverning
body,leadershipandrelevantdepartments.
7.21
Culture
Surveyforwhetheremployeesbelievethatmanagementand/orthecomplianceofficerfollowsup
onreportsofcomplianceconcernsandtakesappropriateactionwhenevernecessary?
(Yes/No/Don'tknow)
7.22
Perceptionofinvestigationresultsbyemployeesand Focusgroupsorsurveyofemployees
stakeholders
7.23
Communicatenoncompliancethroughappropriate
channels
Readworkgroupmeetingminutesoremailstodeterminedistributionlistincludesappropriate
individuals(stakeholders,decisionmakers)
TrainingofInvestigators
7.24
Staffwhoconductinternalinvestigationshavethe
educationnecessarytoconductinvestigations
Peerreviewonsimilarorganizations.Reviewofcertificationsandeducationprovided.
7.25
Numberofemployeeswithappropriatecertifications Reviewlistofinvestigatorsandtheircertifications
thatareconductinginvestigations
7.26
Investigatorshavetheskillset
Interviewinvestigatorsandlookatworkproductforfacts
7.27
Training/competencyofinvestigators
•
•
ProfessionalismandCompetencyofinvestigators
7.28
Ensuringinvestigatorsareconductinginvestigationin Interviewsubjects
professionalandrespectfulmanner
7.29
Professionalismandeffectivenessofinvestigators
Conductandobservemockinterviews
7.30
Strengthandcredibilityofinvestigationprocess
Roleplayofinvestigationprocess
7.31
Investigatemattersinafairmatter,objectiveand
discreetmanner
Peerbenchmarkingtoevaluate:
• thetimeitshouldtaketoconductaninvestigation;
Evaluatetrainingtranscripts,trainthemoninvestigationtechniques;
Reviewthetypeoftraininganyoneconductinginvestigationshasreceivedoverthepast2
years
48
•
whatpeersdotomakesureinvestigationsoccurdiscreetlyandtimely
Independenceofinvestigator
7.32
Objectivityofinvestigator
Interviewsbyexternalsourcewithgoaltoensurenointernalorganizationalpressureonthe
investigatorsthatisimproper.
7.33
Assessinguniformityofusingoutsidecontractorsand Reviewpoliciesandproceduresandauditfilesforcompliance
expertsintheinvestigationprocess
7.34
IndependenceandObjectivityofInvestigation
Reviewpoliciesandprocedures,surveyemployeeperception,qualitycontrolprocess,etc.
7.35
Independenceofinvestigation(nointimidationis
occurring)
Workproductandinterviews;qualityofprocess(avoidreportingstructureconflictsofinterest;
direct-report)
InvolvementofLegalCounsel
7.36
Coordinatinginvestigationstoprotectprivilegewhen Auditagainstpoliciesandprocedurestodetermineappropriateattachmentofprivilege
necessary
7.37
Collaboratingwithlegal
•
•
•
Lookatworkproducttodeterminequality;
Ensurecomplianceleadstheinvestigation(unlessinvestigationisbeingconductedunder
privilege);
Interviewcomplianceofficerandlegalcounseltodeterminethelevelofcollaboration.
TimelinessofResponse
7.38
Areimmediateactionstakenimmediately
Auditinvestigationoutcomestoseeiftimely
7.39
Complianceofficerauthority
Interviews,documentreviews.Ifconcernisraisedanditisharmful,managementneedsabilityto
reactimmediatelyevenifitisbeforeinvestigationiscomplete.Doesthecomplianceofficerhave
theabilityandauthoritytostopanaction(e.g.,billing)?
7.40
Timetoinvestigationclosure
•
•
Tracktimelinessagainstbenchmarkestablishedbyorganization;
Documentationreview.Islengthtocloseinvestigationsbeingdocumented,tracked,trended
andreported?
49
•
Areresolutionactions(e.g.,education,newpolicy/procedure,correctiveactionplan,
disclosure,repayment,etc.)beingdocumented,tracked,trendedandreported?
7.41
Timelyprocessingofrefunds,self-disclosures
Audit,monitor,documentreviewofinvestigationsthatresultedinrefunds,disclosurestoensure
theywereprocessedinatimelyfashion.
7.42
Self-Disclosureguidelines
Documentreview,interviews.
• Aretherewrittenguidelinesforself-disclosures?
• Dotheyaddressmembersimpacted,informationtobesharedwithregulators?
CorrectiveActionPlans/RemedialMeasures
7.43
Businessleadersareaccountableforfollow-upto
investigations
•
•
•
7.44
Effectivenessofcorrectiveactions
Documentationreviewofcorrectiveactionstimeframesmet,issuesclosedout,effective
resolution.
7.45
Structure
Reviewhowcorrectiveactionplansarecreated
7.46
Validatethatcorrectiveactionplansareappropriate, Review3correctiveactionplanstoensureidentifiedallissuesandconductvalidationvisits
implementedandeffective
7.47
Accountability
•
•
7.48
Ensureremedialmeasureforlikefindingsare
consistentlyimplemented
Audit
7.49
Measuringsufficiencyofcorrectiveactionplansthat
aredeveloped
Samplecasesthatweresubstantiatedandreviewthecorrespondingcorrectiveactionplansto
ensuretheyrespondtoissuesidentifiedininternalandexternalauditsandinvestigations
7.50
Remedialactions-Appropriateremedialaction
occurred
Reviewinvestigationdocumentation,PowerPoint,trainingattestationisinthefile.
Verificationthatinvestigativereportissharedwiththoseresponsibleforfollow-up.
ClosurereportsareprovidedtoComplianceCommittee.
Auditpostinvestigationtoensureresolutionismaintained.
Reviewhowcorrectiveactionplansaretracked;
ReviewhowcorrectiveactionplansarereportedtoComplianceExecutiveCommittee
50
7.51
Ensureremedialeffortsareestablishedtoreduce
risk
Basedontheoutcomeoftheinvestigation;deficiencywasfixed,evidenceitwasfixed,thereare
otheritemstoreview(ex.Chargemaster)lookatthedownstreamimpact-employees,systemic
issues(beyonddisciplinaryaction)
Rootcauseanalysis
7.52
Conductrootcauseanalysistodetermineiffindings
needtobeaddressedinotherpartsofthe
organization
Auditdocumentation
7.53
Resolutionofinvestigations
Audit.Wasrootcauseresolved?
7.54
Accountability/Structure
Obtainalistofadhoccommitteesformedaroundspecificcomplianceissueoverthelast2years
Adherencetonon-retaliationpolicy
7.55
Monitoringhowthereporterfeelsabouthaving
reported
Interview
7.56
Ensureconfidentialityofinvestigationprocess
Surveyorfocusedgroups,interviewparticipantsininvestigations
7.57
Exitinterviewprocessqueriesforretaliation
Reviewofexitinterviewprocess
7.58
Culture:Retaliation
Surveys,interviews,exitinterviews.
• Isthereapolicystatementinnewemployeeorientation?
• Aretherecommunications?
• Doemployeesknowhowtoreportpotentialinstances?
• Doestheorganizationconductculturesurveys?
• Isthereapolicystatementregardingnoobstructionofinvestigation?
7.59
Adherencetonon-retaliationpolicy
Surveyparticipatesininvestigationtodetermineiftheyfeltorfearedretaliation
7.60
Substantiatedretaliation
Audit
GovernmentInquires/Investigations
51
7.61
Cooperatewithgovernmentinquiries/investigations
•
•
7.62
Strategicrelationshipwithregulators
Interviews.
• Isthereafocusedapproachtobuildingrelationshipswithregulators?
• Doesstaffseekoutregulatorsatconferences,etc.tobuildrelationships?
7.63
Mockpresentations
Documentationreview.Interviews.
• Doestheorganizationconductmockpresentations(e.g.,in-houseattorney“acts”as
governmententity?
• Compliancepresentsadisciplinepartofcomplianceprogramtoin-houseattorneyfor
his/herreviewandcomment.)
MonitoringResults
7.64
Validationthatinvestigationsarecomplete
Auditcreditreceivedforcooperation;
Readrecordsthatcontaingovernmentcorrespondencewithentity.Reviewandconfirm
appropriateresponsesweresubmittedonorbeforerequesteddate.
•
•
•
Auditing,documentationreview,interviewsafterinvestigationsarecomplete.
Isthereadocumented(3-6-9months)timingintervaltoassesswhether“actionhastraction?”
Isthereaprocesstogobackandprioritizeorverifythatplansorworkunitsarefollowing
throughonrecommendedactions?
Documentationreview.
Isthereananalysisofinvestigationstohelpinformfutureworkplans?
7.65
Reviewofinvestigationsinfutureworkplanning
•
•
7.66
Longtermeffectivenessofremedialmeasures
Audit-oneyearofremedialmeasureswhereactivemonitoringended6monthspriortovalidate
thatremediationstillinplace
7.67
Howlargerlessonscanbeconveyedtothe
organization
COcouldreviewannuallythereportstotheboardorbroadercommunicationstotheentire
organization;revieweducationontrendsandthemes.
AwarenessofInvestigationProcess
7.68
Educationoninvestigationsprocess
7.69
Strategicrelationshipwithriskpartners(i.e.,Legal,
HR,riskmanagement,etc.)
•
•
Audit,monitortrainingrecordsandeducationalcontent.
Istrainingregardingtheinvestigationsprocessprovidedathireandongoingsoemployees
knowwhattoexpectregardingtheinvestigationsprocess?
Interviewriskpartnerstodetermineinteraction,involvement,knowledge.
52
ContractProvisionsregardingInvestigations
7.70
Thirdpartyandnon-employedcliniciancontractsto
ensuretheyhaveanobligationtocooperatein
investigations.
7.71
Inventoryofrequirementsincontracts
• Contractreview.
• Inventoryofagreementswith3rdpartiesandnon-employedclinicianstomakesurethey
understandtheirobligationtocooperatewithinvestigations.
Audit.Documentreview.Aretherestandardtermsthatmustbeincludedincontracts?A
templatecanbeusedtoensureallrequirementsareincontracts.
53