By John H. Fisher II
May 24, 2019
How Are Compliance Budgeting and Compliance Officer Autonomy Tied Together When Assessing Compliance Effectiveness?
The Department of Justice (“DOJ”)’s compliance program evaluation identifies the need to allocate sufficient revenues to the compliance program as one of the key issues that indicates compliance program effectiveness. The issue of resource allocation has been identified since the early days of systematic compliance programs but has emerged as perhaps one of the most crucial factors supporting compliance effectiveness as the compliance industry has matured.
It is both interesting and revealing that the DOJ chose to combine resource allocation with the importance of compliance officer autonomy in one section. In my opinion, these two issues are necessarily intertwined. It is no secret the Compliance Officer is often not the most popular kid on the block. A compliance officer is often in the position of having to investigate and confront others with potential compliance violations. Relatively recent emphasis on the need to identify individual wrongdoing accentuates the compliance officer’s organizational role.
Since the earliest days of organized compliance, the need for the compliance officer is to be a high-level member of management with direct reporting to the board of directors. The reason for this is the compliance officer needs to have the authority and autonomy to address compliance issues, no matter who is involved or how high up in the organization they go. The requirement that the compliance officer have high stature within the organization has taken on new importance as a factor indicating effectiveness as compliance has matured as an industry.
Combining the issues of resource allocation and compliance officer authority and autonomy recognizes the importance of funding in assuring compliance independence. A compliance officer cannot be truly independent, that is not independent enough to take on even the upper levels of management where necessary, if he or she is reliant on others within the organization for funds necessary to maintain an effective compliance program. In order to appropriately support the compliance officer, there needs to be a designated budget allocated to the compliance office. The compliance officer is accountable for establishing the budget and justifying its need to the board, but cannot be in the position of having to beg and steal from other budget areas to support the compliance function.
- sufficient seniority within the organization;
- sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and
- sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.
Selling the Necessary Evil of Compliance Resource Allocation
Compliance budgeting is perhaps the most difficult issue that a compliance officer will address. Compliance is often seen as a huge cost center. The benefit and returns on investment in compliance activities is difficult for business-minded executives to understand. Amounts allocated to the compliance function do not result in the development of new programs, new facilities, or enhanced operations. Management may view compliance as a necessary evil that allocates resources away from program expansion or patient care. The effort required to maintain legal and regulatory compliance is a source of great frustration in the industry and legitimate questions can be asked about the necessity of a lot of the regulatory requirements that providers face.
The return on compliance related investment is not readily ascertainable. A compliance officer may attempt to support the case for compliance budgeting by demonstrating various compliance “horror stories.” Until the horror stories actually occur, it is easy to view them as works of fiction rather than compliance fact. The problem is that once a serious compliance issue emerges, if the provider has not taken steps to assure the effectiveness of their compliance program, the horror story very quickly becomes a shocking and often devastating reality.
Compliance Budgeting – How Much is Enough?
The requirement that sufficient resources be allocated to compliance begs the question as to the level of resources required to indicate compliance effectiveness. There is a recognition that concepts of scalability are relevant. Smaller organizations simply will not have the same level of resources available to finance compliance operations. In most cases the risk profile of a smaller organization will also be more limited than larger, more comprehensive organizations.
There is no magic answer to issues of scalability and sufficiency of a compliance budget. There is no baseline standard of percentage of revenues or other objective factor indicating sufficiency. The DOJ guidance gives us some factors that might impact the sufficiency issue stating the “sufficiency of each factors, however, will depend on the size, structure, and risk profile of the particular company.” A large organization will generally need to devote greater resources than a small organization. By contrast, “a small organization may [rely on] less formality and fewer resources.” There is not a whole lot more guidance to be found on the scalability and resource sufficiency issues.
Unfortunately, we are left to use common sense when determining the amount budgeted to the compliance function. There are certain core issues that need to be part of every compliance program. The seven basic compliance elements must always be present. No one gets a pass on the need to appoint a compliance officer, establish the seven elements of compliance, engage in risk identification to identify the risks present in the specific business, and take actions to reduce risk and address risk when it arises.
The bottom line is regardless of the size of your organization, your compliance program needs to be effective in identifying your risk profile, prioritizing your auditing and remediation activities, and continually operating to address and reduce organizational risk. Smaller organizations will normally have a narrower risk profile and will require less resources to proactively address those areas of risk that are determined to be the most critical.
It is important the compliance budget be a separate line item and not piecemealed from various programs and areas within the organization. The compliance officer should have direct access to budgeted amounts. This assures the compliance officer is autonomous and does not need to rely on allocations or approvals within the parameters of the compliance budget. The compliance officer should be accountable for expenditures that are made, but should not feel restricted from incurring legitimate expenditures.
The budgeting process should ideally be tied to the compliance work plan. It does little good to create a work plan only to have it underfunded. Different stages of compliance development need to be considered when assessing budgetary needs. An organization that does not have a long history of auditing, risk assessment, or other compliance operations needs to account for the sudden rush of compliance issues are likely to arise once a more robust risk assessment and auditing process commences. Organizations that might have lagged in the development of a compliance program will need to factor in “catch-up” expenses needed to build out the compliance function to a sufficient level of effectiveness.
In order to permit the board to rely on professional support, the expertise available to the board should have background and experience in the regulated area. For example, a health care organization should budget for availability of health law and compliance expertise to support operation of the compliance program and to assure the board has competent advice in applicable regulatory areas. This can create challenges to mid-sized organizations that have relatively broad and complex legal and regulatory issues yet are subject to tight budgetary restrictions. These organizations may consider legal counsel that does not have health law experience in order to reduce the legal budget. If legal counsel does not have health law expertise that reliance may not be reasonable. If inexperienced advice results in an organization getting crossways with regulators, the board may not be able to rely on advice of counsel in defense of the proper exercise of its oversight duties.
The DOJ guidance in this area resolves with various questions that prosecutors should ask to verify the compliance office is appropriately funded and the compliance officer has sufficient authority and autonomy to support a finding of compliance effectiveness. The DOJ guidance directs prosecutors to answer a number of questions when assessing compliance program effectiveness. Companies are well advised to consider these same questions when assessing their own compliance efforts. The guidance in the area of budgeting and compliance officer authority resolves with some basic questions prosecutors are directed to ask. I am taking these questions almost directly from the guidance document.
To whom does the compliance function report?
Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company?
Are compliance personnel dedicated to compliance responsibilities, or do they have other, non-compliance responsibilities within the company?
Why has the company chosen the compliance structure it has in place?
Seniority and Stature –
How does the compliance function compare with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers?
What has been the turnover rate for compliance and relevant control function personnel?
What role has compliance played in the company’s strategic and operational decisions?
How has the company responded to specific instances where compliance raised concerns?
Have there been transactions or deals that were stopped, modified, or further scrutinized as a result of compliance concerns?
Experience and Qualifications –
Do compliance and control personnel have the appropriate experience and qualifications for their roles and responsibilities?
Has the level of experience and qualifications in these roles changed over time?
Who reviews the performance of the compliance function and what is the review process?
Funding and Resources –
Has there been sufficient staffing for compliance personnel to effectively audit, document, analyze, and act on the results of the compliance efforts?
Has the company allocated sufficient funds for the same? Have there been times when requests for resources by compliance and control functions have been denied, and if so, on what grounds?
Do the compliance and relevant control functions have direct reporting lines to anyone on the board of directors and/or audit committee?
How often do they meet with directors?
Are members of the senior management present for these meetings?
How does the company ensure the independence of the compliance and control personnel?
Companies should design and operate their compliance programs under the assumption they will someday be in a position that requires them to affirmatively prove it is operated effectively. That situation is likely to occur in the context of a potential False Claims Act case or Fraud and Abuse prosecution where the company needs to assert that its compliance program is effective in order to receive cooperation credit or avoid imputation of knowledge that would result in assessment of the draconian damage assessments under the Federal False Claims Act. In those situations, the stakes will be high and regulators may not be receptive to arguments that scalability factors should be considered to save an under-funded compliance program. Without an adequate, segregated compliance budget, it is very difficult to make a case for effectiveness of a compliance process.
The content in the following blog posts is based upon the state of the law at the time of its original publication. As legal developments change quickly, the content in these blog posts may not remain accurate as laws change over time. None of the information contained in these publications is intended as legal advice or opinion relative to specific matters, facts, situations, or issues. You should not act upon the information in these blog posts without discussing your specific situation with legal counsel.
© 2020 Ruder Ware, L.L.S.C. Accurate reproduction with acknowledgment granted. All rights reserved.