Auditing and monitoring processes are designed to identify issues and deficiencies. Corrective Action Plans (CAPs) are step-by-step plans designed and implemented to address and correct those issues or deficiencies, as well as facilitate ongoing compliance activities. CAPs may vary in complexity and scope depending upon the level of risk associated with the incident of noncompliance. Generally, however, CAPs follow six phases: identification, evaluation, root cause analysis, action plan development and implementation, and follow-up.
Identification: What Should Be Fixed?
The identification phase generally results from internal or external audits or notification from third-party payors. In many cases, outside regulators may not sufficiently identify the problem, and it may be necessary to collaborate with multiple departments or process owners to determine what actually went wrong. For example, significant payor denials may be caused by insufficient medical record documentation, faulty system edits, or a combination of inefficient billing processes. Additionally, internal and/or external counsel may need to be consulted to determine if the issue was the result of incorrectly interpreting regulatory guidance.
Evaluation: What Is the Consequence of Noncompliance?
Once an issue has been identified, the next phase involves analyzing the severity of the issue. For example, was it a one-time, easily corrected event? Or was it a systemic breakdown in processes, controls, or information systems? The extent to which the issue is prevalent throughout the organization will determine whether significant forensics should be performed or whether training will likely correct the issue. This phase will also inform the remaining phases regarding the cost of compliance versus noncompliance. Not every issue will require significant financial resources to remedy; however, an impact analysis on operations will still be required for each issue to design an appropriate CAP.
Root Cause Analysis: Why Did This Happen?
This phase is critical to the success of a CAP. If the organization does not know why the issue or error occurred in the first place, an effective CAP will not be created. As stated in DOJ’s 2020 Evaluation of Corporate Compliance Programs, “Finally, a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root cause.”[2]
The five whys method is a widely known process utilized to analyze in-depth the root cause of an issue. The goal of this method is to enable an organization to arrive at an actionable resolution to a problem. Both the “why” and “who” of an issue is critical in developing an effective CAP with defined accountability for implementation. Finally, root cause analysis categories are helpful in trending types of issues over time. Categories may include the following:
-
Ineffective policy or procedure
-
Human error
-
Noncompliance with policy or procedure
-
Insufficient training
-
Incorrect interpretation of regulation or law
For more on root cause analysis, see the next article in this chapter.