Complete Healthcare Compliance Manual

Why Conduct Compliance Risk Assessments?

For the compliance professional, the risk assessment is both the foundation upon which the program is built and the lens through which it can be evaluated on an ongoing basis. As a fundamental tenant, an organization cannot design an effective compliance and ethics program without first thoroughly identifying the laws and related standards with which it must comply. Moreover, periodic compliance risk assessments enable the organization to establish priorities that permit the most targeted and efficient use of compliance program resources.

Benefits of a compliance risk assessment include:

• Providing an early warning process for detecting compliance and ethics threats

• Mitigating and controlling identified problem areas, rather than having them discovered first by regulators, investors, potential acquirers, buyers, the media, or potential plaintiffs

• Prioritizing compliance and ethical risks and strengthening related existing controls; or developing of new controls to mitigate priority risks

• Revising ethics and compliance policies, training, auditing, and initiatives that require attention

• Improving decision-making by providing managers with critical information on compliance risks, as well as mitigation and control strategies

• Demonstrating to regulators a proactive approach to compliance and thereby meeting a due diligence element of an effective compliance and ethics program

The U.S. Federal Sentencing Guidelines (FSGO) explicitly include risk assessment within the definition of an effective compliance program. Although commentators believed that the importance of performing a risk assessment was already implicit in the original definition of an effective program, the Advisory Group appointed by the U.S. Sentencing Commission intended to make clear that: “risk assessments need to be made at all stages of the development, testing, and implementation of a compliance program to ensure that compliance efforts are properly focused and effective.”^[11]

Thus, to obtain the benefit or credit for an effective compliance program (and the reduction in the organization’s culpability score) the revised U.S. Federal Sentencing Guidelines mandate the performance of periodic risk assessments in order for the program to be considered effective. Specifically, the amended guidelines state that: “The organization shall periodically assess the risk of criminal conduct and shall take appropriate steps to design, implement, or modify each (of the components of an effective compliance and ethics program) to reduce the risk of criminal conduct identified through this process.”^[12]

Additionally, the guidelines comment that organizations must: “Prioritize periodically the elements of the program in order to focus on preventing and detecting the criminal conduct identified in the risk assessment process as most likely to occur.”^[13]

These provisions in the guidelines put forth the foundational insights for the performance of the well-designed compliance risk assessment. A well-designed risk assessment often precedes all other steps in the establishment of the compliance program to help assure that program efforts are properly focused. How would you know what policies, training, auditing, etc., are needed without an assessment of the compliance risks? Further, while a risk assessment is a good starting point, it clearly is not a one-time event and must be conducted periodically as a comprehensive assessment in order for the program to adapt to changing business and regulatory conditions. The frequency of comprehensive risk assessments is determined in part by risks the organization is managing, but in practice should be conducted on an annual basis.

Proactive organizations will try to undergo risk assessment activities before an organization sets its budget, so that funding decisions can be driven in part by needed risk-mitigation strategies. In order for the program to remain effective, the risk assessment must then be integrated into the organization’s overall compliance program and company processes on an ongoing basis. This may sometimes mean interim or focused risk assessments to evaluate the effect of mitigation strategies and to assure accurate, ongoing measurement of organizational risk.

The U.S. Department of Health & Human Services (HHS) Officer of Inspector General (OIG) developed a series of documents outlining compliance program requirements aimed at numerous entities supporting the healthcare and delivery system, which were modeled after the FSG. As an example, among other compliance program elements, the Centers for Medicare & Medicaid Services (CMS) requires organizations offering Medicare Advantage (MA) and/or Part D benefits to establish and implement an effective system for routine monitoring and identification of compliance risks.^[14] Subregulatory guidance requires policies and procedures to conduct a formal baseline assessment of major compliance and fraud, waste, and abuse risk areas, such as through a risk assessment. The assessment has to take all Medicare business operational areas into account. Each operational area or department must be assessed for the types and levels of risks the business operations presents to the Medicare program, and to the organization.

Responding to the question of “how” to do an assessment can be more of a challenge. The agency does not specifically outline how an organization must conduct the assessment. However, suggestions are made by CMS regarding the factors for considering risks, such as size of the department, complexity of the activities conducted, and past compliance issues. Additional factors can and should be included, based on an organization’s past experience and the knowledge of the experience of other organizations in similar business within its industry. Armed with a range of factors, an organization may estimate organizational compliance risks using a wider lens. These factors include:

• Beneficiary impact: How do the operational area’s activities impact the health, wellness, and finances of Medicare beneficiaries and Medicaid recipients?

• Experience of the staff: Has an operational area experienced recent or significant turnover? Has a change in management or other restructuring occurred in the last 12 months?

• Division responsibilities: Does the operational area work on the Medicare line of business only or on other lines subject to different regulations, such as Federal Employees Health Benefit Program, marketplace plans, and/or Medicaid?

• Vendor support: Is an operational function shared with or supported by a vendor? Is the function performed entirely by a vendor?

• Enrollment growth: Has recent enrollment growth affected an area’s ability to perform its function?

• Agency audit protocol: Is the operational area a focus in the most recently published government audit protocol?

Scope of the Assessments

A strict reading of the U.S. Federal Sentencing Guidelines would appear to limit the focus of the risk assessment to possible “criminal” conduct. The commentary to the amended guidelines states that the organization should identify the criminal conduct that might occur considering “the nature of the organization’s business.”^[15] The organization is to further consider "the prior history of the organization” and the legal violations highlighted by government regulations.^[16]

Although the guidelines focus on criminal conduct, most organizations take the prudent view that a broader range of compliance and ethics risks must be examined, including those that affect civil liability, regulatory exposure, business ethics or conduct, and the organization’s reputation.^[17] Essentially, a key step in conducting the compliance risk assessment will be establishing a working definition and shared understanding in the organization of what constitutes a compliance risk.

Extending the risk assessment beyond exposure to criminal conduct is essential, as legal mandates can be ambiguous and cumbersome, especially in highly regulated industries. When employees understand how the company’s ethical values apply in gray areas, they are more likely to align their behavior in an appropriate manner.

Examining ethical factors and reputational impacts can demonstrate the organization’s commitment to ethical business conduct by providing support and guidance when employees are unsure what to do. By emphasizing the commitment to ethics as well as technical compliance, the organization is affirming that how business is conducted is just as important as the business itself. Such an approach is further supported by the U.S. Federal Sentencing Guidelines’ emphasis, when the guidelines were amended in 2004, on the importance of promoting “an organizational culture that encourages ethical conduct and a commitment to compliance with the law.”^[18]

A compliance risk assessment should therefore, at a minimum, involve the assessment of information concerning risks of:

• Criminal misconduct

• Legal liability arising from failure to adhere to legal and regulatory requirements (both civil and criminal)

• Ethical lapse

• Reputational harm

Enterprise Risk Management (ERM) Initiatives and Other Risk Assessments

Compliance risk assessments, when performed from a compliance and ethics perspective, do not delve into the full range of business and operational risks of an organization. But as noted, risk management has taken on more importance in the corporate environment, spurring more risk assessment-type activities across organizations. The compliance and ethics professional should be cognizant of other risk assessment initiatives that may be taking place within the organization.

Following on from Sarbanes-Oxley regulations, many elements of risk assessment such as compliance and internal controls, regular risk assessments, along with the ranking and mapping of findings and results began taking place within various business functions. This encouraged business functions, each with its own business function owner (e.g., manager), to evaluate its specific risks and contribute to a comprehensive understanding of the organization’s overall risk profile.

Because compliance risks touch so many areas of the enterprise, organizations should consider integrating when possible the compliance risk assessment into an existing enterprise risk management process. Studies have suggested that while formal risk assessments have become common, companies initially did not undertake them in an integrated manner, and when they did so, did not address compliance- and ethics-related risks in adequate depth.^[20]

One obvious benefit of an integrated approach is consistency and uniformity with respect to terminology, criteria, process, and the risk information that is collected. When risk assessments are conducted separately by different business units, the use of different frameworks can result in the need and cost for reconciling the information collected across the organization. Integration can lead to a better quality of risk-based information upon which strategic and tactical decisions are based.

Integrating the compliance risk assessment with other business processes can enhance its outcomes and observations, given that ethics and compliance concerns as a practical matter filter into every department and operation. Conducting enterprise-wide compliance and ethics risk assessments in conjunction with financial auditing, manufacturing, marketing, sales, IT, and other business functions, ensures that a more complete range of risks is identified and correlated to ethics and compliance concerns.

Other advantages to a holistic enterprise risk assessment and management approach include:

• Efficiencies gained as risk issues and operational processes often overlap.

• More effective mitigation strategies can be developed if process interdependencies are understood.

• A comprehensive view of risks that face the organization and therefore, a resulting comprehensive prioritization of mitigation and management controls to address the key risks identified.

An integrated approach can also foster an organizational culture that ethics and compliance is central to an organization’s activities, rather than as a stand-alone program that may be perceived as outside of mainstream organizational concerns (sometimes referred to as a “siloed program”).

There are some operational shortcomings to be aware of and correct for when blending the compliance and ethics risk assessment into a broader enterprise- wide effort:

• Compliance and ethical risks may not be as obvious as operational risks and therefore may receive less attention from the majority of those involved.

• Evaluation of compliance risks utilizing the same metrics used for evaluation of business risks may be misleading and should be carefully considered as a combined risk assessment is conducted. For example, the financial exposure resulting from failure to properly manage a legal or regulatory requirement may be outstripped by the reputational damaged caused by the failure. The compliance professional should assure that these differences are understood and accounted for in context of an enterprise approach to risk assessment and management.

• Involvement by the compliance unit in an enterprise assessment led by the risk department may require more time, participation, and resources from program staff than when driving the assessment from purely a compliance and ethics perspective.