Audit functions

As compliance leaders we must take a hard look at our audit functions. We should be aware of the organization’s risks, although, at times, this may be difficult if you are not at the table when decisions are being made.

It is imperative we are not afraid to ask the hard questions and dig into the operations in order to identify those true organizational risks. Over the years, I have been put in many situations where decisions have been made that have compliance implications, and I was not aware of them until they were mentioned off the cuff at a meeting or in conversation. In one instance, I was at a board meeting, and the chief medical officer (CMO) was talking about physicians who were leasing space in the hospital. Just on the off-chance legal didn’t know, I decided to mention it and, lo and behold, there were no lease agreements in place. Furthermore, after some research, it was discovered that there was no rent being collected. If I hadn’t been invited to the meeting and if I hadn’t been willing to ask questions, we would have never known this risk was out there. This is a great example of knowing your risks before you develop an audit plan.

We must also guarantee we have adequate resources in place to carry out any audit plan. I am fortunate that my organization is well aware of the importance of human and financial resources, and my CEO encourages me to let him know when I need to add these resources. However, unfortunately, I have been in opposite situations where the internal audit staff are the first to be cut when layoffs occur. This leaves the department short-handed and unable to carry out the audit plan, and it causes us to use more expensive alternative resources when we put out the fires.

As compliance officers, one of our most important obligations is to be sure the audit functions are reviewed often and discussed honestly with senior leadership!

Program structure

The guidance also addresses the need for high-level oversight. However, this fact does not stop organizations from ignoring the importance of this function. I was working for an organization as the compliance officer with a reporting line directly to the CEO. I had worked there for more than a year and never met the CEO. At another organization where I was the compliance officer, I reported up to general counsel and to the individual hospital boards but not to the corporate board or leadership (where most of the decisions were being made). Finally, at another organization, I had a direct line to the CEO, reported to the CFO operationally, but never met with the board and was not part of the senior leadership team. These examples left me unaware of key organizational decisions that affected how I did my job, leaving me dealing with compliance concerns after the fact.

Another key area that program structure can affect is the perception of authority. The compliance officer must be perceived as important and authoritative by all employees, including the senior leadership team. The staff must believe that, if they report something to the compliance officer, he/she has enough authority to effect necessary change. Additionally, if the compliance officer identifies an issue, they should have the authority to implement corrective action with support from the leaders within the organization.

Compliance should not fall too far down on the organizational chart and, at the very least, should be staffed at a director level. However, I believe that it is even more effective to have the position on the same organizational hierarchy as the CFO, general counsel, CMO, and chief nursing officer. This position should ideally report directly to the CEO or president and the board of directors when needed.

Additionally, organizations should look at the qualifications of the compliance officer and should ensure that salary is on par with others in leadership positions and commensurate with experience.

Resources

Compliance programs should be adequately staffed with the appropriate people for the organization. Although a robust compliance staff is the gold standard, compliance can borrow staff from other departments if needed, especially if the organization is small or has limited financial resources. Some examples of borrowed staff include:

• Revenue integrity auditors

• Coding auditors who work in the health information management department

• Denials management specialists

• Quality assurance and risk management staff

• Security officer and information technology staff

If financial resources are available, the staff should be adequate to address the risks and work plan items. It is also an institutional decision on the structure of the staff and having the following on staff:

• A Health Insurance Portability and Accountability Act (HIPAA) privacy expert

• An expert in Stark Law and Anti-Kickback Statute rules

• Staff who handle employee concerns

• Coding and billing auditors

• Internal auditor or someone who specializes in financial and information technology audits

• Compliance investigators/auditor

Reporting structure

The compliance officer must be able to approach the board of directors without any impediments. Often those who sit in high positions are the ones who are noncompliant, and the infractions must be reported to the board. If the compliance officer is unable to directly report these infractions, they will never be addressed.

Additionally, the compliance officer is at a disadvantage if they are unaware of decisions being made, especially if the decisions have compliance implications, which leads to reactive instead of proactive responses. Typically, this happens when leadership does not want to be told “no.” It is the responsibility of compliance to work with leadership to find ways to say “yes” compliantly. Be creative, think outside the box, don’t just say no. The compliance officer who preceded me at one organization used to tell the staff to write down their requests so he could just say no. We will be invited to participate more often in the discussion if we can stop being viewed as the police and start working with leadership.

Conclusions

The key takeaways include:

• Make sure there is high-level buy-in and support in order to ensure adequate staffing and precise risk assessment.

• Confirm department staffing is adequate and the quality of the staff is appropriate for the job.

• Guarantee the tone of the department is collaborative and nonauthoritative.

• Encourage leadership to put compliance at the top of the organizational chart, thereby giving staff the assurance that the compliance officer has authority to facilitate change.

• The compliance officer and staff must not be the ones to always say no. Be creative and find ways to say yes. Encourage leaders to seek you out, not shut you out!

Takeaways

• Encourage high-level buy-in by getting an invite to the table.

• Act in a collaborative manner so that compliance does not appear to be confrontational.

• Ensure the compliance officer has appropriate authority and can effect change.

• Guarantee the staffing size is adequate and the qualifications meet job expectations.

• Encourage fair salary negotiations that assure that pay is commensurate with title and authority.