The Essence of Compliance – Compliance Officer Authority and Resource Allocation

By
May 24, 2019

How Are Compliance Budgeting and Compliance Officer Autonomy Tied Together When Assessing Compliance Effectiveness?
The Department of Justice (“DOJ”)’s compliance program evaluation identifies the need to allocate sufficient revenues to the compliance program as one of the key issues that indicates compliance program effectiveness.  The issue of resource allocation has been identified since the early days of systematic compliance programs but has emerged as perhaps one of the most crucial factors supporting compliance effectiveness as the compliance industry has matured.

It is both interesting and revealing that the DOJ chose to combine resource allocation with the importance of compliance officer autonomy in one section.  In my opinion, these two issues are necessarily intertwined.  It is no secret the Compliance Officer is often not the most popular kid on the block.  A compliance officer is often in the position of having to investigate and confront others with potential compliance violations.  Relatively recent emphasis on the need to identify individual wrongdoing accentuates the compliance officer’s organizational role.

Compliance Officer Authority and Autonomy – Central Effectiveness Element
The compliance officer needs to have the strength and authority to stand ground where necessary.  Failing to appropriately fund the compliance office is a structural flaw in compliance design that almost conclusively establishes a compliance program is not effective.  Some organizations take further steps to assure compliance officer autonomy such as guaranteeing the compliance officer a term of employment or providing the compliance officer with a guaranteed payment for terminations or resignations tied to compliance issues.  The bottom line is the compliance officer cannot be inhibited by the potential loss of employment, pulling of funds, or other actions that impede the ability to take compliance issues wherever they lead in the organization.

Since the earliest days of organized compliance, the need for the compliance officer is to be a high-level member of management with direct reporting to the board of directors.  The reason for this is the compliance officer needs to have the authority and autonomy to address compliance issues, no matter who is involved or how high up in the organization they go.  The requirement that the compliance officer have high stature within the organization has taken on new importance as a factor indicating effectiveness as compliance has matured as an industry.

The Relationship Between Resource Allocation and Compliance Officer Autonomy
Combining the issues of resource allocation and compliance officer authority and autonomy recognizes the importance of funding in assuring compliance independence.  A compliance officer cannot be truly independent, that is not independent enough to take on even the upper levels of management where necessary, if he or she is reliant on others within the organization for funds necessary to maintain an effective compliance program.  In order to appropriately support the compliance officer, there needs to be a designated budget allocated to the compliance office.  The compliance officer is accountable for establishing the budget and justifying its need to the board, but cannot be in the position of having to beg and steal from other budget areas to support the compliance function. 

DOJ Guidelines Emphasis on Resource Allocation and Compliance Officer Autonomy
The DOJ guidelines emphasize the need for compliance autonomy and the relationship to resource allocation.  Prosecutors are directed to “address the sufficiency of the personnel and resources within the compliance function, in particular, whether those responsible for compliance have:
  1. sufficient seniority within the organization;
  2. sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and
  3. sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.

Selling the Necessary Evil of Compliance Resource Allocation
Compliance budgeting is perhaps the most difficult issue that a compliance officer will address.  Compliance is often seen as a huge cost center.  The benefit and returns on investment in compliance activities is difficult for business-minded executives to understand.  Amounts allocated to the compliance function do not result in the development of new programs, new facilities, or enhanced operations. Management may view compliance as a necessary evil that allocates resources away from program expansion or patient care.  The effort required to maintain legal and regulatory compliance is a source of great frustration in the industry and legitimate questions can be asked about the necessity of a lot of the regulatory requirements that providers face.

The return on compliance related investment is not readily ascertainable.  A compliance officer may attempt to support the case for compliance budgeting by demonstrating various compliance “horror stories.”  Until the horror stories actually occur, it is easy to view them as works of fiction rather than compliance fact.  The problem is that once a serious compliance issue emerges, if the provider has not taken steps to assure the effectiveness of their compliance program, the horror story very quickly becomes a shocking and often devastating reality.

Compliance Budgeting – How Much is Enough?
The requirement that sufficient resources be allocated to compliance begs the question as to the level of resources required to indicate compliance effectiveness.  There is a recognition that concepts of scalability are relevant.  Smaller organizations simply will not have the same level of resources available to finance compliance operations.  In most cases the risk profile of a smaller organization will also be more limited than larger, more comprehensive organizations.

There is no magic answer to issues of scalability and sufficiency of a compliance budget. There is no baseline standard of percentage of revenues or other objective factor indicating sufficiency.  The DOJ guidance gives us some factors that might impact the sufficiency issue stating the “sufficiency of each factors, however, will depend on the size, structure, and risk profile of the particular company.” A large organization will generally need to devote greater resources than a small organization. By contrast, “a small organization may [rely on] less formality and fewer resources.”  There is not a whole lot more guidance to be found on the scalability and resource sufficiency issues.

Organizations such as the Health Care Compliance Association publish survey results on a variety of compliance issues including compliance budgeting.  The information provided in HCCA surveys is certainly helpful, yet it does not really indicate any hard and fast rules.  It does give us some limited insight into what other organizations of varying sizes acknowledge spending on compliance.  But there are no uniform standards used in the HCCA survey to indicate response parameters.  For example, it is not clear whether the compliance budget included the cost of dealing with compliance incidents, self-disclosure and investigations, or whether reported compliance resources is limited to amounts expended on the operation of the compliance program and the risk identification process.  Likewise, it is not clear whether legal expenses directly related to compliance program support are included in amounts reported.  If the overall legal budget is low and special expertise is required to support the compliance function, it makes sense that compliance-related legal fees should be an “add-on” to the compliance budget.

Unfortunately, we are left to use common sense when determining the amount budgeted to the compliance function.  There are certain core issues that need to be part of every compliance program.  The seven basic compliance elements must always be present.  No one gets a pass on the need to appoint a compliance officer, establish the seven elements of compliance, engage in risk identification to identify the risks present in the specific business, and take actions to reduce risk and address risk when it arises.

The Danger of Over-reliance on Compliance Scalability
There is a danger, particularly for mid-size organizations, to rely too heavily on scalability to govern compliance budgeting.  Compliance issues that arise will tend to fall outside the monitoring activities identified through the risk assessment process.  This leaves the organization in the position of having to justify not having addressed a risk area in which a compliance incident has occurred.  Avoidance of the incident, or even self-identification and self-disclosure, is a much better position to be in than having an incident brought to your attention by a governmental enforcement agency or a whistleblower.  Anything that leaves you open to the realization of a risk area leaves you vulnerable.  You can almost count on the occurrence of a compliance issue if you routinely “short” the compliance process; even if you do because you feel you are a smaller organization and can rely on scalability to protect you.  I can tell you, it does not work that way.  A serious compliance issue is a problem, a big problem, if you do not find it yourself.  Guidelines can mention issues of scalability all they want, but you will be under the gun, regardless of your size, if a serious compliance issue is raised externally.

The bottom line is regardless of the size of your organization, your compliance program needs to be effective in identifying your risk profile, prioritizing your auditing and remediation activities, and continually operating to address and reduce organizational risk.  Smaller organizations will normally have a narrower risk profile and will require less resources to proactively address those areas of risk that are determined to be the most critical.

Separation of the Compliance Budget and Access by the Compliance Officer
It is important the compliance budget be a separate line item and not piecemealed from various programs and areas within the organization.  The compliance officer should have direct access to budgeted amounts.  This assures the compliance officer is autonomous and does not need to rely on allocations or approvals within the parameters of the compliance budget.  The compliance officer should be accountable for expenditures that are made, but should not feel restricted from incurring legitimate expenditures.

The budgeting process should ideally be tied to the compliance work plan.  It does little good to create a work plan only to have it underfunded.  Different stages of compliance development need to be considered when assessing budgetary needs.  An organization that does not have a long history of auditing, risk assessment, or other compliance operations needs to account for the sudden rush of compliance issues are likely to arise once a more robust risk assessment and auditing process commences.  Organizations that might have lagged in the development of a compliance program will need to factor in “catch-up” expenses needed to build out the compliance function to a sufficient level of effectiveness.

Budgetary Support for Board Reliance on Expert Support
A compliance budget should also allocate sufficient revenues to assure the board of directors has available the expertise needed to address the legal and regulatory areas that create compliance risk.  Prosecutors are directed to consider “[t]he resources the company has dedicated to compliance,” “[t]he quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk,” and “[t]he authority and independence of the compliance function and the availability of compliance expertise to the board.”

In order to permit the board to rely on professional support, the expertise available to the board should have background and experience in the regulated area.  For example, a health care organization should budget for availability of health law and compliance expertise to support operation of the compliance program and to assure the board has competent advice in applicable regulatory areas.  This can create challenges to mid-sized organizations that have relatively broad and complex legal and regulatory issues yet are subject to tight budgetary restrictions.  These organizations may consider legal counsel that does not have health law experience in order to reduce the legal budget.  If legal counsel does not have health law expertise that reliance may not be reasonable.  If inexperienced advice results in an organization getting crossways with regulators, the board may not be able to rely on advice of counsel in defense of the proper exercise of its oversight duties.

Questions for Prosecutors in the Area of Compliance Budgeting and Compliance Officer Authority and Autonomy
The DOJ guidance in this area resolves with various questions that prosecutors should ask to verify the compliance office is appropriately funded and the compliance officer has sufficient authority and autonomy to support a finding of compliance effectiveness.  The DOJ guidance directs prosecutors to answer a number of questions when assessing compliance program effectiveness.  Companies are well advised to consider these same questions when assessing their own compliance efforts.  The guidance in the area of budgeting and compliance officer authority resolves with some basic questions prosecutors are directed to ask.  I am taking these questions almost directly from the guidance document.

Structure –
Where within the company is the compliance function housed (e.g., within the legal department, under a business function, or as an independent function reporting to the CEO and/or board)?

To whom does the compliance function report?

Is the compliance function run by a designated chief compliance officer, or another executive within the company, and does that person have other roles within the company?

Are compliance personnel dedicated to compliance responsibilities, or do they have other, non-compliance responsibilities within the company?

Why has the company chosen the compliance structure it has in place?

Seniority and Stature –

How does the compliance function compare with other strategic functions in the company in terms of stature, compensation levels, rank/title, reporting line, resources, and access to key decision-makers?

What has been the turnover rate for compliance and relevant control function personnel?

What role has compliance played in the company’s strategic and operational decisions?

How has the company responded to specific instances where compliance raised concerns?

Have there been transactions or deals that were stopped, modified, or further scrutinized as a result of compliance concerns?

Experience and Qualifications –

Do compliance and control personnel have the appropriate experience and qualifications for their roles and responsibilities?

Has the level of experience and qualifications in these roles changed over time?

Who reviews the performance of the compliance function and what is the review process?

Funding and Resources –

Has there been sufficient staffing for compliance personnel to effectively audit, document, analyze, and act on the results of the compliance efforts?

Has the company allocated sufficient funds for the same?  Have there been times when requests for resources by compliance and control functions have been denied, and if so, on what grounds?

Autonomy –

Do the compliance and relevant control functions have direct reporting lines to anyone on the board of directors and/or audit committee?

How often do they meet with directors?

Are members of the senior management present for these meetings?

How does the company ensure the independence of the compliance and control personnel?

Conclusion
Companies should design and operate their compliance programs under the assumption they will someday be in a position that requires them to affirmatively prove it is operated effectively.  That situation is likely to occur in the context of a potential False Claims Act case or Fraud and Abuse prosecution where the company needs to assert that its compliance program is effective in order to receive cooperation credit or avoid imputation of knowledge that would result in assessment of the draconian damage assessments under the Federal False Claims Act.  In those situations, the stakes will be high and regulators may not be receptive to arguments that scalability factors should be considered to save an under-funded compliance program.  Without an adequate, segregated compliance budget, it is very difficult to make a case for effectiveness of a compliance process.

Back to all News & Insights

Disclaimer

The content in the following blog posts is based upon the state of the law at the time of its original publication. As legal developments change quickly, the content in these blog posts may not remain accurate as laws change over time. None of the information contained in these publications is intended as legal advice or opinion relative to specific matters, facts, situations, or issues. You should not act upon the information in these blog posts without discussing your specific situation with legal counsel.

© 2024 Ruder Ware, L.L.S.C. Accurate reproduction with acknowledgment granted. All rights reserved.