The Complete Compliance and Ethics Manual 2023

Ten Things to Include in Your Basic Compliance and Ethics Course

1. Information on the code of conduct

2. Your organization’s specific compliance and ethics philosophy

3. Employees’ obligation to report suspected noncompliance

4. Nonretaliation policy

5. Policies regarding confidentiality

6. Hotline and other compliance program contact information

7. Expectation that vendors will meet the same compliance and ethics standards as staff

8. Levels of discipline for employees involved in compliance and ethics violations

9. Expectation that all identified issues will be investigated by the compliance office in a timely manner

10. Proper retention of documents

General training sessions are meant to heighten awareness among all employees and communicate and emphasize (and then update and reiterate) the organization’s commitment to ethical business behavior, which affects all employees. The organization should designate in a policy the number of general compliance educational hours per year that each employee will be required to take. For a frame of reference, a minimum of one hour annually for basic training in compliance and ethics areas should be required for any compliance and ethics program. As noted earlier, all employees should receive a copy of the standards of conduct and the key compliance and ethics policies and procedures. These, plus basic information about the organization’s compliance and ethics program and how it operates, are the core of general training.

Examples of general education are:

• Ethics

• Code of conduct

• Hotline

• Employees obligation to report suspected issues of noncompliance

Specific/focused training in high-risk areas is critical for specialized personnel. These employees should be given general compliance and ethics training with an emphasis on compliance and ethics risk areas specific to these employees’ job functions. It may be more appropriate to provide this specific training, which goes above and beyond the general training, in the form of one-on-one or on-the-job training to ensure that compliance and ethics is integrated into the employee’s daily activities and doesn’t remain a theoretical concept.

Examples of focused/specific education are:

• General prohibitions on paying or receiving remuneration to induce business referrals

• Proper preparation of financial statements

• Proper preparation of truthful marketing and advertising materials

• Proper documentation of services rendered or items provided

• How to identify misconduct

A written annual education plan should outline what roles should be trained, what content they should be trained on, duration and timing, educational methods, etc. Include not only employees, managers, and leaders in your education plan, but also volunteers, vendors, contractors, board members, and other relevant members of your organization. In the education plan for specific departments, consider individual department content needs, timing, methods, duration of training, and a strategy for securing managerial buy-in. An uncooperative manager can directly or indirectly, consciously or unconsciously, deter staff from attending. The manager must emphasize the importance of training by encouraging employee attendance. That may mean juggling schedules or requiring others to “pick up the slack” during education sessions when a unit may be left shorthanded. Consulting with managers in advance about content needs, and especially timing issues, can prevent conflicting priorities later.

Adult learning styles vary. Some learn through listening, others through seeing, and many by doing. So, to keep education vital and engaging to a diversified staff, the key is to develop a variety of educational formats (e.g., videos, lectures, brown bag lunches, and roundtable discussions). Brown bag lunches and roundtable discussions can be especially effective for targeting a specific training need, and they can provide feedback to the trainers and ultimately to the compliance and ethics personnel as to what is going on in the departments. Your organization may already have various forums you can tap into, such as department meetings or all-staff meetings for targeted education. Look for ways compliance and ethics education can fit into the ways employees are being educated on other issues; integrate compliance and ethics into existing training so it blends with the fabric of the organization.

Ideas for Training Adult Learners

• Make it relevant

• Use real-life scenarios

• Encourage interaction

• Begin with the end in mind

• Teach to all types of adult learning styles

  • Those who learn through listening (use active repetition, songs, skits, etc.)

  • Those who learn through seeing (use handouts, videos, PowerPoint presentations, etc.)

  • Those who learn by doing (use hands-on projects, role-playing, etc.)

• Use resources wisely

• Live training may be most effective but unrealistic for very large organizations

• Use live training for orientation of new employees, new complex regulations, and remedial education

• Online training courses may not be perfectly tailored to an organization, but may still convey the general compliance concepts appropriately, track who has and has not been trained, and use resources more efficiently

• Provide longer, more intensive training sessions to employees in certain areas of responsibility and more general compliance and ethics training to all other employees

Should compliance and ethics education be voluntary or mandatory? At the end of general training, every employee, as well as contracted consultants, should be required to sign and date a statement that confirms their knowledge of and commitment to the standards of conduct. This attestation should be retained in the employee’s personnel file. If the organization decides to make the general compliance education mandatory, it should be enforced. Penalties for those that do not take the education should be communicated and enforced.

Sample Attestation/Acknowledgement Form

This is to acknowledge that I have received and reviewed Our Organization’s Code of Conduct. I agree to comply with the standards contained in the code and all related policies and procedures, as is expected as part of my continued employment or association with the organization. I acknowledge that the code is only a statement of principles for individual and business conduct and does not constitute an employment contract. I will report any potential violation of which I become aware promptly to my supervisor or the compliance officer. I understand that any violation of the code of conduct or any corporate compliance policy or procedures is grounds for disciplinary action, up to and including discharge from employment.

Date

Name (please print)

Signature

Ideally, educational opportunities should become more and more plentiful, easier to attend, and word will spread about their value. Ultimately, those who should attend will realize it will benefit them as well as the organization. While 100% attendance may be difficult to achieve, organizations should implement a policy and then hold employees accountable. A note or a personal call to a supervisor asking for support can be effective. Ultimately, the goal is to show improvement in educational attendance.

Other organizations take a harder line. For example, some organizations offer training free of charge for two months. During that time, educational sessions will be scheduled at practically any time, including nights, weekends, and holidays to best accommodate all employees’ schedules. For those who choose not to attend during the two-month window, their department will be billed $100 for the same training in subsequent months that would have been “free” to the department the previous two months. Moreover, scheduling of the make-up sessions is not as accommodating. In the fourth month, the charge continues to go up. This strategy can be very effective, but it requires the support of the executive staff and finance office.

The benefits of compliance and ethics education and training must be communicated from the top. Attendance by top management, especially at an annual basic program, sends a powerful message. If the CEO can make time, others will follow suit. Other incentives include multiple offerings at alternative times to facilitate attendance. Also, consider the time commitment involved. Everyone today is too busy. Explore with unit managers the pros and cons of two one-hour sessions versus one two-hour session, for example. Food, even simple fare such as donuts, however trite it may sound, does serve as an incentive. Achieving 100% attendance will never be easy. You will need to be creative to find ways to motivate voluntary attendance.

It should be clear by now that compliance cannot be a one-shot educational event. Your compliance and ethics committee can help in assessing the best approach for such issues as whether to make education mandatory or voluntary and how to structure education and training options within the organization. Again, your organization’s culture is the driving force. Education is your best strategy for prevention. The old adage still rings true: An ounce of prevention is worth a pound of cure. Remember to tend to your own educational needs as well. The more you know, the better you can identify and meet the educational needs of employees.

Risk Assessment

A compliance risk assessment will provide a broad baseline risk platform, a snapshot, or essentially a list of all the compliance risks that need mitigation. Management should be involved in identifying the organization’s risk. As previously discussed, performing risk assessments in collaboration with the compliance committee is a great way to leverage diverse perspectives and connect operational leaders and managers with risk mitigation. Once the risk matrix is developed, each risk should be scored as to level of risk for the organization, prioritized, and controls identified. The last step is to develop a work plan to assure that prioritized risks are mitigated.

It is suggested that you identify whether your organization already performs some type of risk assessment. Enterprise risk management (ERM) processes are common among most industries today. It can be beneficial to combine compliance and ethics risk assessment with your organization’s ERM or other type of risk assessment. If the ERM or risk assessment has not had a compliance and ethics component previously, you should conduct a risk assessment of compliance and ethics areas. If you are starting without the assistance of a current company-wide risk assessment, materials relating to ERM processes or risk assessments will be beneficial to you in developing a risk assessment methodology. There are also many vendors who will assist you in developing and performing your risk assessment.

There are certain risk areas common to many types of organizations that should be assessed:

• Contractual issues

• Financial reporting

• The Foreign Corrupt Practices Act

• Privacy

• Security

• Record retention

• Marketing

• Conflicts of interest

• Other

Other risk areas to be reviewed will depend on the type of organization. For example, publicly traded companies should have their financial statements and supporting worksheets audited regularly. Nonprofit organizations should monitor that their mission is being fulfilled and earmarked funds are being used appropriately. Government contractors should include the examination of whether illegal kickback arrangements have been entered into in their risk assessment. Food distributors should ensure that all Food and Drug Administration regulations are being met. Restaurants should monitor compliance with the Department of Health’s requirements. Any areas of risk previously identified either internally or by an outside agency should be looked at carefully and regularly.

The risks identified during your assessment will be used to formalize the components of your compliance and ethics program. The identified risks will also assist you in prioritizing your efforts toward an effective compliance and ethics program. It is suggested that you perform an overall risk assessment not just as a baseline or annually, but on an ongoing basis. The ongoing risk assessment will help you monitor the progress of your program (e.g., if a risk level is lowered year after year, your controls and program are effective), as well as identify any new risks that have developed. Keep in mind that any time you identify a new risk, it should be prioritized into your existing risk profile.

Auditing and Monitoring

You should routinely audit and monitor the success of your program. A concurrent or prospective audit will identify and address potential problems as they arise and before they cause harm to another party. If a problem does indeed exist, you will be required to correct the related process and any policies or procedures that reflect the process and communicate the change to all affected parties. Then you will need to go back in a predetermined amount of time (e.g., three months and perhaps again in six months) to review the process and resulting documents to ensure that the problem has been resolved. It may be determined upon repeated review that further corrective actions may be necessary, including disciplinary action against employees who continually fail to correct the problem after repeated retraining.

Monitoring, or regular review, is also necessary to determine whether compliance elements, such as dissemination of standards, training, and disciplinary action, have been satisfied. It also will target potential deficiencies and areas where modifications might be in order. A good place to begin an internal assessment is interviewing employees. Employees have a wealth of knowledge, and surprisingly, they often enjoy participating in the process of improving the organization they work for and will offer an unexpected amount of information. Ask them openly about risk, their daily activities, and if they feel the established processes and procedures are sound. Ask if the policies and procedures are followed. Periodically send out questionnaires to staff for feedback or conduct focus groups. Remember to always reassure employees that the organization maintains a strict nonretaliation policy, and that employees will not be retaliated against for reporting suspected misconduct.

Set up systems for regular and sometimes random review of records, both final documents (e.g., invoices, cost reports, financial statements) and supporting documents (e.g., invoices, worksheets, notes, legal opinions, financial analyses, schedules, budgets, expenses). Data collection and tracking are the heart and soul of review because they provide trend analysis and a measure of progress. The government recommends the compliance officer or reviewer consider the following techniques:

• On-site visits

• Interviews with personnel involved in management, operations, contracting, marketing, finance, and other related activities

• Questionnaires developed to solicit impressions of a broad cross section of the organization’s employees and staff

• Reviews of written materials and documentation prepared by the different divisions of the organization

• Trend analyses or longitudinal studies that seek deviations, positive or negative, in specific areas over a given period

• Reviews of internal and external complaints filed

• Inclusion of compliance and ethics language in job descriptions and performance evaluations

• Inclusion of compliance-related questions in exit interviews (responses to which should be reported to the compliance officer)

• Sample compliance-related exit interview questions:

  • How do you feel about communications in your unit?

  • How about communications overall?

  • How do you think the organization lives up to its code of conduct?

  • Do you have any concerns about ethical issues or compliance-related practices? If so, please explain.

(See Appendix 2-D, “Sample Audit Review Form.”)

Who is responsible for coordinating the monitoring and for conducting the internal audit? Is this an internal auditor’s responsibility, the compliance and ethics office’s responsibility, or perhaps a combination of the two? First, to avoid duplication or overlap, consider if there are other departments in your organization performing audits. Start with the finance department and the regular financial statement audits usually provided by outside certified public accountant consultants. Also, quality improvement or quality assurance activities are usually underway at all levels of the organization. These activities can dovetail with the monitoring and auditing elements of an effective compliance and ethics program. Auditors will need experience in the areas they are observing. Consider internal ad hoc groups—compliance SWAT teams—to monitor specific issues or review potential problem areas. References should be carefully checked for any outside auditors employed by the organization.

Any questions posed to or communications with government offices, regulatory agencies, or industry associations will be taken into account in an audit or review. The larger your organization, the greater the difficulty documenting such contacts. Be sure to take notes when you have a telephone conversation with the government or other regulatory agency. Ask for written confirmation of the information provided, and always keep your own notes of the conversation, including the date, time, and contact name, as well as the specifics of the conversation.

Audits and reviews must be documented and reported. Regulators call for regular reporting to senior company officers. For example, government guidance calls for written evaluations to be presented to the CEO, governing body, and members of the compliance committee no less than annually. When a facility is part of a larger corporate entity, monitoring and auditing activities should be a key feature of any annual review. Appropriate reports on audit findings should be periodically provided and explained to a parent organization’s senior staff and officers.^[12]

Reports to management, the governing body, and the compliance committee should include findings or suspicions of misconduct with an action plan to address and resolve the potential problem.

If Your Audit Finds a Government Issue

If the investigation finds that there was no violation, all is well. However, if, after the internal investigation, there is reason to believe the organization’s misconduct constituted a material violation of law, then the organization, in collaboration with counsel, must take steps to disclose the violation to the government.

Voluntary disclosure is not only the right thing to do; it also provides certain financial advantages, as fines may be reduced, and administrative advantages if a good faith effort to comply creates a more pleasant working atmosphere between the organization and the investigators. Voluntary disclosures should be conducted under advice of counsel.

Types of Issue Investigation Questions

What is the origin of the issue? An accounting concern may be the result of a systematic practice, a third-party inquiry, or misconduct by individuals. A systematic, noncompliant accounting practice may have been tied to a new system implementation or the result of faulty advice received from a consultant.

When did the issue originate? A systematic accounting practice may warrant internal inquiry into the origin of the practice and the extent of its impact on the organization. Improper accounting methods by one individual may require scrutiny of their entire employment history as well as a review of directions that person may have received from management.

How far back should the investigation go? Investigation standards for one organization may not apply to another. Some will begin by reviewing the past year’s accounting records. Others may start with a month of prior records. Regardless of the methods used, key stakeholders must determine the parameters of its investigation based on a reasonable approach that is justified under the circumstances.

Can extrapolation of a statistical sample be used? Statistical sampling and extrapolation may be warranted for some investigations, especially in the healthcare arena, where it is often too difficult or costly to determine the exact cause of a problem that involves improper billing. Caution is warranted, however. Samples of improper billing, for instance, may not accurately represent all of an organization’s billing practices.

It is understood, of course, that any identified problem must be corrected immediately. Restitution of overpayments especially should be prompt, and when the problem is rectified, the issue should be added to the list of topics to be addressed with regular internal monitoring.

It is also possible that an enforcement agency could approach the organization with information about an alleged violation. In such an instance when there is an investigation, rumors and speculations will run rampant. It will be especially important to keep staff informed about what is going on. To get the message to employees, consider different ways to get the message out. For example:

• A high-ranking official in the organization should send an all-staff memo or email

• Hold an all-staff meeting to get the word out and answer questions

• Keep managers and department heads updated so they can “drill down” the message

• Provide opportunities for feedback and more questions from staff

Most importantly, the organization’s policies and procedures should include instructions for employees on what to expect and how to handle contact from the government about an investigation. Legal counsel must be actively involved in drafting these policies. Search warrant policies and procedures should clearly identify who is responsible for carrying out those procedures (usually the legal department). In the event of an on-site government investigation, legal counsel must be notified immediately, and to the extent possible, all nonessential employees should be sent home or relocated during the government search. The search warrant should be carefully reviewed to ensure only identified documents are seized. Also, the compliance officer should be present during the search, keeping a detailed, written account of all activities and an itemized inventory of documents inspected or removed from the premises.

Delegation of Authority

An organization should have assurances that discretionary authority is not delegated to personnel who are likely to act illegally. It is imperative that your organization maintains control of two components for this issue. First, the organization must ensure that the individuals that sit in positions of authority are individuals the organization can trust in such positions. Drug screenings, background checks, and references will increase your confidence that you have met the element with new employees. The application form itself should ask the applicant to note any incidents of criminal conviction or exclusion action. This proactive strategy can prevent hiring a sanctioned individual (itself prohibited by the government). Such cautions apply to contracts with outside vendors as well. In addition, management and the board must become familiar with these individuals and not allow any particular individual to operate in a vacuum or in an unreviewable stance. This can be handled partly by policies, as discussed earlier. However, the key is that management and the board be actively involved in the workings of each authorized individual.

Second, the organization must control and maintain authority levels. This element gains its need not only from Sarbanes-Oxley (relating to financial controls and authority), but also from legal and compliance needs. The authority levels can be classified as contractual authority, substantive authority (who can commit the company in foreign trade transactions), financial access authority, order control authority, etc. Your organizational structure will determine the actual authorities needed and the levels provided. However, the compliance professionals in your organization should always have access to view such authority levels and include such levels in yearly assessments to determine if the organization has been able to maintain adequate control.

Studies show that most major white-collar crimes involving fraud are committed by first-time offenders. Therefore, performing background checks and reference checks will not ensure that you have hired an honest employee. Involvement in every employee’s business dealings and adequate controls will give your organization a fighting chance at preventing fraud before it happens or at least early in the process.

Hotline Reporting

There are a variety of methods for employees to report potential problems or to raise concerns. Regulators stress the importance of communication in the compliance process. The most important reporting system is an open door, and the best reporting system is one where the employee feels comfortable approaching their supervisor and openly discussing any potential problem.

For any reporting method to be effective, employees must accept that there will be no retaliation or retribution for coming forward. The concept of nonretaliation is fundamental to the compliance and ethics program, and a clearly stated policy regarding nonretribution is the first step. (See Appendix 2-B, “Sample Nonretaliation/Nonretribution Policy.”) The dangers are real. If employees suspect there could be retaliation, no one will come forward, creating fertile ground for whistleblowers and exposing the organization to unchecked risk. Remember, however, that a limitation should be included in the policy for good faith complaints or issues. Employees who concoct or report misinformation in bad faith should never benefit from such a policy.

Confidentiality is also key. Policies and procedures should assure to the extent possible confidentiality and anonymity in all reporting processes. (See Appendix 2-E, “Sample Confidentiality Statement.”) Confidentiality is closely tied with nonretaliation. For example, the decision-making process regarding a promotion can be tainted if the supervisor has been informed of an employee-candidate’s report of a problem. Policies and procedures need to offer assurances to the employee, but also must note that resolution of a problem, which could include legal action, may in certain circumstances require disclosure of identity. Legal counsel should be involved in the review of both the nonretaliation and confidentiality policies to be sure unrealistic promises are not made.

One common reporting method recommended by the government is the hotline or helpline. There are various arguments as to whether to provide a hotline internally or externally. The size and setting of the organization must factor into the decision. A large organization may need 24-hour coverage. For smaller organizations, 24-hour coverage may not be necessary, or may only be feasible through outsourcing. Also, cost and resources needed for training staff on how to handle calls and protect confidentiality must be weighed against the costs of a professional telephone service. If you decide to outsource, the contract should include the following:

• The right to move the toll-free number to another vendor or bring it in-house

• Assurances that security of the vendor computer system equals the security provided for the data within your own system

• An electronic method of linking the incoming phone line with the computer of the person answering the call (to decrease the risk of your hotline calls being routed, even inadvertently, to another client of the vendor)

Whether a hotline is provided internally or externally, anonymity to the greatest extent possible is vital, keeping in mind that anonymity can never be promised. Hotline numbers and procedures must be clearly and readily communicated to staff, preferably not solely through a page in the employee policies and procedures manual. Permanent and prominent bulletin board postings ensure that everyone knows problems are to be reported and how to report them.

Once you have a hotline up and running, how do you assess its effectiveness? Does a high number of calls indicate an effective hotline? Not necessarily. If you have been able to create an environment where issues are raised through appropriate channels and the staff trusts they can report problems without fear of retaliation, you may not get a lot of calls. Also, in most organizations, at least 80% of hotline calls are human resources or employee relations issues (e.g., complaints about a supervisor’s behavior or a colleague’s allegedly insulting remark, or disagreements with the organization’s policy on overtime). Here again, consider your organization’s culture. The number of calls alone is not an indicator of effectiveness.

Issue Escalation and Investigations

Once a complaint is received or a question raised, it must be investigated regardless of how small it seems. Remember, to regulators, documentation is everything. All complaints must be logged and tracked. Many organizations assign a unique number to each call, so the caller can check on the status of the complaint by calling back and giving the assigned number. How the complaint was handled, by whom, and when should all be included in the documentation. (See Appendix 2-F, “Sample Hotline Information Sheet.”) The log sheet should be supplemented with a complaint-specific issue form. Noting that a complaint was received is not enough. Documentation of the specifics of the issue, the departments involved, findings, and actions taken is also necessary. (See Appendix 2-G, “Sample Compliance Issue Follow-Up Form.”) You also need a clearly stated procedure outlining the disposition of these forms—specifically, who gets copies and how information is incorporated into written reports.

There also should be a written policy and procedure regarding how calls to the hotline, or input to any reporting mechanism for that matter, will be addressed. Specific steps for an investigation should be enumerated, and such a policy must limit distribution of information to protect confidentiality and nonretaliation commitments. Hotlines can seem like a sizeable expense, but in many, if not most, organizations they are a practical investment. The employee’s options shouldn’t be limited to government-sponsored hotlines.

In addition to hotlines, most organizations have in-house email systems. With the help of the information services department, email can often be configured so that problems can be reported but the compliance officer cannot determine who is sending the email. In today’s work environment, computers are commonplace, but they are not ubiquitous. Some jobs do not require a desk with access to a computer, and a centrally located general-access terminal could compromise confidentiality. For these reasons, email should not be the only reporting system. If adopting this sort of system as part of your reporting options, remember to emphasize in your procedures that anyone who wants to hear back will need to include their name in the body of the email, as there will be no way for the compliance officer to know who sent the email.

Another reporting option is a drop box for paper reports, a variation on the old suggestion box. Regular and frequent pickups will be important and multiple locations are encouraged, but be sure not to position it in an area of the organization with a security camera.

Reporting works both ways, and the compliance officer should take every opportunity to keep in touch with all levels of staff. Regular, ongoing communication is another form of education that reiterates commitment and can facilitate prevention of problems. Compliance and ethics communication can be incorporated into existing systems—a compliance and ethics column of frequently asked questions in the organization’s in-house newsletter, posters on bulletin boards, tent cards in the cafeteria, articles on an organization’s intranet, compliance content in department staff and organization-wide town hall meetings, etc. Good channels for communication must be in place and effective when changes or additions to policy or procedures occur. You may consider an email blast for special announcements, but use these sparingly, otherwise you will risk them not being taken seriously. Whatever communication you choose to use, be sure to keep copies in a binder or file so you can document what you are communicating, how, to whom, and when. All-employee emails, articles in the in-house newsletter, pages on the company’s intranet, brief presentations at all-employee meetings, and other methods of communication will reinforce that the compliance and ethics department is available to employees and provide documentation of the organization’s commitment to a culture of compliance and ethics.

Ongoing Program Improvement

Appropriate compliance and ethics program improvements should be designed to reduce any identified risks or compliance violations. Continual improvements and changes must be made as the compliance and ethics program matures. If you have identified additional risks, issues, or violations, it is required that you improve whatever part of your compliance and ethics program “failed” or fell short. You will need to (1) address the issue or violation consistently within your program policies and procedures and (2) ensure that this particular risk, issue, or violation will not occur in the future and, if it does, implement a control to catch such an issue or violation early and immediately, if at all possible. This may mean a new policy or procedure. It may mean a new control or audit criteria. It may mean additional compliance and ethics training. You will be required, as part of addressing the risk, issue, or violation, to revamp your program to address the finding.

In addition, a compliance and ethics program is never static. The degree of required program improvement will be determined by the maturity of your compliance and ethics program. If you have come into an organization with no compliance and ethics program, your program will be changing dramatically for years to come. Resources will play a role, as well as the attitudes of the governing members of your organization. Diligence in establishing the essential elements will be your driving force for much of the beginning of your effort. However, once your program touches all the essential elements, there will always be improvements that can be made to each element. Chapters 3, 4, and many of the key risk area articles found in Chapter 5 can help you fine-tune your program. Remember, forward momentum is always something you want to be able to show the government if they ever require proof of your program.