Scope & Implementation of an Effective Institutional Compliance & Ethics Program

1. Scope & Implementationof an Effective Institutional Compliance & Ethics Program Presented by: Charles G. Chaffin, CPA, CIA Director of Audits and System-wide Compliance Officer The University of Texas System AND Todd Guttman of the Ohio State University

2. KEY POINTS • The University of Texas Challenge • How Do I Get Started? • Implementation of an Institutional Compliance Program • Building the Infrastructure • Creating Compliance Awareness • Managing Critical Risks • Appraisal and Renewal • Benefits • Sharing the Best Practice Initiative • Resources

3. The University of Texas Challenge • Design, implement, and operate: a program that will provide an on-going, real-time assessment of the compliance profile of the system and each of its entities for executive management and the Board of Regents. • Board of Regents Issued Challenge • Challenge assigned by Executive Management to Director of Audits • 9 Academic Institutions • 6 Health Institutions • 1 Central Headquarters

4. How Do I Get Started? • Appoint an ad hoc committee representing all stakeholders in the collegial community • Including: • Business Affairs • Academic Affairs • Student Affairs • Athletics • Development • Safety • Human Resources • Research • Faculty

5. How Do I Get Started? (continued) • Obtain a MENTOR for outside expert advice. • For Example: Charles G. Chaffin or Todd Guttman • Adopt an operating philosophy and goals and objectives for the program. • Produce an Action Plan (a written blueprint) to guide the program.

6. Implementation of an Effective Institutional Compliance Program • Definition: An Institutional Compliance Program is one that encompasses your entire university. • Must have one within Athletics • And within the Safety Program • The Institutional Compliance Program joins it all together, creating a situation in which one individual is held accountable by the president.

7. Implementation of an Effective Institutional Compliance Program (cont’d) • Building the Infrastructure • Creating Compliance Awareness • Managing Critical Risks • Appraisal and Renewal

8. Building the Infrastructure • TIME and RESOURCES Required • Driven by the Size and Overall Complexity of your Institution • Convincing your Institution to Fund and/or staff the Program • Specific Tasks • Appoint a COMPLIANCE OFFICER • Current executive or a new position • Attorney, Auditor, Business Officer • Full-time or part- time

9. Building the Infrastructure (continued) • Appoint a COMPLIANCE COMMITTEE • Executive – President’s Cabinet • Working Committee – High Risk Area Department Heads (H.R. Director, Safety Officer, etc.) • Establish a COMPLIANCE FUNCTION/OFFICE • Full-time staff or slice of current staff time. • Can be housed in the legal, audit, business affairs office, or it can stand alone.

10. The Infrastructure • Compliance Officer • Compliance Committee • Compliance Function/Office • Institutional Community Imbued with Ethical Culture

11. Creating Compliance Awarenessat Your Institution • Compliance Awareness = An Institution Imbued with Ethical Culture • From the bottom up, include everyone • Develop a Standards of Conduct Guide (Code of Conduct) • Develop a General Compliance Training Program • Face – to – face • Web-based • Articles and emails.

12. Creating Compliance Awarenessat Your Institution (continued) • Establish a confidential reporting mechanism (Compliance Hotline) • Third Party Vendor • In-house Legal or Audit • Email

13. Managing Critical Risks • Risk ASSESSMENT Process • Identify Risks: • Probability of Occurrence • Potential Impact Related to Occurrence • Identify the SHOW-STOPPERS

14. Managing Critical Risks (continued) • Determine Risks that are Organization Critical: • Medicare Billing Rules (fines) • Research Time and Effort Reporting (fines) • Research Human Subjects (suspension) • Research Medical Billing (fines) • Lab Safety (injury) • Fire (injury and death) • Athletic Recruiting (loss of scholarships) • Athletic Boosters (loss of scholarships) • Sexual Harassment (very bad) • Endowment Spending (repay endowment)

15. Managing Critical Risks (continued) • Risk MANAGEMENT Process • Single High-Level Responsible Party • Medical School Dean • Vice President of Research • Dean or Provost • Vice President for Business • Athletic Director • Human Resources Director • Provost • Specialized Training Plan • (Risk Specific)

16. Managing Critical Risks (continued) • Monitoring Plan • How do you know if you are following the rules? • Reporting Plan • Report Cards to Compliance Officer and President

17. Appraisal and Renewal • Addressing instances of non-compliance • On-going assurance regarding the management of mission critical risks • Certifications • Inspections • Agreed-upon Procedures • Audits (design and/or information validation) • Peer Reviews

18. Appraisal and Renewal (continued) • Periodic assessment of the Compliance Program • Self-assessment • External Peer Review • Renewal • (Action Plan based on periodic assessment)

19. Benefits • Reduction in NEGATIVE PUBLICITY • Reduction in FINES and EXTERNAL AUDITS • Reduction in WORKERS’ COMP. CLAIMS • Safety Program Awards • Change in Organizational Culture • Established Basis for Enterprise-wide Risk Management and Accountability Program

20. Sharing the Best Practice Initiative • How-to book: Effective Compliance Systems: A Practical Guide for Educational Institutions(available from The Institute of Internal Auditors, Inc.) • Hosted: 1st and 2nd National Conferences on Effective Compliance Systems in Higher Education • Sharing: Major Research Institutions Compliance Group (formed after the 2nd Compliance Conference)

21. Resources • www.utsystem.edu/compliance • www.theiia.org • www.utsystem.edu/AUD • Chapter 8 -- 2004 Federal Sentencing Guidelines Manual Index (for the Sentencing of Organizations). http://www.ussc.gov/2004guid/tabconchapt8.htm  (effective November 1, 2004)

22. Resources (continued) • http://www.ussc.gov/2004guid/8b2_1.htm • CHAPTER EIGHT SENTENCING OF ORGANIZATIONS http://www.ussc.gov/2004guid/CHAP8.htm • http://www.pcms-team.com/federal-sentencing-guidelines/ • http://www.ethics.org/ethicsindex/fsgo.html • http://finance.pro2net.com/x46801.xml

23. Resources (continued) Other, important related sites and articles: • http://www.midicorp.com/articles.php?section=articles&id=77 • http://www.ussc.gov/PRESS/rel0504.htm  (Gov-ernment Press Release)