Federal Expectations of Effective Compliance Programs

1. Federal Expectations of Effective Compliance Programs 4th Conference for Effective Compliance Systems in Higher Education Austin TX March 2006 Carol Blum Council on Governmental Relations

2. Federal Expectations ofEffective Compliance Programs • Federal Expectations: Compliance • Federal Expectations: Compliance Programs • Elements • Effectiveness • Risk Management

3. Federal Expectations:Compliance Requirements Regulations • Statutes & Public Laws • Circulars & Executive Orders • US Code (USC) and Code of Federal Regulations (CFR) by Department • Policies by Agency • Manuals, “Policy Statements,” Handbooks • Terms & Conditions

4. Federal Expectations:Regulatory Guidance & Guidelines • "guidance documents:" documents that are prepared by an agency to describe the agency's interpretation of or policy on a regulatory or technical issue. • given their nonbinding nature, guidance documents should not include mandatory language such as “shall,” “must,” “required” or “requirement.”

5. Federal Expectations:Compliance Enforcement • Audits • Fraud Investigations (including Qui Tam) • Allegations – For-Cause Investigations • Not-for-Cause Site Visits Outcomes • Audit Resolution (within agency) • Regulatory Determination, e.g. loss of license • Settlements/Judgments

6. Federal Expectations ofEffective Compliance Programs • Federal Expectations: Compliance • Federal Expectations: Compliance Programs • Elements • Effectiveness • Risk Management

7. Federal Expectations:Compliance Programs US Sentencing Commission Chapter 8, Federal Sentencing Guidelines Part B, Section 2., Effective Compliance and Ethics Program (§8B2.1. ) An organization shall • Exercise due diligence to prevent and detect criminal conduct; and • Otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance within the law.

8. Federal Expectations:US Sentencing Commission Expectations for Compliance Program: • Reasonably Designed, Implemented and Enforced To be Generally Effective • Failure to detect an offense does not (necessarily) mean the program is not generally effective

9. Federal Expectations:US Sentencing Commission Seven Elements (Minimum Requirements) for An Effective Program: 1. Established standards and procedures 2. Governing authority is knowledgeable and exercises reasonable oversight • High-level personnel assigned over-all responsibility • Individual assigned day-to-day operation reports to higher-level and, as appropriate, to governing authority on effectiveness

10. Federal Expectations:US Sentencing Commission 3. Reasonable effort to avoid assigning substantial authority to individuals who engage(d) in illegal activities 4. Communicate the standards, procedures and other elements of the program to all members of the organization by: • Effective training programs • Dissemination of information

11. Federal Expectations:US Sentencing Commission 5. Take steps to: • Ensure compliance with program through monitoring and auditing; • Evaluate effectiveness periodically; • Provide system for reporting potential or actual criminal conduct, including: • Anonymous or confidential reporting • Provides guidance • Prevents retaliation

12. Federal Expectations:US Sentencing Commission 6. Promote and enforce program consistently • Incentives to comply • Discipline for: • Criminal Conduct • Failing to take reasonable steps to prevent or detect criminal conduct 7. Respond to criminal conduct and take steps to prevent similar conduct including modifications to program

13. Federal Expectations:US Sentencing Commission What is Effective? Effective Program Design Factors: • Industry practice or standards set by “applicable governmental regulation” • Size of the Organization • Similar Misconduct

14. Federal Expectations:US Sentencing Commission • Why? Culpability Score Determines the Fine • Approach Geared toward Deterrence • Restitution • Fines • Probation • Sentencing Benefit for an “effective program to prevent and detect violations of law” • Rehabilitate Organizations by Instituting and Maintaining Compliance Programs

15. Federal Expectations ofEffective Compliance Programs • Federal Expectations: Compliance • Federal Expectations: Compliance Programs (PROPOSED) • Elements • Effectiveness • Risk Management

16. Federal Expectations:HHS Inspector General • Draft OIG Compliance Program Guidance for Recipients of PHS Research Awards (November 2005) • Assist in developing & implementing internal controls & procedures that promote adherence to applicable statutes, regulations and other PHS requirements.

17. Federal Expectations:HHS Inspector General Eight Elements as Fundamental to an Effective Compliance Program • Written Code of Conduct & Policies & Procedures • Designated Officer & Committee • Training & Education • Open Lines of Communication • Internal Monitoring & Audit • Enforce through Disciplinary Guidelines • Respond, Correct & Report Problems • Define Roles & Responsibility & Assign Oversight

18. Sentencing Commission Standards & Procedures Designated Over-all & Day-to-Day Responsibilities Assignment of Substantial Authority Communicate by Training & Dissemination Monitor, Audit, Evaluate with a System for Reporting Promote & Enforce Respond & Correct Problems HHS OIG Written Code & Policies & Procedures Designated Officer & Committee Training & Education Lines of Communication Internal Monitoring & Audit Enforce through Disciplinary Guidelines Respond, Correct & Report Problems Define Roles & Responsibility & Assign Oversight Federal Expectations: ComparisonSentencing Commission & HHS OIG

19. Federal Expectations ofEffective Compliance Programs • Federal Expectations: Compliance • Federal Expectations: Compliance Programs • Elements • Effectiveness • Risk Management

20. Federal Expectations:US Sentencing Commission • Periodically assess risk of Criminal Conduct • Nature & seriousness of conduct • Effect of nature of business on risk of occurrence • Prior history of organization predicts conduct • Design, implement, or modify program to reduce: • Prioritize on most serious or most likely to occur • Modify, as appropriate, to reduce most serious or most likely occurences

21. Federal ExpectationsRisk Management Sources of Federally Defined Risk: General/Financial: • Agency OIG Annual Work Plans • Reports of Agency Audits • A-133 Annual Audit Compliance Supplement Specific Regulations, e.g.: • OHRP Determination Letters

22. Federal ExpectationsRisk Management HHS OIG FY 2006 Work Plan • CDC Management of Select Agent Programs • FDA Clinical Investigator Financial Disclosure Requirements • NIH Monitoring of Extramural Grantees’ Conflicts of Interest • (NIH) Grantee Level of Commitment in Applications • (NIH) Grantee Subrecipient Costs & Monitoring • (NIH) Direct Charge of Administrative & Clerical Salaries • (NIH) Allowability of Cost Transfers by Grantees

23. Federal ExpectationsRisk Management HHS OIG Proposed Compliance Guidance Program Risk Areas: • Time & Effort Reporting • Proper Allocation of Charges • Reporting of Other Financial Support

24. Federal ExpectationsRisk Management NSF OIG FY 2006 Audit Plan • Time & Effort Reporting at Major Recipient Universities • Financial & Performance Audit (two) Science & Technology Centers • (New & Continuing) Financial Audits, focus on management of cost sharing and indirect cost rates • Quality Control Reviews of (two) OMB A-133 Single Audits

25. Federal ExpectationsRisk Management NSF OIG Management Challenges • Cost Sharing (Prior Awards) • Integrity in Research • Project Reporting (Final and Annual) • Declining Success Rate