Ten years ago, when compliance programs were being established, the focus was on identifying, documenting, and communicating compliance requirements. There was also an emphasis on communicating the consequences of non-compliance and the potential for significant financial penalties, criminal charges, and even court appointed monitors. These consequences were like a compliance “hammer” and were used to get the attention of employees, management and leadership. For the most part, it worked.
Today, regulatory oversight continues to increase with the enactment of new laws such as the Dodd-Frank Act and the Affordable Care Act. It’s essential that compliance programs be structured to document and now demonstrate compliance with laws, rules, and regulations.
The basic elements of documenting and communicating compliance requirements remain at the core of a successful compliance program but, there’s an increased focus on answering a fundamental question: How do you know? A response of “because we have documentation in place” may not be sufficient. A more appropriate response might be “because we have substantiation and we can prove it.” Regulators and auditors who are assessing the effectiveness of compliance programs are looking for substantiation. Substantiation means determining ownership and accountability for tasks associated with compliance requirements at the individual level. This may include attesting to completion of a compliance requirement, being able to explain why the requirement exists, or even producing documentation to support it. Ultimately, it boils down to ownership and accountability – the new compliance “hammer.”