ESTABLISHING AN EFFECTIVE COMPLIANCE PROGRAM, COMPLIANCE RISK ASSESSMENTS,

AND THE ROLE OF GENERAL COUNSEL

June 25-28, 2006

PETER HARRINGTON Harvard Medical SchoolBoston, Massachusetts

and

TOM SCHUMACHERUniversity of MinnesotaMinneapolis, Minnesota

I. INTRODUCTION

It is increasingly evident that senior leaders and managers, and trustees and directors, of an ever growing number of colleges and universities have come to the conclusion, or are coming to the conclusion, that their institutions need to establish some sort of formal “compliance program” in order to better ensure that they are adequately and responsibly carrying out their various ethical, legal and fiduciary responsibilities and obligations arising out of all of the institution’s various programs and activities, and that they are minimizing and appropriately safeguarding the institution and its directors, officers, employees, students and other constituencies against the risks and liabilities inherent in those programs and activities. The factors understood to be driving this trend include the increasing levels of public and regulatory scrutiny of corporate governance in the wake of Enron and other recent corporate financial scandals, the passage of the Sarbanes-Oxley law1 in 2002 (directed at publicly traded corporations but whose provisions have influenced a reexamination of corporate controls in the non-profit sector), the increasing expectations of government regulators, accrediting bodies, and academic and industry groups – expressed in various regulatory and sub-regulatory guidance documents, management standards, and best practice recommendations - that institutions will establish and maintain appropriate and adequate compliance programs, and a significant increase in claims and liability exposures in areas such as gender discrimination, study abroad programs and human subjects research.

Once the decision has been made that a compliance program is needed, institutions must of course determine what the program will look like, how it will function, and how it will be administered and managed. Embedded in those inquiries are questions about the intended purposes and goals of the program, the preferred scope and cost of the program, and the location of the compliance function, and compliance officials, within the pre-existing university governance structure and hierarchy. While answers to many of these questions may vary from institution to institution, there appears to be a fairly broad consensus in the literature, and in published guidance from government and academic and industry groups, about the basic elements essential to successful compliance programs. These standard elements are well known by university audit and compliance officers, and increasingly, by university lawyers, controllers, risk managers and other management professionals as well.

1 15 USC 7201.

The intention of this paper is to discuss a number of these essential compliance program elements, and to provide some useful recommendations, insights and cautions about them, as well as, whenever possible, citations or references to useful models or other resources that might assist university attorneys and others looking to help establish or improve their institution’s compliance programs.

Since one of the authors serves as a research compliance officer in a medical school (while the other is a university-wide compliance official with oversight of all risk areas), some of the discussion in certain sections will focus on issues or considerations specific to the compliance function in a unit- or school-based setting, or on compliance concerns specific to research and sponsored programs activities. Nonetheless, the article is intended to convey and discuss general principles applicable in a university-wide context and relevant to compliance risks in the full range of research and non-research activities.

II. GUIDELINES FOR COMPLIANCE PROGRAMS

The acknowledged “touchstone” set of guidelines for institutional compliance programs, which appear to serve as a template, or at least starting point, for other governmental and non-governmental compliance guidelines, are those contained in the United States Sentencing Guidelines for Organizations (“Sentencing Guidelines”), which were first issued in 1991 by Congress, acting through the United States Sentencing Commission, and were most recently revised and reissued in November of 20042. The section of the amended Sentencing Guidelines entitled “Effective Compliance and Ethics Programs” identifies a framework of seven (7) core elements which it says are minimally necessary to ensure that the organization has met its core obligations to “exercise due diligence to prevent and detect criminal conduct and [ ] otherwise promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law.” Those seven elements, which by now are familiar to many, and which will be elaborated upon in the sections to follow, are:

1. Adequate compliance standards and procedures;2. Effective compliance oversight;3. Careful delegation and due care in hiring/screening employees;4. Effective training and education for roles and responsibilities;5. Monitoring, auditing, and hot lines;6. Enforcement for violations; and7. Corrective action.

An equally useful and influential set of governmental guidelines for colleges and universities are those issued in draft form last December by the Office of the Inspector General of the U.S. Department of Health and Human Services and entitled “Draft OIG Compliance Program Guidance for Recipients of PHS Research Awards”3 (“Draft OIG Guidelines”). While these guidelines are intended to provide recommendations for compliance programs focused on regulatory and financial aspects of federally sponsored research and service awards, the principles and practices they describe are readily generalizable and useful for structuring compliance programs overseeing virtually all activity areas. A recent statement issued by officials from COGR indicate that government sources have said that these OIG Guidelines will be “withdrawn,” presumably in response to the numerous public comments

2 See USSC Sentencing Guidelines Manual, Section 8B2.1, available on line at http://www.ussc.gov/2004guid/gl2004.pdf.3 70 CFR pp 71312-71320 (11/28/05), available on line at: http://www.oig.hhs.gov/fraud/docs/complianceguidance/PHS%20Research%20Awards%20Draft%20CPG.pdf

2

submitted to HHS which were critical of certain aspects of the guidelines. Nonetheless, because it is very likely that some federal agency (probably the National Science and Technology Council’s Committee on Science) will ultimately issue some sort of government-wide guidance similar to the DHHS Draft OIG Guidelines, and because the Draft OIG Guidelines in any case provides valuable insights concerning that agency’s perspectives on compliance programs, they remain an important resource for institutions establishing or evaluating their compliance programs.

The OIG describes the purpose of its draft guidance as being “to encourage the use of internal controls to effectively monitor adherence to applicable statutes, regulations, and program requirements.” While acknowledging the focus of the guidance to be “on grant compliance and administration issues,” the OIG also states its belief that its guidance will also assist institutions in developing compliance programs for their other activities …” The OIG makes clear, in its introductory comments, that its Guidance is not meant to provide rigid mandatory rules for compliance programs, but rather is meant as a set of recommendations and suggestions for institutions to consider if they decide to establish a compliance program. While noting that “the decision to adopt a compliance program is entirely voluntary,” the OIG also points out certain advantages related to such a program, including: “ensuring good stewardship of Federal funds by eliminating erroneous or improper expenditures”; improving grant administration processes; “demonstrating to employees and the community at large the institution’s commitment to honest and responsible conduct”; “identifying and correcting unlawful and unethical behavior at an early stage”; minimizing losses to the government and the institution through early detection; reducing the likelihood of government audits and investigations; and possible mitigation of penalties and other adverse enforcement actions in certain governmental enforcement cases.4

The Draft OIG Guidelines then go on to describe the eight basic elements of a comprehensive compliance program as follows:

(1) The development and distribution of written standards of conduct, as wellas written policies and procedures, that reflect the institution’s commitment tocompliance.

(2) The designation of a compliance officer and a compliance committee charged with the responsibility for developing, operating, and monitoringthe compliance program, and with authority to report directly to the headof the organization, such as the president and/or the board of regents inthe case of a university.

(3) The development and implementation of regular, effectiveeducation and training programs for all affected employees.

(4) The creation and maintenance of an effective line of communicationbetween the compliance officer and all employees, including a process (such asa hotline or other reporting system) to receive complaints or questions that areaddressed in a timely and meaningful way, and the adoption of procedures toprotect the anonymity of complainants and to protect whistleblowers fromretaliation.

(5) The clear definition of roles and responsibilities within the institution’sorganization and ensuring the effective assignment of oversight responsibilities.

4 Id at page 71314.

3

(6) The use of audits and/or other risk evaluation techniques to monitorcompliance and identify problem areas.

(7) The enforcement of appropriate disciplinary action against employees orcontractors who have violated institutional policies, procedures, and/or applicable Federal requirements for the use of Federal research dollars, and

(8) The development of policies and procedures for the investigation ofidentified instances of non-compliance or misconduct . These should includedirections regarding the prompt and proper response to detected offenses,such as the initiation of appropriate corrective action and preventive measures.

Most of these elements are discussed in the succeeding sections of this paper. In addition, the OIG’s supplementary comments and statements found elsewhere in the Draft OIG Guidance, which elaborate on or explain the meaning and intent of these eight elements, are summarized in the outline-grid reproduced in Appendix A.

Another set of influential guidelines – in this case non-governmental guidelines – that should be very useful to higher education organizations seeking to establish or improve internal compliance controls in the sponsored programs area are those described in COGR’s publication entitled “Managing Externally Funded Programs at Colleges and Universities: A Guideline to Good Management Practices.” (the “COGR Guide”). The COGR Guide, which is the most detailed of the three guidance documents mentioned here, provides specific sets of performance standards and best practice recommendations for each of the various risk areas relating to sponsored research and sponsored programs activities, such as allowable costs, cost sharing, human subjects protection, awards management, environmental safety and intellectual property. The COGR Guide is organized to provide, for each of those and other identified risk areas, a hierarchical set of principles, each with multiple corresponding recommended “practices” and compliance “indicators”. For example, in the area of “Financial Administration” one of the enumerated “Principles” (relating to “cost sharing”) along with one of its subsidiary “Practices” and its multiple corresponding “Indicators” are described as follows:

Principle II-6. Cost Sharing: The institution has policies and procedures for properly monitoring and documenting cost sharing in the same manner as costs funded by the sponsor, including mandatory and voluntary committed investigator effort. These policies and procedures comply with federal requirements of OMB Circulars A-21/A-122 and A-110/2CFR215.

Practice A. The institution has written policies and procedures for cost sharing that are consistently applied in proposing, accumulating, and reporting costs both to external sponsors and within the institution.

Indicator 1. Cost sharing included in proposal budgets, accepted by the sponsoring agency, and made a condition of the award is considered to be an obligation of the institution.

Indicator 2. Investigator and staff effort as well as non-labor costs included as cost sharing obligations are appropriately recorded in the institution’s accounting records.

4

Indicator 3. Cost sharing expenditures meet the standards of allowability, allocability, and reasonableness consistent with federal cost principles and standards of sponsors.

Indicator 4. Institutional systems provide for appropriate monitoring of cost sharing for timeliness and adequacy of expenditure or in-kind valuation documentation.

Indicator 5. The institution reports required cost sharing in accordance with the terms and conditions of awards.

Indicator 6. Voluntary uncommitted cost sharing (i.e. investigator-donated additional time above that agreed to as a condition of the award) is excluded from the organized sponsored projects base used for computing the F&A cost rates.

The COGR Guide is closer to a detailed accreditation checklist than a general set of guidelines for the overall design of a comprehensive compliance program (although it contains a short list of recommended principles, practices and indicators for an overall compliance program as well). Nonetheless, it is an immensely valuable tool that compliance officials will certainly want to use when performing an evaluation and gaps-analysis of institutional policies and controls in the areas of research and sponsored programs.

III. CONSIDERATIONS AND RECOMMENDATIONS CONCERNING

SPECIFIC ASPECTS OF COMPLIANCE PROGRAMS

In the following sections, we will a number of the recommended components of a compliance program which are not covered in the companion paper (which covers codes of conduct, hotlines and non-retaliation policies) as well as issues relating to the relationship of the compliance function and compliance offices and officials with other university offices and officials, including lawyers in the office of general counsel.

A. OVERSIGHT, GOVERNANCE AND LEADERSHIP ISSUES

Of critical importance to the success of any university compliance program is the establishment of an effective governance structure for the compliance function which: will ensure the necessary awareness of compliance issues and needs among university directors and senior leadership, and the awareness and support of senior managers across all relevant schools, departments and business and administrative units; high level support for compliance programs initiatives, including the provision of adequate resources to ensure their success; clear delegation of compliance responsibilities to qualified designated personnel who are provided appropriate authority and who will report back to senior leaders; and an appropriate degree of coordination and/or integration of compliance functions across different units and programs to ensure consistent quality and effectiveness of compliance programs and safeguards and the avoidance of administrative redundancy and conflict.

The essential importance of senior leadership responsibility for compliance, and senior leadership commitment and support for a properly designed and effective compliance program, is a central theme in the Sentencing Guidelines. Those Guidelines specifically provide that:

5

1. The organization’s governing authority shall be knowledgeable about the content and operation of the compliance and ethics program and shall exercise reasonable oversight with respect to [its] implementation and and effectiveness.

2. High level personnel …shall ensure that the organization has an effective compliance and ethics program… [for which ] specific individuals within high level personnel shall be assigned responsibility.

3. Specific individuals within the organization shall be delegated day-to-day operational responsibility for the compliance and ethics program. [These individuals] shall report periodically to high-level personnel and, as appropriate, to the governing authority, or an appropriate subgroup of the governing authority, on the effectiveness of the …program. To carry out such operational responsibility, such individual(s) shall be given adequate resources, appropriate authority, and direct access to the governing authority or an appropriate subgroup of the governing authority.

The Draft OIG Guidelines also provide very specific recommendations concerning the design and organization of a compliance program for sponsored research. Its recommendations specifically include: that senior management (“such as” the president and board of directors) be involved in “the development of all aspects of the compliance program”; that each organization appoint a compliance officer who will have day-to-day responsibility for overseeing and coordinating the compliance program; that the compliance officer should report directly to the institution’s president (or, in larger organizations, to the provost or senior director of research administration) and have direct access to the board of regents or other governing body, senior administration officials and legal counsel; that the compliance officer “have sufficient funding, resources and staff to perform his or her responsibilities fully”; that the compliance officer’s responsibilities include program oversight and monitoring, program revisions, education and training delivery and oversight, policy development, assisting with audits and reviews, investigating reports of noncompliance, and assuring appropriate reporting and corrective action; that organizations establish a compliance committee “to advise the compliance officer and assist in the implementation of the compliance program”; and that the compliance committee be composed of officials with varying responsibilities within the organization and who possess subject matter expertise in various areas of importance to compliance, such as finance, audit, legal, and biosafety.

An example of a charter for a university-wide compliance oversight committee, from the University of Minnesota, is attached as Exhibit B.

While the Sentencing Guidelines and Draft OIG Guidelines provide very useful suggestions concerning the design of compliance programs, they are best seen as articulating only general principles, and not as prescribing specific models that institutions need to replicate in every detail. Indeed, the OIG Draft Guidance has been criticized for being overly rigid and prescriptive in certain of its recommendations, and many believe that when DHHS issues its final guidance, it will articulate a greater recognition to the diversity of institutions and a greater acceptance of a variety of different approaches to compliance.

The reality is that a compliance oversight model that makes great sense for one institution would not work at all well for another institution. Universities with stronger and more independently administered campuses or schools will have more highly decentralized governance structures. These institutions may prefer to appoint school-based compliance officers rather than a single university-wide compliance officer. The challenge for these institutions will be to determine how best to coordinate the efforts of the multiple compliance offices and programs, to avoid duplication and conflict, and also to ensure that the institution’s system-wise or university-wide governing board and leaders can fulfill their

6

fiduciary obligations and ensure compliance in all university activities. One way to do this might be to have all decentralized compliance officers/programs report to a central university leader (who could report directly to the president or board), and to have that leader both evaluate and provide direction and support (such as through the provision of centralized employee training resources) to those unit-based officers and programs. The challenge for an institution with a highly centralized governance structure and a single university-wide compliance office and program will be that of developing effective relationships and lines of communication with leaders and senior managers in each of the colleges, schools, and other subordinate organizations, perhaps through designated local compliance “liaisons” or “partners”.

While the design of each institution’s program will be unique in at least some of its respects, and while there are bound to be variety of effective models that are designed quite differently from one another, the view that emerges from the literature and the various guidelines discussed here, is that a properly designed compliance program will feature certain essential characteristics such as: a highly placed compliance officer (or officers), reporting regularly to senior leadership, charged with essential compliance oversight duties, and vested with sufficient authority to ensure his/her/their effectiveness; a fully informed and engaged senior leadership, chief executive and board; adequate resources and institutional support for the compliance function; and some kind of compliance-related senior management oversight or advisory committee to advise, assist and/or oversee the work of the compliance officer and help ensure the success of the institutional compliance program.

B. COMPLIANCE RISK ASSESSMENTS

No attempt will be made here to discuss the topic of risk assessment in any level of detail. Rather, some basic suggestions and observations will be provided in an attempt to provide a framework for thinking about the problem. But for an excellent discussion of a risk assessment approach for a higher education institution, as well as invaluable advice and a scalable framework for establishing an effective compliance program at your college or university, see Effective Compliance Systems: A Practical Guide for Education Institutions, David B. Crawford, Charles G. Chaffin and Scott Scarborough, (The Institute of Internal Auditors Research Foundation, Nov. 2001).

Most approaches to risk assessment appear to involve, at a basic level, the identification of activities that involve risk to the institution, the measurement of the degree of risk each involves, and the comparison or ranking of degree of risk of those various activities. The process that involves all three steps has sometimes been referred to as “strategic risk assessment,” since its end result is the identification of risk-bearing activities most in need of attention by management, i.e. most in need of some institutional intervention to minimize the risk.

The following will describe a basic approach to risk assessment, in an effort to offer a simple model for possible comparison with other models, and to highlight some of the main challenges in this area. To keep the discussion simpler and more focused, the discussion will presume an attempt at a strategic risk assessment process for research compliance in a medical school setting.

Step One: Identify the various “compliance areas” or “risk areas” inherent in the institutional activity of conducting sponsored research. As a first step, these risks could be divided first into “financial and grants management” risks and non-financial “regulated research activity” risks. The area of “financial and grant compliance” would include, for example: effort reporting; cost sharing; cost accounting standards; equipment management; program income, procurement, and subrecipient monitoring. The regulated research activities risks would include risk areas such as: export controls, human subject

7

protection, biosafety controls; animal welfare; and conflicts of interest. A more complete list of risk areas within these two general categories are included in Appendix C.

Step 2: For each identified risk area, an inventory should be developed which identifies the applicable legal, regulatory and institutional policy requirements relating to that area, and the offices, committees and officials at the institution responsible for various administrative or compliance duties in the area. One outcome of this exercise is to identify “subject matter experts” or “compliance leaders” with both knowledge and responsibility in the various assigned areas who will be able to assist with the further steps, including higher-level compliance assessments and targeted compliance enhancements or improvements.

Step 3: A basic-level “gaps analysis” should be performed to determine whether university policies or business or administrative processes are in place (at least on paper) to help ensure that all of the identified legal and regulatory requirements are identified and internally communicated (even if not fully understood and being complied with), and if any such basic gaps are found, to fill them.

Step 4: A next step would be to perform a higher-level compliance-program-type assessment in each of the identified areas. This would involve assessing, in each area, the level of adequacy or degree of completion of each of the seven substantive “elements of compliance” identified in the Draft OIG Guidance, namely: written policies and procedures, effective training and education, effective lines of communication, internal monitoring and auditing, published disciplinary guidelines, defined roles and responsibilities, and appropriate response to problems and corrective actions.

Step 5: Determining, on a continuing basis, which of the areas in which deficiencies have been identified in Step 4 need to be addressed and remedied on a priority basis, and how they ought best be addressed. This step involves a somewhat more subjective analysis, based in part on the perceptions of institutional leaders and staff, and probably external subject matter experts as well, about the greatest risks to the institution. This analysis will generally involve some kind of an attempt at an objective quantification of potential institutional harms that may result in the event of non-compliance, often through a review of the “external environment” of federal agency and DOJ enforcement actions, case settlements, OIG audit reports and work plans, and civil lawsuits. But it should also involve some kind of a survey of institutional managers, staff and subject matter experts to obtain their “insider” perspectives on which areas they perceive to be the greatest compliance risks and areas most in need of attention and some kind of management intervention. This kind of internal “temperature taking,” which is a strategy often associated with the “enterprise risk management” (“ERM”) approach to governance, can utilize the type of survey instrument attached as Appendix C.

A few additional observations about this very basic form of “strategic risk assessment” are in order. First, the concept of institutional “risk” is normally defined broadly to include, in addition to financial risk (from potential damage awards, regulatory fines and penalties, costly remedial compliance conditions imposed on the institution, and business disruptions), risks to institutional reputation and prestige, and risks to the health and safety of employees, research subjects and community members. Second, the ranking or prioritization of risks will necessarily involve making predictions about the likelihood that a non-compliance event will occur and result in some adverse outcome affecting institutional finances or reputation or the well being of the institution’s constituents, and the degree of harm that will most likely be associated with that adverse outcome. Those predictions will in turn be based on perceptions of the nature of the underlying activity (e.g. inherently dangerous or not), the intensity of volume of the activity (e.g. “very few” versus “very many” clinical research trials) at the particular institution, and the likelihood of a resulting enforcement action or lawsuit by regulators or

8

affected parties, or an expose by the local or national press or watchdog groups. Finally, the basic steps outlined above may be re-ordered, depending on institutional priorities and strategic preferences. For example, many institutions may choose to proceed with Step 5 and prioritize their risks before undertaking the detailed 7-point compliance-program-type assessment described in Step 4 for those identified “priority risks.”

C. ASSESSING YOUR COMPLIANCE CULTURE

1. Sentencing Guidelines and Related Regulatory Mandates

The Advisory Committee making recommendations to Congress on the 2004 revisions to the U.S. Sentencing Guidelines placed great emphasis on organizational culture. Specifically, the committee expanded the existing Guidelines to make the requirement to promote a culture of compliance an explicit element of the framework. As amended, the Guidelines now state:

“To have an effective program to prevent and detect violations of law… and organization shall … promote an organizational culture that encourages a commitment to compliance with the law.” § 8B2.1(a).

This is consistent with legislative and regulatory reforms, both before and after the Amendment to the Guidelines. These include the Sarbanes-Oxley Act of 2002 (“SOX”), (companies to adopt codes of conduct with “standards that are reasonably designed to promote honest and ethical conduct”) §406; SEC regulations (recognizing that a “code of ethics” include “written standards that are reasonably designed to deter wrongdoing and to promote honest and ethical conduct”) 68 Fed. Reg. 5110, 5118. Although in the highly-regulated world of the SEC, the views expressed by its Director, Office of Compliance Inspections and Examinations perhaps best capture the current regulatory mentality across many regulatory bodies:

“The culture of compliance is too important to be left to subjective impressions. Through our new methodologies we are turning it into a formal examination technique. We are taking it very seriously.”

“The Culture of Compliance,” Lori Richards, (April 23, 2003). http://www.sec.gov/news/speech/spch042303lar.htm.5

2. Compliance Culture Assessment Strategies.

At the most general level, however, assessing your compliance culture should evaluate the behavioral norms and views of your faculty and staff against key indicators for a “health”

5 Ms. Richards further remarked:

[W]e have prepared a formal approach to assessing your culture of compliance. We think that every good culture of compliance has at least five elements. First, it has a strategic vision. Compliance activities have to relate to some larger strategic goal. Second, it identifies the specific risks that could arise within each strategic area. The devil, as they say, is in the details. Third, it establishes control points for each of these risks. Fourth, it is well documented. Documentation provides transparency, both internal, to senior management, and external, to auditors and regulators. Fifth and finally, specific people are accountable for managing each specific element of the compliance system. You can have the best policies and procedures in the world, but if no one is making them work, they will be useless.

Id.

9

compliance culture. This is in many ways the more traditional, expansive view of “culture” beyond programmatic elements. Factors to consider in this assessment may include:

1. Employee awareness of ethical/legal issues that arise at work2. Looking for ethics/compliance advice within the organization3. Employee knowledge of workplace rules4. Employee willingness to inform management of problems/ deliver “bad

news” to management

5. Employee willingness to report legal violations (e.g. call the “hot line”)6. Employee commitment to the organization7. Employee perceptions that leadership pays attention to ethics and cares about ethical

conduct as much as the bottom line.8. Employees perception of fair treatment within the organization9. Institutional ethics and values are openly discussed and are integrated into

decisionmaking10. Employees perceive that ethical behavior is rewarded and unethical behavior punished, at

all levels. 6

3. Examples: Culture Assessment Questions

As one strategy to consider, many institutions, including the University of Minnesota, currently survey faculty and staff culture generally on a period basis. A typical “culture” survey may include a host of topics, from compensation satisfaction to professional development. This may be an ideal location to integrate questions essential to a compliance culture. For example, in the University of Minnesota’s most recent survey, employees were asked the following questions:

 Strongly Disagree

Disagree to Some Extent Uncertain

Agree to Some Extent

Strongly Agree

I know where to report violations of law or policy (such as the University's confidential reporting line.) 1 2 3 4 5I believe I would be protected from retaliation if I report a suspected violation. 1 2 3 4 5University leadership demonstrates integrity and ethical behavior. 1 2 3 4 5

6 Source: Managing Ethics and Legal Compliance: What works and what hurts, Trevino et al, 41 California Management Review, No. 2 1999.

10

I have experienced or observed significant misconduct (violation of law, workplace rules, or significant University policy) in my unit/department within the last twelve months?

Yes No

If Yes, If the misconduct was not known by responsible University officials, did you or someone else report it to responsible University officials or the University’s confidential reporting service?

Yes, Yes, No, Don’t I reported it others reported it it was not reported know

If Yes, Do you believe responsible University officials took appropriate corrective action?

Yes No Don’t Know

D. OTHER ASPECTS OF A COMPLIANCE PROGRAM

Without going into any level of detail, brief mention should be made of a few of the other most essential aspects of a compliance program.

1. Education and Training & the Promotion of Responsible Conduct

The Advisory Committee making recommendations to Congress on the 2004 revisions to the U.S. Sentencing Guidelines (the “Advisory Committee”) re-emphasized and enhanced the requirements for compliance-related education programs. The most significant change made to this element was inclusion of the explicit directive to engage in compliance training, and that such training includes the Board, organizational leaders, and all employees. The Advisory Committee recognized that successful training had two components: (1) effectively communicating compliance standards, roles and responsibilities to all organizational agents and (2) motivating them to comply. It concluded that “all organizations should engage in active compliance training.” Based upon the role organizational leaders play in overseeing the compliance program, the Committee further emphasized “that all levels of the organizational hierarchy should be made aware of their compliance responsibilities, from the governing authority on down to organizational agents.” Most commentators have interpreted this to mean that compliance specific education is required for boards or an appropriate board committee.

The degree to which, and manner in which, education and training is conducted will vary from institution to institution, based on the nature and intensity of risk-bearing activities, the institution’s perceptions of risk, resource availability, institutional culture and other factors. A common question that arises is the degree to which training should be a centralized function, run out of a central compliance or employee training office that can perhaps better ensure that training modules and programs are structured and evaluated appropriately and consistently across all units, or should be a decentralized function delegated to the administrative units responsible for the given activity which are more likely to be administered by subject matter experts with practical insights on the day to day operations they are

11

tasked with overseeing. Perhaps the best, albeit highly resource-intensive, model is the hybrid model established by Stanford University in its Cardinal Curriculum through which training modules are developed for each particular risk area through a partnership between a central training department that brings curriculum design and evaluation expertise and the subject matter experts responsible for the administrative and compliance functions in that particular area. Stanford has also recently introduced its STARS “training and registration” system which permits the institution, among other things, to track all compliance training that occurs in its decentralized training environment. Information about Stanford’s impressive training program is available to the public online at http://ora.stanford.edu/cardinal/.

2. Auditing, Monitoring and Trending

The 2004 amendments to the Sentencing Guidelines make three changes to the USSC’s original monitoring and auditing requirements. First, the original guidelines listed compliance monitoring and auditing as examples of good compliance practices, but did not make them expressly required. The amendments make these required, so that “regular compliance evaluations through auditing and monitoring practices are essential features of every compliance program.” Second, the amended Guidelines add a new requirement to regularly review and assess the compliance program itself. The Committee distinguished between (1) traditional monitoring to review “the adherence of organizational activities to applicable laws and compliance program requirements” and (2) evaluation of “the sufficiency of managerial practices comprising an organization’s compliance program to ensure a reasonable likelihood of success.” The Committee observed that “regular evaluations of program effectiveness are an essential means to ensure the completeness and success of the compliance program.” Thus the new Guideline states that due diligence requires the organization to “take reasonable steps to evaluate periodically the effectiveness of the organization’s program to prevent and detect violations of the law.” Third, the amendments make clear that monitoring and auditing programs should be based upon regular risk assessments (discussed above). The change “clarifies that characteristics of monitoring, auditing, and evaluation efforts, such as the targeting and frequency of compliance assessments, should correspond to the likelihood of compliance problems in particular organizational activities.”

There are a number of possible sources of “trending information,” i.e. information providing evidence of which particular compliance problems are occurring – or are thought to be occurring – with the greatest frequency at your institution. Certainly, audit reports from both the institution’s external auditors (e.g. auditors performing the annual A-133 Audit for sponsored programs) and internal auditors (e.g. performing confidential departmental or program audits) are among the most useful sources of information about compliance problems. Other sources include hotline/helpline reports, statements and questions made by employees at focus group meetings and training sessions, and actual discovered or reported noncompliance events, all of which can and should be compiled and evaluated in some fashion. In addition, employee satisfaction surveys administered by personnel and workforce development offices can contain (and could be explicitly designed with assistance of compliance personnel to contain) questions about institutional compliance intended to elicit employees observations and concerns about compliance in their areas.

3. Reporting & Corrective Action

It is of course essential that internal reporting of non-compliance be encouraged, through language establishing that expectation in Codes of Conduct and through protective provisions for whistleblowers in well publicized non-retaliation policies. It is equally essential that institutional

12

policies and procedures are sufficient to ensure that all instances of non-compliance required to be reported to external agencies are in fact reported, and that appropriate corrective and, when necessary, disciplinary action, is taken following review and investigation of instances of alleged noncompliance. No attempt will be made here to discuss this broad topic in grater detail. However, an excellent template for institutional policies intended to encourage reporting, and to appropriately address noncompliance concerns, is the one developed by the University of Minnesota, which is available on line at http://www.fpd.finop.umn.edu/groups/ppd/documents/policy/Reporting_Violations.cfm.

E. ROLE OF LEGAL COUNSEL

Lawyers clearly play a very significant and important role in compliance programs. First, they are responsible for providing legal advice to the institution and have the final word on legal issues facing the institution. Hence, whenever there are questions about the scope or meaning of regulatory requirements, the institution’s particular duties under those regulations, or the manner in which the institution should discharge its duties to best ensure compliance with the regulations, the lawyers are the ones who will need to provide the answers, or at least their best professional advice for institutional leaders to consider in making decisions about institutional management. Second, lawyers will often be the most knowledgeable “subject matter experts” in any given area, and can help with risk assessment, the design of compliance controls and policies, and employee training in those areas. Third, lawyers can help compliance leaders better understand the external enforcement and liability environment, by keeping compliance officials updated on enforcement and litigation trends, and identifying new and emerging regulatory challenges. Fourth, lawyers will often need to assist with investigations of wrongdoing, particularly advising on issues of due process and hearing procedures and appeals, and sometimes leading such investigations and protecting institutional findings under attorney-client or other applicable privileges. Fifth, lawyers are invaluable resources when it comes to policy drafting and development, with usually strong writing and analytical skills and with a trained eye for due process and related legal issues. Finally, and more generally, due to the institution-wide perspective they bring, and their keen eye for potential problems and pitfalls that can lead to conflict and litigation, lawyers should be seen as key partners who can assist and provide useful advice to compliance personnel on the full range of an institution’s compliance activities.

III. CONCLUSION

There is no question that compliance programs are increasingly becoming part of the landscape at colleges and universities, due to external pressures such as Sarbanes Oxley, more thorough rigorous external auditing processes, governmental expectations expressed in guidance like the Draft OIG Guidance and U.S Sentencing Guidelines, as well as internal pressures from institutional directors and senior leaders, employees and actual and potential whistleblowers. The bad news is that successful compliance programs can be a significant challenge to establish and maintain. But the good news is that many useful tools, guidance materials and model policies, like those developed at the University of Minnesota and at Stanford University, as well as materials available through conferences like this one, are available to help guide institutions looking to establish or improve their compliance programs.

13

APPENDIX ASummary of DHHS OIG 11/05 CPG: 8 Elements

Policies and Procedures regarding federal requirements

"Policies and procedures should be developed under the direction and supervision of the compliance officer, the compliance committee, and relevant institutional officials

  "Policies should be reviewed at regular intervals to ensure they are current and relevant"

  Policies provided to all faculty, staff and students affected by them; suggestion for putting them on a single internet site

 

Code of Conduct Should "detail the fundamental principles, values and framework for action within an organization…should articulate the institution's expectation of commitment to compliance by management, employees, and agents, and should summarize the broad ethical and legal principles under which the institution must operate; should be applicable to all employees.

  Code of Conduct: Senior management "such as the board of regents and president" and others should participate in the development of the code of conduct

Designation of Compliance Officer and Compliance Committee

Compliance Officer primary responsibilities: "optimally should report directly to the institution's president and should have direct access to the board of regents, senior administration officials, and legal counsel"

  Compliance Officer primary responsibilities: Overseeing and monitoring implementation of the compliance program

  Compliance Officer primary responsibilities: Reporting on a regular basis to the board of regents, president and compliance committee

  Compliance Officer primary responsibilities: Periodically revising the program to respond to changes

 Compliance Officer primary responsibilities: Developing, coordinating, and participating in education programs that focus on the elements of the compliance program, and seeking to ensure that all affected employees understand and comply with pertinent federal and state standards

  Compliance Officer primary responsibilities: Developing policies and procedures

  Compliance Officer primary responsibilities: Assisting the intuitional internal or independent auditors in coordinating compliance reviews and monitoring activities

 Compliance Officer primary responsibilities: Reviewing, and where appropriate acting in response to reports of noncompliance received through the hotline, or otherwise brought to compliance officer's attention by internal audit or counsel

 

Compliance Officer primary responsibilities: "independently investigating and acting on matters related to compliance. The compliance officer should have the flexibility to design and coordinate internal investigations (e.g. responding to reports of problems or suspected violations) and any resulting corrective action (e.g. making necessary improvements to policies and practices, and taking appropriate disciplinary action) with particular departments or institution activities

  Compliance Officer primary responsibilities: participating with counsel in the appropriate reporting of any self-discovered violations of federal requirements

  Compliance Officer primary responsibilities: "continuing the momentum/ revising or expanding the compliance program after the initial years of implementation"

  Compliance Officer primary responsibilities: "compliance officer must have authority to review all documents and other information relevant to compliance activities"

14

  Compliance Committee: Established to advise the compliance officer and assist in the implementation of the compliance program

 

Compliance Committee: suggested membership "operations, finance, audits, human resources, and legal, as well as faculty members. All committee members should have the requisite seniority and comprehensive experience within their respective areas to recommend and implement any necessary changes to policies or procedures.

  Compliance Committee: "the committee should function as an extension of the compliance officer and provide the organization with increased oversight"

Conducting Effective Training

An institution should provide general training sessions that cover such issues as ethical standards and the institution's commitment to compliance issues. All employees, and where feasible and appropriate contractors, should receive the general training. General training should include the contents of the institution's compliance program, such as the roles of the compliance officer and the committee" and the hot line and "both a description of the many types of compliance issues that administrators, faculty and other employees may need to address...and the sources of guidance for resolving those issues

  More specific training for more specialized audiences, for example administrative personnel who manage award funding

 General and specific training sessions should be provided both upon initial employment with the institution as well as on some periodic schedule…specialized training should be provided on a more frequent basis, perhaps annually or more frequently.

 The Compliance Officer should maintain records of all formal training undertaken by the institution as part of the compliance program. This should include attendance logs, descriptions of the training sessions, and copies of the material distributed at the training sessions.

  Institution needs to establish a mechanism to ensure that employees receive the training they need.

  "Adherence to the training requirements as well as other provisions of the compliance program should be a factor in the annual evaluation of each employee"

Effective Lines of Communication

Confidentiality and non-retaliation policies should be developed and distributed to all employees

 "In addition to serving as a contact point for reporting problems and initiating appropriate responsive action, the compliance officer should be viewed as someone to whom personnel can go for clarification on the institution's policies"

 "an effective employee exit Interview program could be designed to solicit information from departing employees regarding potential misconduct and suspected violations of the institution's policies and procedures"

  Identification of areas of risk or concern through periodic surveys

  Hotline/ reporting mechanism made available to all employees and communicated; "employees should be permitted to report matters on an anonymous basis

  Reported matters should be reviewed promptly; matters which suggest substantial violations of federal program requirements should be documented and investigated promptly.

  "The compliance officer should maintain a thorough record of such complaints, as well as any investigation, its results, and any remedial or disciplinary action taken."

  May "provide [hotline] information, redacted of individual identifiers, to the institution's senior management, such as the board of regents and the president, and to the compliance committee.

Auditing and Monitoring

Auditing of institution's operations and activities is a critical internal control; should follow "Yellow Book" Government Accounting Standards

 Conduct risk assessments to determine where to devote audit resources, and for separate performance audits. May wish to consider the three research risk areas identified in the CPG; "risk assessments could be coordinated by the compliance office."

 Monitoring of the implementation of the compliance program itself and an ongoing evaluation process. The compliance officer should document this monitoring process and provide these assessments to the institution's senior management and compliance committee.

15

 "The nature of the [compliance reviews] could include prospective systemic review of the institution's processes, protocols, and practices, or a retrospective review of actual practices in a particular area."

  "reviews should evaluate whether (1) the institution has policies covering identified risks; (2) policies were implemented and communicated; (3) the policies were followed"

Enforcing Standards through Well-Publicized Disciplinary Guidelines

"should include clear and specific disciplinary policies that set out the consequences of violating federal or state requirements, the institution's code of conduct, or its policies or procedures"

 Should consistently undertake appropriate disciplinary action across the institution for the disciplinary policy to have the required deterrent effect. Intentional and material noncompliance should not be tolerated and should subject transgressors to significant sanctions

  Disciplinary action may also be appropriate when a responsible employee's failure to detect a violation is attributable to his or her negligence or reckless conduct

Responding to Detected Problems and Developing Corrective Action Initiatives

Compliance officer or other official should immediately investigate allegations to determine materiality; take decisive steps to correct problem, and implement corrective action plan as appropriate

 

where investigation shows credible evidence of misconduct that may violate criminal, civil or administrative law, the institution should promptly report to the appropriate authorities within a reasonable period, but not more than 60 days, after determining there is credible evidence of a violation.

  "Once the investigation is completed . . . The compliance officer should notify the appropriate authorities of the outcome of the investigation

Establishing Roles and Responsibilities and Assigning Oversight Responsibility

Should clearly delineate the responsibilities of all persons involved with the conduct of federally supported research, including both administration or department personnel with oversight responsibility as well as principal investigators and other personnel who are engaged in research.

  Roles and responsibilities should be clearly communicated and accessible

APPENDIX B

16

Compliance Oversight Committee

Purpose

The Compliance Oversight Committee will oversee the University’s compliance activities and program to ensure they are reasonably designed, implemented, enforced and generally effective in preventing and detecting violations of the law. The committee will further take or recommend such actions as are necessary to promote an organizational culture that encourages a commitment to compliance and ethical conduct.

Responsibilities

The Committee members will be knowledgeable about the content and operation of the University’s compliance and ethics program. The Committee will further exercise reasonable oversight over the implementation and effectiveness of the program, including:

● Assuring that individuals with operational responsibility conduct regular ongoing risk assessment; regularly reviewing risk assessments; and recommending and assuring that appropriate steps are taken to design, implement, or modify compliance activities to reduce the compliance risks identified by risk assessments.

● Assuring that compliance roles and responsibilities are clearly established across the University system, and that due care is taken in delegating substantial authority.

● Assuring that the University implements standards of conduct, policies, procedures and internal control systems reasonably capable of reducing misconduct, including the Board of Regents Code of Conduct.

● Exercising reasonable oversight over compliance activities, including periodically requesting and receiving information on the implementation and effectiveness of the compliance and ethics program from individuals with day-to-day operational responsibility, as well as the Director of Institutional Compliance.

● Assuring that individuals responsible for the compliance and ethics program have adequate resources, authority, and competencies to carry out their responsibilities.

● Assuring that the University’s compliance standards, procedures and expectations, including the Board of Regents Code of Conduct, are effectively communicated through education and training programs, publications, and other appropriate means.

● Assuring that reasonable steps have been taken to achieve compliance with laws, policies, and procedures throughout the University through the use of reasonably designed auditing and monitoring systems as well as periodic evaluation of the compliance program’s effectiveness.

● Assuring the University maintains an effective mechanism for employees and agents to report or seek guidance regarding potential or actual wrongdoing, including mechanisms to allow for anonymous reporting, and appropriate safeguards to protect against potential retaliation.

17

● Assuring that compliance is promoted and enforced consistently through appropriate incentives and disciplinary measures, including discipline of employees responsible for violations and, if warranted, discipline of employees for failing to reasonably detect offenses; further assuring that appropriate actions are taken to prevent similar offenses, including making any necessary modifications to the compliance program.

● Reporting, or directing the reporting, on the implementation and effectiveness of the compliance program to the Board of Regents Audit Committee.

● Taking such other actions, or making such other recommendations, as are necessary to promote an ethical organizational culture.

Membership

The membership of the Compliance Oversight Committee will consist of members of senior management selected by the University’s President, and other persons as deemed appropriate. The initial membership will include:

● Vice President for Human Resources● Vice President for Research● Vice President for University Services● General Counsel● University Auditor● Director of Institutional Compliance

Operations

The Committee will meet at least quarterly and at such other times as it elects. The Director of Institutional Compliance will provide administrative support to the Committee, as well as serving as a member. The Committee may delegate compliance activities to other committees or persons as it deems appropriate.

18

APPENDIX C

REGULATED RESEARCH ACTIVITIES (“Non-Financial”) (“RRA”)

Activity/Risk AreaReputational

RiskHealth, Safety &

OperationalRisk

Financial RiskOverall Priority Ranking

(1-11)

High Med Low High Med Low High Med Low

Human Subject Protection & IRB

Animal Welfare & IACUC

Stem Cells – Non-Financial Compliance

Biosafety & COMS

Select Agents

Export Controls

Environmental/Occupational Health &

Safety

Clinical Trials & FDA

Financial Conflicts of Interest

Intellectual Property & Bayh-Dole Compliance

Data Privacy & Security (including HIPPA

19

FINANCIAL and GRANTS MANAGEMENT (“FGM”)

Activity/Risk AreaReputational

RiskHealth, Safety &

OperationalRisk

Financial RiskOverall Priority Ranking

(1-13)

High Med Low High Med Low High Med Low

Pre-Award & Proposal Requirements

Subrecipient Monitoring

Award Management, including Financial & Technical Reports,

Records and Data

Time & Effort Reporting

Cost Allocation, including Cost Transfers & Cost Sharing

Stem Cells – Cost Allocation

Program Income

Allowable Costs

Reporting Support from Other Sources

Financial and Cost Accounting & Reporting

Procurement

Equipment Use & Management

International Programs: Oversight

20