Compliance Perspectives

Post By: Adam Turteltaub

Operation Lava Jato (Carwash) had a profound effect on business in Brazil, with countless companies caught up in one way or another in the corruption scandal.

State oil company Petrobras was no exception, but, as is the case with so many compliance incidents, the question quickly moved from what happened to what are you going to do about it.

At the 2022 SCCE European Compliance & Ethics Institute, Salvador Dahan (LinkedIn), Executive Director, Chief Governance & Compliance at Petrobras will be addressing the company’s ethical journey. He shares some of the story in this podcast.

Petrobras entered into a Non-Prosecution Agreement (NPA) that included a provision that the company had to agree to collaborate with all the investigations underway, not just with the US. The company also agreed to $850 million in fines to authorities in the US and Brazil. And, of course, it was required to improve its compliance program and internal controls.

How did the company go about the transformation? Leadership provided a strong tone at the top. The head of compliance was placed at the Executive Director level and made a part of any major decision in the company. In addition, there is a direct line of report to the board of directors. There is even a formal hiring and termination process for the compliance team to protect the program against retaliation.

The company also embraced a three lines of defense model, with compliance playing an integral role.

Petrobras is continuing along its journey, Salvador reports. They are working to restore employee confidence and helping the workforce see the company is made up of individuals with strong ethical values. Supporting this initiative has been a great deal of communication designed to show that these are real actions, not just words. Every meeting in the company now starts with a five-minute discussion about ethics, integrity and transparency. They have also established a force of more than 200 ambassadors, known as Integrity Agents, to build bridges between the compliance team and the business unit.

What does he recommend for other organizations going through a crisis? Several things:

* Quickly recognize the situation, accept what is happening and begin collaborating

* Talk to employees with transparency, outlining the next steps, long-term commitments, as well as do’s and don’ts.

* Provide a clear sense of direction. It mitigates noise and a lack of confidence.

* Find out your vulnerabilities, and then act as soon as possible.

* Get an independent opinion. An outside voice can be very helpful.

Listen in for more lessons, including how to continue to strengthen your organization, even after the NPA comes to an end.

Post By: Adam Turteltaub

Doctors, nurses and other medical practitioners must keep up often multiple licenses and certifications. There are everything from board certifications to confirmations of inoculations to track.  Adding to the complexity: equipment has its own set of licenses and certifications, and so do the facilities themselves.

Miss a deadline, and it’s not just simply a matter of paying a late fee. It may mean a surgeon can’t operate or a piece of equipment needs to be taken offline, negatively impacting both patient care and the bottom line.

Keeping on top of it all can be a nightmare, explains David Baule, CEO of MISO3 in this podcast. The challenge is amplified by the fact that each certification has its own renewal dates, frequency of renewal, and can be tracked in multiple different places, including third party databases.

How do you stay on top of it all? Like much else in compliance, he advises, by prioritizing. Also, look to automation.

Listen in to learn more about the risks and possible solution.

Post By: Adam Turteltaub

The relationships between Enterprise Risk Management (ERM) and compliance risk management is a complex and confusing one.  There is the potential for overlap and even conflict.

To help clear the air and improve the relationship among the various approaches to risk, Bret Bissey, Vice President, Chief Compliance Officer, Gateway Health and James Rose (LinkedIn), Managing Director, SunHawk Consulting will be leading a session “Establishing the Enterprise ERM/GRC Strategy with Compliance in Mind at the 2022 HCCA Compliance Institute, which will be taking place online and in Phoenix March 28-31.

In this podcast they offer a wealth of advice for compliance teams including:

* Having the right sponsor is key

* This is about having a dialogue cross the organization

* The goal is to help business operators achieve their goals

* A good process helps prevent surprises

* There are naturally going to be some tensions, particularly when it comes to allocating resources

* Expect different views of how much data should be tracked and how useful it will be

* Be sure to capture the goals and interests of the C-suite and board

Listen in to learn more and then join us in person or online for the 2022 HCCA Compliance Institute.

Post By: Adam Turteltaub

The Challenger and Columbia disasters were as instructive as they were tragic, providing countless lessons for organizations, including for compliance and ethics professionals. The January 2022 issue of Ethikos focuses exclusively on them and features an extended article by Professor J. Mark Maier, Founding Chair of the Leadership Program at Chapman University

Professor Maier has dedicated much of his career to studying the disasters and sharing lessons from them, even producing a documentary. Of particular focus for him were the efforts of Roger Boisjoly and Allan McDonald, who refused to sign off on the Challenger’s launch. Professor Maier and McDonald frequently spoke about leading with integrity, including for US Space Command’s Leadership Development Program.

In the latest Compliance Perspectives podcast Professor Maier explores the many ethics issues that led to these disasters. The topics discussed include:

Speaking Truth to Power

It’s not easy for people to speak up to individuals who are more senior than they are. There’s inherent risk, especially when delivering bad news that can imperil a project. Adding to it, management often signals, intentionally or not, that they want things to stay on track, schedule and budget.

This calls for a focused effort by leadership to create a different mindset, one that encourages people to bring up unpopular truths.

Risk Complacency

In the case of the Columbia disaster, the spec was for no foam to fall off the external fuel tank, but it kept happening. In fact, it happened so frequently and with no effect. As a result, NASA grew complacent about the risk, until ultimately the foam did damage a wing and all aboard perished.

The Dynamic of Internal vs. External Risk

It can be too easy to downplay the external risks and focus on the internal risks we perceive to ourselves and our careers.

The Fallacy of “It’s a Business Decision”

Often a decision is treated as “just a business decision” when, in fact, there is an ethical issue at stake. Focusing solely on the results, dollars and cents fails to consider the importance of the means, and not just the end.

The Importance of Little Things

It is easier to fix a problem when it is small than when it is big. However, when it is small it is too easy to ignore until it is too late.

The Value of Servant Leadership

This often-misunderstood term is explained, and Professor Maier argues that when management leads as a servant of common cause rather than from a position just of power, it is far more advantageous.

Listen in to learn more lessons from these two tragedies.

Post By: Adam Turteltaub

Stephen Paskoff has some serious concerns about Diversity, Equity & Inclusion (DE&I) training. The President and CEO of ELI definitely believes training has advantages, but too often he has seen it done improperly.

Sometime is a part of a one and done proposition. Other times he has found the training to be divisive, which runs counter to the unifying message of DE&I. The training proposes stereotypes for a group, which can cause both internal problems, as well as legal risk.

So what’s the right way forward?

First, he argues for recognizing that the purpose of the training, like the DE&I initiative, is to change habits, which is very complicated. The new habits need to be specific, clear and few, and they have to be consistently reinforced.

Second, the training has to align behavior with the values, vision and mission of the organization, not an unattached initiative. It has to be a part of an organization imperative, like sales, quality and innovation.

Communication has to extend beyond the training. Leadership must support it publicly, and so too must line managers.

What else makes for success?

* There needs to be consequences

* The effort must be continuous, like safety, quality and innovation

* The program needs to be seen as bringing values to life

* There needs to be clear standards that are linked to the organization’s growth

Listen in to learn how to make your DE&I initiative and training work.

Post By: Adam Turteltaub

At the 2022 HCCA Compliance Institute, Tonja Wise (LinkedIn), Corporate Director of Compliance, Sharp HealthCare will be leading a session “Your Audit Plan is on Point…but How is Your Moderating Game?”  It’s a very good question, and in this podcast she offers very helpful advice on how to improve your monitoring efforts.

First, since monitoring and auditing are often referred to together as if they are the same thing, she defines the difference between the two.  Monitoring, she explains, tend to come after a problem, or potential one, is identified and there is a need to ensure that the remediation in place is working.

Like other areas of compliance she advises a risk-based approach.  Health care entities should focus on areas of recent government audits or any place they already have a correction plan in place.  Avoid focusing on areas where the risk is low of either an incident or having to pay a substantial penalty.

To have a strong monitoring program in place, Tonja explains, you need an experienced staff and the right software.  An Excel spreadsheet to track things is probably not enough.

Listen in to learn more about how to effectively monitor your healthcare compliance program, and then join us for the 2022 HCCA Compliance Institute.

Post By: Adam Turteltaub

Given the dangers of third-party risk, it’s not surprising that so many organizations have developed supplier codes of conduct. Like everything else in compliance, though, the trick is in just having one, its in having the right one.

Patty Houser (LinkedIn), Compliance Counsel at Land O’Lakes reminds us in this podcast that a supplier code of conduct should be like an internal one: set high expectations ,provide guidance and promote ethical practices. It is also a chance for the company to confirm its commitment to integrity and sound business practices.

The supplier code should be recognized as a statement to suppliers and public about what it stands for, including the company it keeps.

Going much beyond that, and getting too far into the weeds, though, is not advisable she says. There are other documents for getting into the specifics, including the terms of the contract.

When drafting a supplier code she recommends:

* Focusing on the challenges of the jurisdictions with the most risk

* Looking at what your own internal code of conduct says

* Examining supplier codes of others in your industry

* Taking the time to understand the sophistication of your suppliers

* Assessing the risks inherent in the industry

* Reviewing internationally-recognized standards

* Setting expectations and giving guidance

* Asking your suppliers for feedback to see if what you has written is workable. As she warns, “Compliance with the impossible is no compliance at all.”

Finally, don’t forget one other key audience for the supplier code: your organization’s business unit. To secure their buy in, take them back to your own code of conduct and the commitment to doing things the right way. Also, show them the risk of a supplier that doesn’t do things properly, including the reputational damage it can do to your firm.

In the end this is all about finding well qualified business partners that can both supply and protect your business.

Post By: Adam Turteltaub

The pandemic is both increasing burnout and making it harder to differentiate between needing a break and being, well, just completely done.

As Ellen Hunt of Spark Compliance and Melanie Sponholz, Chief Compliance Officer, Waud Capital Partners explain in this podcast (and will also share in their session at the HCCA Compliance Institute), common signs are fatigue (to the point of not wanting to get up and start work), feeling cynical or jaded, irritability, inability to concentrate, not feeling your usual self, and no sense of purpose. Another sign to watch out for: the inability to have a sense of accomplishment. If being able to cross something off of your list no longer brings with it any feeling of reward, it’s a telltale sign of burnout.

To avoid burnout they recommend building a separation between work and not working. That’s harder to do with so many of us working from home, but it’s necessary.

Try to focus on doing some things completely separate from work that make you happy. Anything involving movement – walking, running yoga – can help. Think about things that you used to do at home that filled your cup when you left work. It could be cooking a meal, reading a good book, or spending time with non-work friends (safely, of course).

At work, they recommend three specific behaviors:

* Always assume positive intent. Don’t think that people are out to get you, even if their words may seem a bit hostile.

* Practice the pause. Take a deep breath and ask yourself, “Are they really insulting me, trying or be rude, not understanding?” Ask people why they asked the question or made the decision that they did. It could have just come from a misunderstanding.

* Ask yourself: Do I really care?  Is this something that is going to matter next week or year?

Finally, they advise making that effort to revive and build out your network. It will help you expand beyond the core people you normally interact with and find others than inspire you. It’s also beneficial to talk with others going through similar circumstances to be reminded that you are not alone.

So, schedule that 30-minute virtual coffee, or just send a note to someone you haven’t been in touch with to see how they are doing. Reach out to people you admire. Many will be surprisingly happy to hear of your support and be more than willing to talk.

You can even take the next step of creating something of a board of advisors for yourself.

Listen in to learn more, and then be sure to attend their session at the 2022 HCCA Compliance Institute, which takes place in Phoenix, March 28-31 and is also available online.

Post By: Adam Turteltaub

Markus Juttner, Vice President & Global Head of Compliance at E.ON doesn’t focus on individual blind spots or taboos. Instead, he focuses on the organizational ones. In fact, as he argues in this podcast and will explain during his talk at 2022 SCCE European Compliance & Ethics Institute, he thinks it’s a mistake to focus on the individual.

Since the core task for compliance teams is to prevent, detect and respond to corporate misconduct, it calls for an organizational level of analysis. You need to understand that the organization is an entity of its own.

There are four common challenges that he sees:

* The compliance team not being transparent to the management board: If they ask if the program is effective, you need to be honest and admit if you do not know

* The risk assessment only addresses what we expect to see. There may be other factors we have not thought about.

* A lack of transparency by the business side when reporting to compliance

* The habits that are normal and a part of life in the organizations

All of these can have dramatic effects on the compliance program, and all reflect the culture of the organization. As a result, it is essential to take the time to determine what the culture is, as well as the many subcultures.

Listen in to learn more and then join him at the 2022 SCCE European Compliance & Ethics Institute.

Post By: Adam Turteltaub

There are a lot of good reasons to do a periodic review of your healthcare compliance program, not the least of which is that the government expects it.

But when’s the right time?  How do you get the management support?  What outside experts do you need?  And how do you integrate the results into your workplan?

Those questions are tackled by Anne Daly, Vice President of Compliance, Samaritan health System, Judy A. Ringholz, Vice President of Compliance and Ethics & Chief Compliance Officer, Jackson Health System and Steven W. Ortquist, Founder & Principal, Arete Compliance Solutions in this podcast and at their session “How to Assure that Your Next Compliance Program Review Confirms Performance and Helps Improve Your Compliance Program” at the 2022 HCCA Compliance Institute.

It’s important, they explain, to make sure that you have your arms around the program before you begin the review.  If you’re new to the role, you probably don’t know enough about the program to make the review as successful as it could be.

Once you feel that you are ready and that it’s time to have outside eyes review the program, it’s important to select a vendor with healthcare-specific experience, ideally with experience interacting with enforcement.  Make sure they also have a solid understanding of the government’s expectations as well as your organization’s goals.  Be sure they also are well versed in the fiduciary duties of healthcare boards and have the personal presence to be able to present to the board.

One thing else to do: make sure the consultant is reasonable.  You want someone who will give you actionable recommendations, not someone caught up in a quest for perfection.

Be prepared to dedicate significant staff resources to help the review, most likely including a dedicated person who will be on point for the project.  A consultant is going to need your team to provide a lot of documents about the program and assistance in scheduling interviews with key employees.

Once the work is done and the report is drafted, it’s a good idea to review it with the consultant to make sure that he or she truly understands the organization and didn’t misinterpret any information.

Be sure also to meet with the board and key leadership so that they understand the purpose and benefits of the review, including that it is a part of their fiduciary duty to have an effective compliance program.

And, be sure to bring your workplan to the final presentation to the board.  That’s an ideal time to both demonstrate what you plan on doing and ask for the resources you need to get the job done.

Listen in to learn more, and then join us in Phoenix (in person or virtually) March 28-31 for the 2022 HCCA Compliance Institute.