Compliance Perspectives

By Adam Turteltaub

During the typical due diligence period for an acquisition, the accountants are all over every financial risk, but compliance-related risks are very real and potentially just as expensive.  If compliance isn’t involved it could be very expensive.

Ted Banks, a compliance-profession veteran and partner at Scharf, Banks Marmor argues persuasively in this podcast that compliance has to have a seat at the table and dive right in.

Once involved, the compliance team has to realize that it can’t rely on off the shelf analysis.  You need to map to the current risks in the marketplace.  Also, you need to be wary of your business partners.  Someone pushing to close the deal too quickly may be hoping a risk stays hidden or just be unaware of potential risk areas.

When examining the company being acquired, look at its history of litigation and regulatory issues.  Also, take the time to understand whether their method of doing business has been or may be altered by changes in laws, regulations and even public sentiments.

Be sure to also examine their social media presence.  Are they careful in their communications?  Are their followers real or purchased?

And, of course, bring in experts to assess their products and services to help sure you understand the risks in them.

Listen in to learn more about how to make your due diligence process more effective and better able to mitigate the inherent risks.

By Adam Turteltaub

In a surprising web conference, Brian Lee, Managing Vice President at Gartner, shares some eye-raising insight into what’s going on when it comes to third-party risk management.  Recent research there reveals what he reports to be a disproportionate emphasis on initial due diligence versus ongoing auditing and monitoring.  Their research found that organizations typically spend three-fourths of their time on the initial due diligence, and just one quarter on ongoing monitoring.

That’s out of balance for several reasons, he argues.  For one, it’s one of the factors that has led to an increase in initial due diligence times to 90 days, up 20 days from four years ago.  In addition, they discovered that 83% of compliance executives found third party risks after the initial due diligence, 31% of those risks had a material impact, and 92% of executives reported that those risks would not have been found during the initial review phase.

By contrast, their research found that ongoing monitoring made companies 1.5 times more likely to surface risk, twice as likely to be able to remediate it and four times more likely to satisfy their business partners with their speed.

Listen in to learn more about optimizing the balance between initial and ongoing auditing and monitoring.

By Adam Turteltaub

Internal investigations are fraught with complexities, and while it is easy to focus on the practical complications, it’s also important to be aware of the ethical ones as well.

In this podcast Julie Myers Wood, CEO of Guidepost Solutions explains that the ethics questions have to be addressed throughout, starting with treating the complainant with respect.  That includes being sensitive to the nature of the allegation, particularly in cases of sexual harassment or assault.

It also means setting reasonable expectations of how much, if at all, you will keep a complainant in the loop, protection against retaliation.

Turning to the subject of the investigation, it’s important to ensure he or she is treated fairly and understands what steps the company will be taking to ensure a fair process.

Throughout, having written policies and procedures can be exceptionally helpful, she points out, in helping everyone understand how to keep the process on track and fair.

Listen in to learn more about how to ensure that your investigation is done right, both from a practical and ethical perspective.

By Adam Turteltaub

A compliance program is only as good as its team, and keeping the team operating at its best can be a challenge given the stress and pressure, observes Lisa Beth Lentini Walker, a compliance industry veteran, and CEO and Founder of Lumen Worldwide Endeavors.  The problem, she shares in the podcast, is one that’s endemic to the world of risk and partially explains the high rate of turnover.

So, how do you succeed as a team leader or member?  Fortunately, there are good guideposts for boosting job satisfaction, such as creating opportunities for growth and to have an impact.  If you can provide those, you are much more likely to have an engaged team.

Likewise, there is a need to manage the stress level.  If it gets too high, research shows, the rational brain starts shutting down and the emotional side takes over.  Fortunately, here, too, there are strategies to overcome the challenge.

Listen in to gain more insight from Lisa Beth as to how to make your team more collaborative and successful.

By Adam Turteltaub

It’s hard to find a company that doesn’t do compliance training and it’s also hard to find a company that isn’t trying to avoid training burnout.

Neil Cullen, Director of Client Learning at Interactive Services in Ireland, and Johan Thorell, senior Director EMEA Compliance & Data Privacy at CWT have spent a great deal of time considering this problem.  In this podcast -- a preview of their session at the 2020 European Compliance & Ethics Institute -- they recommend compliance teams focus on three areas when it comes to training:

* Content:  Remember that even if the content stays the same year to year it can be framed differently each time

* Technology: Be sure to take advantage of new ways to deliver engaging content across multiple devices

* Design: Use imagery that is reflective of media people consume in their day to day to life

Listen is as they also discuss the balance between short and long-form training, designing training so that it can be edited easily, making it look like it’s your training and not something off the shelf, and other ideas for making your compliance education initiative a more effective one.

By Adam Turteltaub

Earlier in 2019, the European Parliament adopted a new EU Whistleblower Directive.

To better understand these new rules and their implications we sat down for a discussion with Vigjilenca Abazi, Assistant Professor at Maastricht University and Mary Inman, a partner at the law firm Constantine Cannon LLP, which represents whistleblowers.  They will be addressing the EU Whistleblower Directive at the 2020 SCCE European Compliance and Ethics Institute in Amsterdam.

In this podcast they answer three key questions about the Directive:

* Who does it cover?

* What does it cover?

* How does it work?

They also explore the differences vs. the US whistleblowing model, the interaction of the Directive with GDPR (click here to listen to another podcast on the topic) and the opportunities the Whistleblower Directive provides for reorienting mindsets.

Listen in to learn more, and to learn still more, join their session in Amsterdam in March 2020.

By Adam Turteltaub

The FBI wants you, but it’s not why you think.  Spencer Evans, the Section Chief in the Office of the Private Sector (OPS), explains that the OPS is here to help and wants you to get involved.

He begins the podcast by explaining that the FBI’s mission is to protect the American people and defend the Constitution.  The mandate of OPS, as a part of that mission, is to protect the economic security interest of the US by fostering relationships with the private sector.

There are two programs that he suggests businesses consider becoming a part of.  The Domestic Security Alliance Counsel (DSAC) is comprised of Fortune 1000 companies that are involved in critical infrastructure and the national security of the US.  The approximately 590 members of the program enjoy bilateral sharing of information about critical threats and help identify new trends in issues such as the targeting of US businesses by foreign adversaries.  These include terrorism (both foreign and domestic) and hostile nation-state actors engaged in espionage and stealing trade secrets.

InfraGard is similar to DSAC, in that is a partnership with the private sector, but while DSAC members are organizations, InfraGard is open to individuals.  It has over 65,000 members who are involved in protecting critical infrastructure.

As you listen to his remarks, you’ll learn about how you and your organization may benefit from these two programs within OPS.  You will also gain a better understanding of how to contact the FBI should your organization come under attack, as well as what to expect once you do.

By Adam Turteltaub

The Medicare Access Clause at first glance seems simple.  If you are a Medicare provider who has subcontracted patient services (other than equipment and supplies) worth $10,000 or more over a year then you must include in that subcontract a clause “….that allows the Comptroller General of the United States, HHS, and their duly authorized representatives access to the subcontractor’s contract, books, documents and records until the expiration of four years after the services are furnished under the contract or subcontract.”

According to Courtney Blau, Administrative Director of Risk Management & Compliance at Norman Regional Health System in Oklahoma, the seemingly simple provision must be applied carefully and diligently.  If the contract does not contain the Access clause then Medicare has the right not to reimburse services provided.

It’s essential that compliance teams work with the contracts team, she argues in this podcast, to ensure that all new contracts contain the clause.  In addition, compliance and contracts need to assess which contracts this applies to, beginning by auditing all the service contracts.  Then determine when amendments to the agreement are needed.

Listen in to learn more about your organization’s obligations under the Medicare Access Clause.

By Adam Turteltaub

It’s not easy getting buy-in for a compliance and ethics program.  Too often people feel as if they already know the information or see compliance as unduly expensive and unnecessary.

Beth Colling, Vice President and Chief Compliance Officer, CDM Smith argues in this podcast that compliance teams need to think like marketers to get the buy-in they need and make the compliance program fully a part of the business.  Know your stakeholders, she advises, and understand what’s motivating them.  From there create a strategic plan, including a marketing plan, to help them achieve their business goals.  Other advice she gives includes:

* Figure out your key touchpoints with management and what resonates with them

* Tell stories instead of just reciting facts

* Help business people know that big problems tend to start out with small ones that aren’t handled properly

* Make sure that people in your organization have a common definition of compliance

* Develop key allies, including the general counsel’s office, HR, marketing and finance

Listen in to learn more about how you can make your compliance program truly a part of your business.

By Adam Turteltaub

Even the best compliance initiative can’t survive a bad rollout.  That’s why it’s essential that the planning is done properly.

In this podcast Grace Wu de Plaza, Director, Compliance & Corporate Integrity, Farmer Mac, advises that before embarking on a new initiative compliance officers should think about three things first:

* How you will communicate the importance of the initiative to senior leaders to get their go-ahead

* How to socialize the idea with key stakeholders to help them become your champions

* How to continually market post-launch

Grace points out the third point is a critical one, since ongoing support is so important to a program’s success.  Key elements of the continuous marketing plan include milestones, specific tasks and dates, and ensuring employees know their roles and responsibilities.  And, of course, you need metrics to provide measurable results.

Listen in to learn more about how to ensure your compliance initiative is properly planned and successfully implemented.