Compliance Perspectives

By Adam Turteltaub

Both HIPAA and the HITECH Act have been around forever in compliance years, but that doesn’t mean that the challenges they pose have all been met.

In fact, Adam Greene, a partner at Davis Wright Tremaine in Washington, DC explains that the risks keep changing because technology keeps evolving.  Big data, Artificial Intelligence and machine learning are all changing the playing field, not to mention ransomware, information sharing and interoperability.

In our talk together on this podcast he speaks to the dynamic environment as well as some of the issues compliance teams are facing when dealing with the regulators.  It’s a topic he knows well, having seen it from both sides.  Before his current tenure in the law firm, he served at HHS in the Office for Civil Rights (OCR).

Some of the other topics he discusses include:

* The disconnect between how information security professionals look at security vs. what OCR wants to see in compliance documentation

* Ongoing difficulties in enabling patients to access and share their health data

* Vendor management after the business associate agreement is in place

* The European General Data Protection Regulation (GDPR), and not over or under-reacting

* How best to approach regulators after a breach occurs

Listen in.  He provides a good guide to changing times for this substantial compliance risk area.

By Adam Turteltaub

As CEO of Klink & Co., Jeff Klink has a unique and broad perspective on the challenges of global compliance programs, especially those operating in Asia.  Lately, he reports in this podcast, he has seen a rise of troubling kickback schemes plaguing large global manufacturers.  Employees are finding creative ways to get kickbacks, even setting up fictitious shell companies that appear independent.

It’s a problem that, while not exactly a compliance issue, that should send up red flags for the compliance department because it points to weaknesses in third-party due diligence efforts that rely on database searches.  It often takes a site visit – one that exposes that the “company” address is actually just a studio apartment – to reveal the problem.

What else should compliance teams do?  First, he advises, use a risk-based approach which invests more resources into higher risk areas.  In addition, focus on high-dollar vendors.

Then don’t stop with the initial due diligence.  Ongoing auditing and monitoring are essential.  He notes that many companies do comprehensive due diligence of existing vendors every few years, especially those that interact with government officials.

Listen in, and maybe share the podcast with your fraud team

By Adam Turteltaub

As CEO of Klink & Co., Jeff Klink has a unique and broad perspective on the challenges of global compliance programs, especially those operating in Asia.  Lately, he reports in this podcast, he has seen a rise of troubling kickback schemes plaguing large global manufacturers.  Employees are finding creative ways to get kickbacks, even setting up fictitious shell companies that appear independent.

It’s a problem that, while not exactly a compliance issue, that should send up red flags for the compliance department because it points to weaknesses in third-party due diligence efforts that rely on database searches.  It often takes a site visit – one that exposes that the “company” address is actually just a studio apartment – to reveal the problem.

What else should compliance teams do?  First, he advises, use a risk-based approach which invests more resources into higher risk areas.  In addition, focus on high-dollar vendors.

Then don’t stop with the initial due diligence.  Ongoing auditing and monitoring are essential.  He notes that many companies do comprehensive due diligence of existing vendors every few years, especially those that interact with government officials.

Listen in, and maybe share the podcast with your fraud team

By Adam Turteltaub

These days it seems that most helplines are handled by external providers.  But, not ever company goes down that route.  For Brendan LeMoult, Fiscal Affairs and Anti-Illicit Trade Vice President at JTI, having an internal whistleblower line has distinct advantages.

As he explains via this podcast, the company takes allegations itself and uses an internal investigations group for all its investigations.

Employees are first encouraged to raise issues with line managers or persons they have concerns about.  If that doesn’t work, they have three ways to report anonymously or confidentially.  First, they can log on to an online portal.  Second, the company has about 250 contact persons throughout the company who have been trained to address concerns.  The third option is to come directly to corporate compliance and raise their issue.

Once a concern is raised, the compliance team will examine if the concern is in scope — addresses code of conduct, policies or procedures or violation of law, rather than a routine personnel issue.  If it is in scope the allegation goes to the Business Ethics Committee which decides whether to refer the matter for a full-blown investigation.

The goal of the process is to make sure that the person who raises the concern has the confidentiality/anonymity that they want, and the investigation process has sufficient independence.

Listen in to learn more about the process, including the ongoing reviews of active investigations.

By Adam Turteltaub

These days it seems that most helplines are handled by external providers.  But, not ever company goes down that route.  For Brendan LeMoult, Fiscal Affairs and Anti-Illicit Trade Vice President at JTI, having an internal whistleblower line has distinct advantages.

As he explains via this podcast, the company takes allegations itself and uses an internal investigations group for all its investigations.

Employees are first encouraged to raise issues with line managers or persons they have concerns about.  If that doesn’t work, they have three ways to report anonymously or confidentially.  First, they can log on to an online portal.  Second, the company has about 250 contact persons throughout the company who have been trained to address concerns.  The third option is to come directly to corporate compliance and raise their issue.

Once a concern is raised, the compliance team will examine if the concern is in scope — addresses code of conduct, policies or procedures or violation of law, rather than a routine personnel issue.  If it is in scope the allegation goes to the Business Ethics Committee which decides whether to refer the matter for a full-blown investigation.

The goal of the process is to make sure that the person who raises the concern has the confidentiality/anonymity that they want, and the investigation process has sufficient independence.

Listen in to learn more about the process, including the ongoing reviews of active investigations.

By Adam Turteltaub

When it comes to compliance due diligence during a merger or acquisition, the number one thing to know, says Kasey Ingram of ISK Americas, is that regulators expect it as a part of an effective compliance program.

Even if the regulators didn’t have these expectations, it’s just plain prudent, he argues.  And, it helps the compliance department demonstrate the value it provides.

So how can and should compliance be involved?  According to Kasey, it begins with having a seat at the table.  Introduce yourself to the M&A team even before a deal is in the works.  Deals happen fast;  if you’re not there at the start you may be left out.

Once the deal begins, create a questionnaire for the business team to use to identify issues.  Do a quick risk assessment even before you begin the questionnaire, looking at the industry and the company’s history.

The answers to your questionnaire can help identify potential issues which should be discussed with the M&A team.  They can then decide if the risks are worth taking or even price them into the deal.

Also, recognize that when the deal closes the real work begins.  Compliance needs to do additional due diligence, and the company may need to self-report if violations are found – there are strong incentives to do so.

In many ways, after the deal closes is the trickiest time for compliance.  It’s essential to have a checklist of things you will need to do, and be prepared for culture clashes: no two businesses have the exact same culture.

Handle it all correctly and you could help both stem legal problems, and reduce internal friction.

Listen in to learn more.  And for still more insights, consult the Complete Compliance and Ethics Manual.

By Adam Turteltaub

When it comes to compliance due diligence during a merger or acquisition, the number one thing to know, says Kasey Ingram of ISK Americas, is that regulators expect it as a part of an effective compliance program.

Even if the regulators didn’t have these expectations, it’s just plain prudent, he argues.  And, it helps the compliance department demonstrate the value it provides.

So how can and should compliance be involved?  According to Kasey, it begins with having a seat at the table.  Introduce yourself to the M&A team even before a deal is in the works.  Deals happen fast;  if you’re not there at the start you may be left out.

Once the deal begins, create a questionnaire for the business team to use to identify issues.  Do a quick risk assessment even before you begin the questionnaire, looking at the industry and the company’s history.

The answers to your questionnaire can help identify potential issues which should be discussed with the M&A team.  They can then decide if the risks are worth taking or even price them into the deal.

Also, recognize that when the deal closes the real work begins.  Compliance needs to do additional due diligence, and the company may need to self-report if violations are found – there are strong incentives to do so.

In many ways, after the deal closes is the trickiest time for compliance.  It’s essential to have a checklist of things you will need to do, and be prepared for culture clashes: no two businesses have the exact same culture.

Handle it all correctly and you could help both stem legal problems, and reduce internal friction.

Listen in to learn more.  And for still more insights, consult the Complete Compliance and Ethics Manual.

By Adam Turteltaub

Sometimes you have to move on, whether it’s because your current compliance and ethics position isn’t working out, or because opportunity comes knocking.

Steve Harrison of Conselium works with compliance professionals looking for new job opportunities and for companies looking to hire them.  He took time at the 2018 Compliance and Ethics Institute to record this podcast and to offer advice, starting with resume writing.

He warns against resumes that are too internally focused, using, for example, abbreviations that only relate to the company and business that a candidate is working in.  For obvious reasons, resumes like this don’t translate externally.  Instead, he advises trying to portray yourself as generally capable, not just really good at what you do at your company.

It’s also important, he advises, to get into the mindset of the person reading the resume.  Include information such as how many people report to you, the structure of your organization and projects that you led.

What about at the interview?  He advises doing your due diligence before walking in the door.  Find out what the compliance reporting line is to see if there is appropriate independence.  Be sure to also go online to determine if the company has been in the news lately and for what.

To stand out in an interview, bring ideas with confidence and talk about how you would approach the role and the program.  Also show a genuine interest in the business.  Ask the person interviewing you about their past work and what they like about working at the company.

Listen in to his podcast to learn what can make you a more attractive candidate.

By Adam Turteltaub

Sometimes you have to move on, whether it’s because your current compliance and ethics position isn’t working out, or because opportunity comes knocking.

Steve Harrison of Conselium works with compliance professionals looking for new job opportunities and for companies looking to hire them.  He took time at the 2018 Compliance and Ethics Institute to record this podcast and to offer advice, starting with resume writing.

He warns against resumes that are too internally focused, using, for example, abbreviations that only relate to the company and business that a candidate is working in.  For obvious reasons, resumes like this don’t translate externally.  Instead, he advises trying to portray yourself as generally capable, not just really good at what you do at your company.

It’s also important, he advises, to get into the mindset of the person reading the resume.  Include information such as how many people report to you, the structure of your organization and projects that you led.

What about at the interview?  He advises doing your due diligence before walking in the door.  Find out what the compliance reporting line is to see if there is appropriate independence.  Be sure to also go online to determine if the company has been in the news lately and for what.

To stand out in an interview, bring ideas with confidence and talk about how you would approach the role and the program.  Also show a genuine interest in the business.  Ask the person interviewing you about their past work and what they like about working at the company.

Listen in to his podcast to learn what can make you a more attractive candidate.

By Adam Turteltaub

While there is much discussion of the challenges in due diligence and third-party vetting in China, Russia and Africa, the risks and challenges don’t end there.  As Milos Stopic, Compliance & Ethics Officer, Middle East and Eastern Europe for Louis Berger International explains, when doing business in Eastern Europe and the Western Balkans it is a necessity as well.

Happily, he reports in this podcast, it is increasingly becoming much more common and expected.  More companies are adopting due diligence standards, and even large companies are receiving more requests to give information about their compliance programs.

But despite the progress, there is still resistance, mostly based on a lack of understanding as to why a company conducting due diligence is even asking questions in the first place.  That problem is often exacerbated by a lack of understanding of compliance programs.

Listen is as Milos explains the challenges and what can be done to overcome resistance and help improve your due diligence efforts.