From Title IX to FCPA, what your investigations say about overall compliance

What can your investigations function say about the overall health of your compliance program?

Turns out: A lot.

Whether you’re dealing with human subjects research, civil rights or Title IX, conflicts of interest, or FCPA matters, your investigations (or dispute resolution) systems can be a goldmine of insight into how well you’re really living up to your compliance goals — whether those are from the U.S. Sentencing Commission, your accreditor, or your own internal benchmarks.

Compliance programs can be designed for any risk area, and the overall structure outlined by U.S. Sentencing Commission guidelines is a useful tool to help guide your program design. As a quick recap, here are the requirements of an effective compliance program:

1. Implementing written policies and procedures
2. Designating a compliance officer and compliance committee
3. Conducting effective training and education
4. Developing effective lines of communication/reporting
5. Conducting internal monitoring and auditing
6. Enforcing standards, including through consistent disciplinary mechanisms
7. Responding promptly to detected problems and undertaking corrective action

So where do you even start in assessing whether your risk area is responsive to these requirements? The investigations function can serve as an excellent window into your compliance program.

So, let’s do a quick “Investigations 101” check-in, starting from the top:

How do you learn of alleged misconduct?
Hopefully through an effective reporting mechanism. Effective reporting may look different depending on your organization size, populations (employees, students, patients), etc. But the heart of effective communications and reporting is the accessibility of the process. Are there multiple ways for employees to report issues (phone, email, online forms, through managers)? Can employees report anonymously? Are the appropriate populations provided training on reporting mechanisms, so they know where to go when something comes up? Is it easy to find the reporting information on employer websites, intranet, in workspaces, etc.?

This satisfies component 4, Communications / Reporting Systems.

How do you provide due process?
In an investigation, it is best practice to provide a respondent information about the specific policy they are accused of violating. If you can do that, it means you have the policies in place. If you struggle to identify a policy that applies to a specific situation that you would describe as “misconduct,” it may be time to consider updating those policies to make sure they are appropriate for your situation.

This satisfies component 1, Policies and Procedures.

Also in the due process category is the question: Are individuals trained on policies before being held accountable to them? If you have policies that you expect to be upheld by the folks in your organization, how can you expect them to do their part if they are not informed of those policies? Training and awareness campaigns play and important role in creating the culture you wish to have and ensuring fairness when it comes time to hold folks accountable.

This satisfies component 3, Training.

How do you review and respond to allegations?
Some states, like California, have requirements in law regarding how investigations must be conducted into certain issues. Regardless of whether you are in California, an effective compliance program would demand that investigations—whether conducted by internal staff or an external investigator—be prompt, thorough, and impartial.

This satisfies component 7, Responding Promptly to Issues.

What happens when it’s over?
After the fair, thorough, and impartial investigation, then what? Accountability and appropriate corrective action, of course (right?). The consistent application of disciplinary standards is crucial to developing trust among your different populations, whether customers, employees, patients, or students.

This satisfies component 6, Enforcing Standards.

What’s left?

In just that quick run-through, we gleaned tremendous insight into five of the seven elements of an effective compliance program.

So what remains?

Component 2: Assigning compliance leadership (Maybe that’s you? Nice, there’s six.) 

Component 5: Having auditing and monitoring systems in place. But even going through this exercise gets you closer to effective auditing and monitoring (boom, seven!).

Your investigations aren’t just about resolving issues — they’re a window into how your compliance culture works in practice. I hope this roadmap allows you to rip off the band-aid of compliance jargon and dig into assessing whether your compliance program is living up to its mission. And if you’d like some help, please reach out.

---

About the Author

---