Case Study in Compliance: Mountain or Molehill?

Case studies in compliance are based on situations presented to working compliance officers-often as in-person reports or hot line calls. Selected case studies proved problematic to the compliance officer in receipt of the report. Case studies in compliance are not public domain. Most case studies, including this month's, are copyrighted and you need the specific written permission of the copyright holder to copy or quote the case.
 
This month's case concerns the sticky issue of management certifications. An executive for a health plan opts not to report a potential compliance situation recently brought to her attention because she doesn't have enough information. By failing to report to the compliance officer what she does know, has this executive herself committed a compliance infraction?

The Case

The executive team for a health plan is asked to sign a document certifying that they are not aware of any ethics or compliance issues in the organization, which they have not already discussed with the compliance officer. Recently, one senior executive has been made aware of a situation-albeit with only very sketchy details from an inexperienced manager who has a history of sometimes overreacting to situations-which could have compliance implications.

This executive is reluctant to discuss it with the compliance officer because she (the executive) is fearful that the compliance officer will make a "big deal" out of the situation. The situation may not amount to anything (especially given the reporting manager's history and inexperience). But then again it may. The executive feels she needs to investigate the matter further, to get more information, before deciding whether or not to talk to the compliance officer. So she decides not to talk to the compliance officer for the time being. And she signs the management certification stating that she is not aware of any issues.

Has this executive herself now committed a new compliance infraction, by betraying the purpose of the certification process and failing to report an issue?

Discussion

This is a difficult judgment call, the kind of judgment call executives make all the time which falls in the gray area of management decision-making. Whether or not to disclose the facts of the situation to the compliance officer, to the degree that those facts are known, depends to a large degree on the executive's assessment of the situation. The fact that her manager is inexperienced and has a history of sometimes overreacting complicates matters. The executive needs to ask herself, "In a worse case scenario, how bad could this situation turn out to be?" If the answer is "pretty bad," she should take whatever she has to the compliance officer.

The executive's reluctance to disclose the issue to the compliance officer is understandable, especially since she does not yet have a full grasp of the issue she might be disclosing. Moreover, both she and the compliance officer both have extremely demanding sets of responsibilities, which require the efficient use of their time. However, leaving the form blank and signing it anyway is probably a mistake.

The executive could have considered other ways of dealing with situation. Without getting into all the details, she could have discussed with the compliance officer that she cannot sign the form immediately, because she needs time to gather information about a potential situation recently reported to her. She could also indicate that an inexperienced manager has brought the issue to her attention and she needs to determine whether or not the manager is overreacting.

If there is an aggressive completion date for the management certification process, which the executive cannot meet, another approach would be for her to request additional time from the CEO (with a copy of the request to the compliance officer).

A third approach would be for the executive to note on the management certification form that she is conducting an initial review of a situation, and will report to the compliance officer as necessary. Signing such a statement would be consistent with the purpose of the certification process.
The management certification process is a delicate and important one. (See the June 1999 issue of the Pastin Report for a detailed discussion).

Compliance officers are well advised to position this process, as well as their function in relation to this process, as a resource to managers and executives, not as the latest version of "gotcha." Compliance must be given a clear mandate to investigate compliance sensitive issues, which arise within the organization. However, even with the support and oversight of compliance, executives must be given latitude to manage e.g. giving them some time and some space to gather enough information initially to determine whether or not an investigation is warranted.

What is not clear from the facts of this case is whether the compliance officer himself has contributed to the problem by overreacting to situations in the past, causing other executives to pause before raising issues or asking questions. One of the most delicate balancing acts for compliance is responding appropriately to the severity of issues: neither underreacting nor overreacting. On one hand, when the compliance officer underreacts to a situation that turns out to be substantial and serious, he or she puts the organization in grave danger. But on the other hand, if the compliance officer overreacts, this may discourage peer managers and executives from picking up the phone just to talk something over with you.

The Council of Ethical Organizations operates Talk-About-Compliance as a resource for ethics/compliance officers seeking discussion of and viewpoints on specific compliance questions. Subscribe to Talk-About-Compliance at no charge by visiting our web site at http://www.complianceprograms.com.


The material in this area is proprietary and protected by copyright registration to the Council of Ethical Organizations. Reproduction or dissemination-by any means-including photocopying and transmittal by FAX-is a violation of federal copyright law (17 USC 101 et seq) punishable by fines of up to $100,000 per violation. Violators will be prosecuted. Do not copy, quote, duplicate electronically or by any means disseminate without specific written permission.