MD - Health Care Compliance Association

By José A. Tabuena
JOSÉ A. TABUENA
Editor’s note: José A. Tabuena is with the
Forensic & Dispute Services practice of
Deloitte Financial Advisory Services and
assists organizations in the development
and assessment of corporate compliance
and anti-fraud programs. He is currently
an Assistant Editor with Compliance &
Ethics for The Society of Corporate
Compliance and Ethics (SCCE). This article
was originally published in Compliance
& Ethics (Vol. 1, No. 2), page 10,
November 2004. HCCA members interested
in learning more about Compliance &
Ethics can visit the SCCE Web site at:
www.corporatecompliance.org or e-mail
José at jtabuena@deloitte.com
How did “internal control”
become such a catch phrase in
the current business climate For
the experienced auditor, the terminology and
underlying concepts, though frequently used,
are deceptively simple and often ill-defined
or applied in an assumptive manner.
Just what are internal controls and what can
happen to a company’s performance (and
stock) if the controls aren’t very good Often
it is not well understood that a compliance
and/or antifraud program itself serves as a
broad form of internal control. Certainly the
features of such programs can comprise the
fundamentals of a company’s internal control
system.
In certain highly regulated industries (including
health care, defense contractors, financial
institutions), an ethics-based compliance or
integrity program headed by a compliance
officer with senior management responsibility,
have produced an established track record
for the processes called for in the corporate
governance reforms. Yet the recent legislation
and resulting standards, though touting useful
principles, still fail to recognize or emphasize
a compliance program as an essential element
for enhancing corporate governance. 1
The changing legal and regulatory environment
is encouraging companies to do what
compliance officers and internal auditors have
been striving to accomplish for some time—
namely to consider compliance and fraud prevention
programs as a significant part of an
organization’s internal controls. To a growing
extent, regulators and investors are demanding
proactive compliance and fraud control programs
characterized by an emphasis on the
timely detection of fraud or other misconduct.
The changing mindset places greater emphasis
on internal controls, and particularly in the
United States, the Committee of Sponsoring
Organizations of the Treadway Commission
(COSO) internal control framework.
This fundamental shift presents an opportunity
for ethics and compliance officers to
become more actively involved in corporate
governance matters and to demonstrate tangible
value to an organization. For the compliance
function, which may have been chafing
under ambiguous accountabilities and perhaps
perceptions that compliance programs
only contribute burdensome processes, the
environment is encouraging greater expectations
to support efforts to combat corporate
fraud and misconduct. Although there are
some studies indicating that compliance and
antifraud programs can pay for themselves 2 it
has been a challenge for a compliance program
to show value beyond the prevention of
uncertain regulatory fines and penalties.
Sarbanes-Oxley (SOX) and corresponding regulatory
changes have raised the stakes for senior
management and the board of directors.
What follows is a discussion on how a compliance
function can contribute to meeting the
new requirements to assess the effectiveness of
internal controls over financial reporting,
while simultaneously laying the groundwork
for documenting and demonstrating the effectiveness
of the compliance program. This is
unquestionably an opportune time to embrace
the new financial governance standards as a
bridge to overall compliance excellence.
Continued on page 40
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org
January 2006
31