MD - Health Care Compliance Association

including the three objectives set forth under
COSO: financial reporting, operating efficiency
and effectiveness, and compliance
with applicable laws and regulations. Most
companies and their auditors will use the
COSO framework, which has been deemed
suitable by the PCAOB for purposes of management’s
assessment. 6 The COSO integrated
framework includes five components of
internal control (Control Environment, Risk
Assessment, Control Activities, Information
and Communication, and Monitoring) that
are also acknowledged by the PCAOB.
SOX refers explicitly to controls related to the
prevention, identification and detection of
fraud. And the PCAOB repeatedly notes that
strong internal controls provide better opportunities
to detect and deter fraud. 7 Although
antifraud programs and controls must include
all five components of COSO, special
emphasis is placed on the control environment,
8 such as tone at the top, because of its
pervasive effect on the achievement of many
overall objectives of control criteria.
Amendments to the Organizational
Sentencing Guidelines
Prior to SOX, the U.S. Sentencing
Commission adopted the Federal Sentencing
Guidelines (FSG) which introduced the
seven criteria for management of ethics and
compliance risk, 9 and that have served as the
primary framework for compliance program
effectiveness. The FSG and COSO frameworks
share many characteristics. Much of
the FSG criteria are contained in the components
of COSO, especially under the control
environment. However, a main distinction is
that as a practical matter, the FSG only
requires evaluation of its elements when a
company is seeking to mitigate penalties for
corporate misconduct. Additionally, if a
Department of Justice attorney finds that a
truly effective compliance program has been
implemented, this “may result in a decision
to charge only the corporation’s employees
and agents” and not the organization itself. 10
This year the U.S. Sentencing Commission
voted to amend the existing guidelines. 11
These amendments narrow even further the
differences between the Guidelines and the
COSO framework. Many of the same forces
that led to the Sarbanes-Oxley requirements
had led to the initiation of the FSG and the
new amendments.
The amendments approved by the
Commission make the standards for compliance
and ethics programs more rigorous and
put greater responsibility on boards of directors
and executives for the oversight and
management of such programs. Board directors
and senior management must now take
active roles in the content and operation of
ethics and compliance programs. Similarly,
SOX devotes considerable attention on how
to ensure adequate board and management
oversight.
Significantly, the FSG states that the organization
must issue standards of conduct and
internal control systems that reduce criminal
activity and detect and prevent violations
of law. Just like SOX, the organizational sentencing
guidelines recognize the value of
internal controls and view them as an essential
feature of an effective compliance program.
Under the FSG, internal controls are
tied to risk assessment and monitoring activities—also
to COSO components.
The value proposition
As noted, many of the attributes of the
COSO components and their points of focus
implicate a compliance program under the
organizational sentencing guidelines. The
amendments to the FSG are therefore a
means for a compliance officer to get more
involved in Sarbanes-Oxley compliance. The
function is pivotal because many of the compliance
processes undertaken by the compliance
program can be applied to the SOX
internal control requirements.
Yet in most cases, SOX is managed out of a
unit under the purview of the controller’s
office or internal audit. And most of those
outside a compliance or legal department are
unaware of the compliance standards under
the FSG. As a result, many in charge of managing
SOX 404 implementation or assessment
are not familiar with the elements of
effective compliance processes.
What should be apparent is that involvement
in the SOX internal control process can set
the stage for demonstrating compliance effectiveness
to mitigate penalties if the occurrence
of fraud or corporate misconduct
should occur. Given the overlap between the
FSG and SOX, it makes sense to leverage
and integrate compliance program activities
with those of SOX internal control implementation
and assessment. What are likely to
emerge are the best practice standards that
for organizations can also serve as a demonstration
of compliance program effectiveness
to the government.
The following are areas of opportunities for
an organization contemplating a formal compliance
program, or for an existing compliance
officer to consider:
Integration of control processes. There is
often a tendency to compartmentalize compliance
responsibilities (e.g., SOX, FSG, industryspecific
legal mandates, etc.). But consider the
benefits to managing these processes with similar
controls and technology. Otherwise organizations
can face inefficient and ultimately fragmented
compliance processes. A compliance
Continued on page 42
Health Care Compliance Association • 888-580-8373 • www.hcca-info.org
January 2006
41