Compliance Program Framework

WVSOM is committed to meeting the legal obligations that govern its many activities. Those obligations are often complex and require coordination among several departments. The Compliance Framework identifies the critical components of any effort to achieve compliance. The WVSOM community will be able to meet its compliance obligations more efficiently and effectively if we share a common framework for communicating about and tackling compliance.

Step 1: Clarify Obligations

Understanding what is required and what isn’t. This is the necessary first step in meeting our legal obligations.

The most common sources of compliance obligations are:

Federal laws, regulations and agency guidance;
State and local laws, regulations and agency guidance;
Requirements of accrediting bodies or other organizations; and
University policies.

Generally speaking, legal obligations require us to do something or prohibit us from doing something. But in the modern era many laws go well beyond “dos” and “don’ts” and require us to engage in specific types of compliance activities, including:

Having a written policy;
Naming a responsible officer;
Including specific language in certain types of contracts;
Keeping records of incidents;
Obtaining a license or permit before engaging in certain regulated activities;
Providing notice to consumers (students) or employees;
Certifying that the University has met particular requirements;
Conducting regular risk assessments;
Providing training to employees; or
Making a self-disclosure to the relevant agency in the event of an incident.

The best way to ensure that you and your departments are meeting these obligations is to identify the requirements clearly.  WVSOM’s Compliance Responsibility Matrix, which utilizes information from the Higher Education Compliance Alliance details most of the federal requirements in higher education by subject area. We would be happy to work with you to clarify related state, local, or other obligations.

An important part of clarifying your obligations is identifying the areas that require individuals or departments outside of your own to meet obligations.  For example, many grants or other government documents require WVSOM to certify that it complies with a host of laws and regulations, some of which will be outside your area.  Many reports required by federal, state or local agencies require information that comes from departments outside of your own.  Who do you rely on to meet obligations you are responsible for?  Compliance Services can help you identify those circumstances and help clarify responsibilities.

Step 2: Establish Priorities

Given the limited time and resources available for compliance efforts, it’s important to establish priorities and make a plan to meet your obligations.  As you establish priorities you should consider the possible consequences of any failure to meet legal obligations.  For example:

Could failing to meet this obligation significantly affect the institution’s reputation?
Could failing to meet this obligation harm the institution’s relationship with an important agency or research sponsor?
Does the agency responsible for the requirement fine or penalize those who do not comply?  How aggressively?
Does the statute or regulation provide whistleblower protection, making it easy (and financially lucrative) for individuals to report alleged wrongdoing?
Is this an area where class actions or lawsuits are common?

Compliance Services can help you with this risk assessment.  We can monitor enforcement activities and notify you when other colleges and universities are sued or pay fines or penalties in connection with compliance issues.

We suggest that you look back at the list of your departments’ obligations to identify which two or three do you worry about most.

Developing and publicizing clear policies and procedures will make it easier, and therefore more likely, that individuals will do what is necessary to meet these obligations.

Step 3: Develop Procedures

Clear policies and procedures make it easier, and therefore more likely, that individuals will do what is necessary to meet legal obligations, in other words, “do the right thing”. Although we are fortunate to have many long-time employees who may understand what is necessary to meet some obligations, that knowledge often is lost as employees retire or take on new or different responsibilities. For significant legal obligations, the best approach is to write and share clear instructions that specify what we will do and who will do it. That’s particularly true for the many significant legal obligations that require action by individuals in different departments throughout WVSOM.

Writing procedures does not have to be complicated or time-consuming.  Keep in mind the following guidelines:

Briefly describe whatever background is necessary; consider the new employee who will read the document.
Describe the scope of the procedure so that it is clear when it does and does not apply.
Use common, easy to understand words and sentences; avoid legalese and “corporate speak”.
Identify by job title(s) the group(s) or individual(s) responsible for each action; passive voice signals a gap.
Ask someone with limited knowledge to review the procedure and address any ambiguities or concerns.

Usually, these written instructions will be internal to a department or shared among a few departments and need not take the form of an institutional policy.  However, if a law requires a policy or the nature of the obligation requires institution-wide action, consider whether an institutional policy is necessary.

Compliance Services can help you draft policies or procedures for meeting legal obligations.  Consider the two or three obligations that are of most concern to you.  Would new or improved procedures help your departments and the other departments you work with meet those legal obligations?

Procedures may be sufficient if a few individuals are primarily responsible for meeting straightforward legal obligations.  However, if legal obligations require a larger group or segments of our entire community to understand what is necessary, consider developing concise, practical training materials.

Step 4: Providing Training

Offering concise, practical training materials helps our community understand what they are required to do and how to do it. Policies and procedures will help ensure compliance if a few individuals are primarily responsible for meeting straightforward legal obligations.  However, if legal obligations require a larger group or segments of our entire community to understand what is necessary, we should consider developing concise, practical training materials.  Training helps members of our community understand what they are required to do and how to do it.

Training can take a variety of forms, including:

Discussing requirements with your staff on a regular basis at office or staff meetings;
In person training for a group of individuals with similar responsibilities; or
Online training delivered to individuals with particular roles and responsibilities.

There are several options for developing and delivering training.  For example, online training may be available at little or no cost through higher ed organizations such as the Collaborative Institutional Training Initiative (CITI).  If you would like to develop your own training materials, peer institutions often make their training materials available online, which can provide an excellent starting point.

Compliance Services can help you identify, develop, and deliver training.  Consider the two or three obligations that are of most concern to you.  Would new or improved training help your departments and the other departments you work with meet those legal obligations?

As members of our community understand obligations more clearly, it’s fair to expect that individuals will raise questions or concerns. Although it may seem counterintuitive, it is important to welcome reports of concerns or complaints about alleged wrongdoing and to investigate any complaints promptly and responsibly.

Step 5: Report and Investigate Concerns

Encouraging members of our community to report violations of laws or policies and diligently investigating reports made in good faith fosters our ethical culture, which is one of our most critical core values.

Policies, procedures, and training give members of our community the critical tools to understand what they are required to do and how to do it.  However, even the best compliance programs aren’t perfect and problems may arise.  It is far better to understand any shortcomings from an internal report made directly to the institution than to hear about the compliance issue from a regulator or enforcement agency. Although it may seem counterintuitive, it is important to welcome reports of concerns or complaints about alleged wrongdoing and to investigate any complaints promptly and responsibly.

WVSOM is committed to complying with laws and regulations and maintaining the highest standards of ethical conduct.  As part of that commitment, WVSOM encourages all members of our community to report any concerns about failure to follow laws and policies.  Members of our community should be encouraged to report those concerns to supervisors, directors, department heads, or senior leaders responsible for particular areas.  In addition, members of our community may contact the following offices with specific concerns:

Equal Opportunity/Human Resources: Harassment or discrimination
Human Resources: Employment issues
Office of the General Counsel: Legal or ethical issues
Office of the Dean: Academic affairs or student issues
Office or Research and Sponsored Programs: Research activities
Office of Business Affairs: Financial issues
Compliance Services: Any compliance or ethical issue

You also may contact the individuals responsible for specific areas of compliance, which are identified in the Compliance Matrix. WVSOM has an independent Ethics and Compliance Hotline, administered by Mitratech/Syntrio-Lighthouse for anonymous and confidential reporting of activities that may involve improper conduct or violations of WVSOM policies. You are encouraged to report any compliance concerns through any of these other mechanisms as appropriate.

If you receive a complaint or question about compliance obligations you should contact Compliance Services or Office of the General Counsel. We can investigate, or help you investigate, and help ensure that any appropriate follow up occurs.

Step 6: Monitor and Correct Course

Once you have appropriate procedures and training in place for your most significant compliance obligations, it is important to assess whether they are effective.  Identifying and resolving small problems as they arise reduce the risk that significant problems will occur.

Investigating complaints and taking appropriate action to follow up is one way to assess whether your compliance efforts are working. But it’s important to identify other mechanisms for feedback. Do members of your department understand what they are supposed to do and are they doing it? Identifying a few key risk indicators and monitoring them periodically can help identify and resolve small problems, which reduces the risk that significant problems will occur.

Compliance Services can help you figure out how to monitor your compliance efforts and see if they are accomplishing what you intend. This type of monitoring can provide critical feedback that you can use to clarify policies, re-focus your training efforts, or take other steps to meet your compliance obligations. It may also help you recognize instances of non-compliance before the turn into larger or more significant problems.