Establishing A Compliance Program: It Makes Sense Derry Harper Inspector General & Director of Compliance January 28, 2010

Institutional Compliance Program Broadly Defined A program that has been reasonably designed, implemented, and enforced so that it will generally be effective in preventing and detecting violations of law. Program must evidence the organization’s “due diligence” in seeking to prevent and detect violations of law.

Compliance Program Design Proactive Identify key risk areas and perform a risk assessment on compliance readiness. Prioritize implementation of compliance program in the areas of higher regulatory risk because of impact on health or safety, academic or fiscal integrity. Provide recommendations, education and training in connection with regulatory compliance gaps that have been identified.

Compliance Program Design (Cont.) Integrated Work collaboratively and as a liaison to other compliance offices/functions throughout the organization To identify risk areas and conduct assessment To monitor new developments or requirements in regulatory compliance

Compliance Program Design (Cont.) Transparent Promote Mission/Vision of the organization Promote an organizational culture that encourages a commitment to compliance with law

Internal Control A process affected by an entity, board of directors, management and other personnel designed to provide reasonable assurance regarding achievement of objectives related to: Reliability of financial reporting Effectiveness and efficiency of operations Compliance with applicable laws and regulations

Compliance Program Elements Risk Assessment Responsible Parties and Roles Standards and Procedures Program Oversight Awareness, Education and Training Lines of Communication Monitoring and Auditing Enforcement Corrective Action Identify gaps in regulatory compliance Coordinate, manage and monitor internal and external risks associated with regulatory compliance Improve coordination, dissemination and communication of regulatory compliance issues Develop a best practices model for regulatory compliance Save millions of dollars in settlements of government lawsuits* Protect the organization and its employees from severe criminal and civil penalties* *The existence of an effective compliance program shows the government that the organization has undertaken its compliance obligations seriously and allows the courts to reduce fines and penalties under the U.S. Sentencing Guidelines.

Audit & Compliance Committee Charter Regarding the SUS, the Audit & Compliance Committee will: Receive and review university audit reports; Identify trends in such reports and confirm that adverse trends are being addressed by the universities; Initiate inquiries if Committee has reasonable cause to believe a university is not providing appropriate response to audit findings; Direct the IG to conduct an inquiry or investigation if the Committee has reasonable cause to believe that a university board of trustees is unwilling or unable to provide for investigation of allegations of fraud. 8 8

The Brogan Doctrine Step 1: Establish Compliance Program Identify Project Owner or Champion Establish a Steering Committee Step 4: Establish Systematic Compliance Program Develop Compliance Matrix Training Monitoring Identify areas of non-compliance Corrective Action Plan Process Step 2: Identify Key Objectives List Key Objectives Prioritize Key Objectives Step 3: Identify Key Compliance Risk Areas Brainstorm and assess high risk areas Assign high risk areas to process owner

Compliance Matrix – Schema BOG Internal Operating Policies & Procedures State Statutes Regulations, Policies & Procedures Federal Statutes BOG/Chancellor Charters BOG Regulations BOG Policy External Policies & Procedures???? External Policies & Procedures Florida Constitution U.S. Constitution Developing a Compliance Matrix that will help guide the implementation efforts and assist in identification of compliance gaps and education/ training needs Adopting a Code of Conduct accepted by all members of the organization

Compliance Matrix Steps > Constitution > State Admin Regs & Rules > State Statutes (20.055) > Federal Statutes > BOG Regulations > Charter Research Analysis Implementation: Development of Policies & Procedures

Compliance Assistants SUS Compliance Work Group: FAMU Vice President for Compliance & Audit FIU Assoc Vice President & University Compliance Officer UCF Vice President & General Counsel USF Executive Director for University Audit & Compliance USF Chief Compliance Officer BOG Compliance Steering Committee: Senior Associate Vice Chancellor, Associate Vice Chancellor, Chief of Staff, IRM Assistance Vice Chancellor, Director of University Budgets, Director of Academic & Student Affairs, General Counsel, IRM Assistant Director, Assistant Director of Personnel, Budget Analyst, Campus Development Coordinator, and Research Associate

BOG Regulation Compliance Review Tools