Compliance Program
Last reviewed · By Chad Griffith
A compliance program is the written set of policies, procedures, training, monitoring activities, and corrective actions that an organization uses to prevent, detect, and respond to violations of applicable laws and regulations. The US Sentencing Commission and Department of Justice have published seven elements that constitute an effective compliance program: written standards, oversight by a compliance officer, training, communication, monitoring and auditing, enforcement and discipline, and prompt response to detected violations.
Frequently Asked Questions
What are the seven elements of an effective compliance program?
The DOJ and US Sentencing Guidelines list seven elements: (1) written policies and procedures; (2) compliance officer and oversight; (3) training and education; (4) effective communication; (5) monitoring and auditing; (6) enforcement and discipline; (7) prompt response to detected offenses. CMS adopted the same seven elements for healthcare provider compliance programs under 42 CFR 422.503.
Is a compliance officer required?
Some regulators require a designated compliance officer. CMS-certified Medicare Advantage and Part D plans must designate a compliance officer (42 CFR 422.503). HIPAA covered entities must designate a Privacy Officer and Security Officer (45 CFR 164.530, 164.308). DOT regulations require a designated DER (Designated Employer Representative) for the drug and alcohol program (49 CFR 382.107). Most other regulators expect equivalent oversight without naming the specific role.
How often should a compliance program be reviewed?
Industry norms call for at least annual review of policies, with continuous monitoring of training records and certifications. CMS expects annual compliance program effectiveness reviews. OSHA expects annual review of written programs (HazCom, LOTO, ECP, RCRAPP). FMCSA expects ongoing program execution with biennial Safety Management Cycle reviews.
What documents prove a compliance program exists?
Required documentation includes: written compliance policies and procedures, employee training records, internal audit reports, corrective action records, compliance officer designation letter, communication channels (hotline records), and disciplinary action records for compliance violations. Regulators expect both the program documentation and evidence that the program is followed in practice.
Authoritative sources
Related terms
FileFlo classifies and tracks compliance documents against rule packs that map directly to the regulators referenced above. Run a free CFR-cited audit →