Where to Begin April 5, 2010

First rule:

Make sure Management is aligned with your objectives.  “Tone at the top” is a key factor in your success.  Every compliance person I know has experienced Management that is only partially “on board”.  When you meet with them, they sound aligned with your plan but they later sabotage (purposely or inadvertently) your efforts with lack of resources, failure to drive accountability, or rapidly changing priorities.  You cannot create an effective, sustainable compliance program without some support at the Management level.  I say “some” support because you also need to be realistic about their enthusiasm.  If they will provide the resources and hold the organization accountable for the plan, you’re way ahead in the game.  They will most likely never embrace compliance with a passion that equals your own.  Don’t lose sleep over it.

Your job is to communicate the needs clearly, keep them engaged and to continue to reinforce the need for support of your planned actions.  Let’s be honest, compliance is not a sexy topic.  It is not usually a revenue generator and even the best-intentioned attempt to detail the benefits of  “cost avoidance” prompts guaranteed yawns and BlackBerry checking.  Fear works well to get the attention of Management initially but be careful not to overplay the jokes about how nice the President will look in stripes. 

Someone in management, for some reason, has decided that a compliance program is needed.  The reason is most likely linked to competitiveness and a strategic plan.  In other words, your purpose has already been established, no need to sell it further.  Your job is to deliver the outcomes that will support the business objectives.  Your best approach is to create and communicate well-stated, achievable, measurable goals.  Understand the scope of the project and the impact to available resources.  Employ sound project management techniques to ensure effective communications, well controlled plan changes and to avoid scope creep.  Identify the risk factors and key assumptions up front so that you have contingency measures in place.

Most importantly, don’t try to boil the ocean.  As the subject matter expert, you should have a solid grasp of what is critical and what can be delayed for future action.   After all, there is a reason it’s called continuous improvement.  Your efforts to achieve compliance “nirvana” will be ongoing well into the future.

Start with the Basics

Regardless of the compliance area (Quality Systems, Health Care Compliance, Government Contracting or SOx….I have worked in all areas), you will need to obtain and integrate three key inputs.

An understanding of the business needs

An understanding of the people needs

An understanding of the external requirements

 

Armed with these three key inputs, you can leap into your Plan-Do-Act-Check approach with enthusiasm.  Without these three tools, you will most likely find yourself in a constant state of churn.

Understanding  the External Requirements

Start with, and hold tight to, the intent of the requirements that are driving your efforts.  Naysayers often argue that compliance shackles a business…that the regulations inhibit the ability to nimbly meet the changing commercial landscape.  Those of us who have experienced a good compliance program know that this is false.  A solid compliance program that integrates the needs of the business while embracing the intent of the requirements is a business asset.  A well-considered, well-designed compliance program is also much easier to sustain over time.

External requirements are generally designed to protect the masses and, by and large, they are based upon the concept of control.  As they must be applied to differing businesses and products, they tend to be broadly written and subject to interpretation.  There is no way around this core of ambiguity.  You must first identify the relationship between the intent of the regulation and your specific business model. If, for example, you make a medical device that requires terminal sterilization, you know that the packaging and sterilization mechanisms you deploy must be adequately validated.   “Adequately validated” becomes the process endpoint but the road to that endpoint is yours to engineer.  Certain aspects of the path you design will reflect established best practices, such as those communicated by the FDA via thousands of issued Form 483 reports.  A multitude of industry standards provide a solid definition of success but the path is still yours to define.  It is a solid understanding of the intent of the requirement that maximizes your freedom to design the optimal solution.

Compliance professionals in other areas of focus, such as Health Care Compliance (HCC), don’t benefit from years of activity and a library of standards.  The interpretation applied by enforcement agencies shifts over time as settlements, Deferred Prosecution and Corporate Integrity Agreements sculpt the environment.  Areas such as Sales and Marketing, historically exempt from compliance controls, are suddenly required to navigate within defined “safe harbors”.  Requirements within the commercial compliance arena are even more challenging to embrace as the criteria for success is rarely data driven.  For example, sales interactions with health car providers must not “induce” the purchase of product.  Such a requirement forces a business to define internal limits and to draw a line in the sand.  When does a meal cross the line from allowable Sales activity to inducement?  What limits should be established on consulting arrangements with customers?

• Getting your hands on the intent can be a bit like trying to pinch a watermelon seed but there is no point in trying to design a compliance program until the intent is well understood.  In my daily challenges, I seek intent keeping the end in mind.  When I get stuck, I often ask, “What’s the worst case outcome if we/I…..?”

Lastly, a clear understanding of the intent will add long term value to your training program.  Compliance training is largely a selling activity and intent will be a powerful tool in your bag.

My brain online

Years ago, I interviewed for a compliance position at a medical device firm.  My interviewer, a Director within the R&D group, bluntly stated during my interview that he had never met a compliance person with whom he had enjoyed working.  I assured him that compliance people aren’t all bad but recommended that, given his strong feelings, he should avoid being seated next to any of us at dinner parties.  He laughed in response but was clearly confused by my failure to be offended.  Years later, to my surprise and delight, the interviewer eventually became my boss and a true believer in the power of compliance. 

All compliance professionals worth their salt have received the offhand comment and backhanded compliment time and time again.   There is something very suspect about us compliance people.  It seems almost unfathomable that anyone would choose compliance as a career.  I have come to believe that compliance professionals are simply hardwired for the role.  Creating and sustaining a compliant culture is a labor of love…. more art than science.  Success requires stamina, finesse and a very thick skin. 

After more than 19 years in compliance, I have learned to greedily seek out the knowledge and experience of colleagues.  As I tackled new regulations, standards and business models, the knowledge shared by others has saved the day numerous times.  This blog is my way of returning the favor.