Officer and the BoardGRC Law & Consulting

Compliance & Ethics

Build and assess
your compliance program.

Assess, build, and improve the processes that help an organization meet its obligations, recognize problems, and respond.

How we can help

Program assessment and development

Use program activity, operational data, and employee feedback to assess effectiveness and decide where attention and resources are needed.

  • Program structure and effectiveness reviews
  • Risk-based work plans
  • Roles, resources, and reporting relationships
  • Implementation and program improvement

Policies and procedures

Give policies clear ownership and a workable life cycle.

  • Policy inventories and gap reviews
  • Drafting and revision
  • Approval authority and document ownership
  • Review schedules, access, and implementation

Monitoring and response

Help the organization identify issues and follow through on them.

  • Monitoring plans and coordination with audit
  • Investigations and response planning
  • Corrective action and accountability
  • Reporting to management and committees

Culture and education

Examine how incentives, leadership behavior, and responses to bad news shape what people report and how they make decisions.

  • Speak-up and escalation processes
  • Psychological safety, transparency, and leadership responses to concerns
  • Incentives and expectations that support ethical decisions
  • Leader and workforce education
  • Compliance committee support

Healthcare and research compliance

Address the obligations that come with care delivery, research, and physician relationships.

  • Healthcare regulatory risk assessments and work plans
  • Fraud and abuse, overpayments, and operational compliance
  • Research conflicts of interest and management plans
  • Physician credentialing and committee processes

Privacy, security, and information use

Connect legal requirements to the way information is collected, used, protected, and shared.

  • HIPAA and privacy program assessment
  • Security governance, accountability, and incident response coordination
  • Health-information access and information-blocking compliance
  • AI and predictive analytics policies and oversight

Illustrative engagement · Hypothetical

“Our policies have accumulated for years, and nobody is sure which ones are current.”

Review the inventory, clarify ownership and approval responsibilities, and prioritize the documents that need attention.

The work could produce: A policy inventory, a revision plan, and an ongoing policy management process.

Writing and references

Resources for evaluating a program

HHS Office of Inspector General · November 2023

General Compliance Program Guidance

OIG’s voluntary guidance on compliance program infrastructure, relevant federal laws, and adaptations for organizations of different sizes.

Read OIG guidance ↗
U.S. Department of Justice · September 2024

Evaluation of Corporate Compliance Programs

DOJ’s framework for examining program design, resources and authority, and effectiveness in practice.

Read DOJ guidance ↗
HHS Office of Inspector General

Industry-specific compliance guidance

OIG’s directory of general and industry-specific guidance. Use the materials relevant to the organization and its operations.

Browse OIG guidance ↗

Start a conversation

OATB is coming soon.

This site previews planned legal and consulting services. Visit RobertBStratton.com for Robert’s professional background, writing, and speaking.

Contact Robert ↗