How to

Conduct a
Compliance
Risk
Assessment
(and Why You
Should)

January 2022
About the Authors

ROZ CORDINI, JD,

MSN, RN, CHC, CHPC
SENI O R V I C E P RESI D E
NT / DI R E C T OR OF C O DI
N G & C O M P LI AN C E SE
RV I C ES
RC O RD I NI @ C O K ER GR O U P . C O
M 6 7 8 . 83 2 . 20 0 0
Roz Cordini, JD, MSN, RN, CHC, CHPC, is a senior vice
president and director of coding & compliance
services with Coker Group. Ms. Cordini leads the
coding & compliance service line to focus on Office
Inspector General program compliance, including
compliance program development, compliance
effectiveness reviews, compliance investigations,
physician compensation governance procedures, and
governance education.

ROB MENDOZA, CHC

SENI O R M ANAGER
RM E ND O Z A @ C O K ER GR O U P . C
O M 6 7 8 . 83 2 . 20 0 0

Rob Mendoza is a senior manager at Coker Group with

over 13 years of experience in healthcare compliance.
He partners with hospitals, physician groups, and
other healthcare clients to develop, evaluate, and
operationalize their compliance programs according to
Office of Inspector General (OIG) guidelines.
Contents
6 What is a Compliance Risk Assessment?

10 Why Conduct a Compliance Risk Assessment?

13 The Compliance Risk Assessment Process

19 Develop the Compliance Work Plan

21 Monitor and Track Progress

23 Conclusion
Healthcare organizations such as hospitals,
home health agencies, skilled nursing facilities,
physician practices, and third-party medical
billing companies are constantly exposed to
new compliance risks. We attribute this to our
current world of continually changing
healthcare laws and regulations coupled with
these organizations evolving their operations
to adapt to this ever-changing environment.

Now more than ever, these organizations must

maintain an effective compliance program. The
industry recognizes conducting a compliance
risk assessment regularly as one of the key
elements of an effective compliance program.
An ongoing compliance risk assessment will
identify and evaluate these risks and empower
an organization's leadership to address the
risks to the organization proactively.
This paper will define a
compliance risk assessment,
explain why you should conduct a
compliance risk assessment,
discuss how to develop a
compliance work plan, and why
you should monitor the work plan
and track progress.
What is a
Compliance Risk
Assessment?
A compliance risk
assessment is a
structured process for
identifying, evaluating,
and prioritizing legal
and regulatory risks that
could negatively impact
the organization. It
allows the organization
to focus essential
It is the foundation
resources on the most of a well-designed
significant risks and
areas lacking adequate
compliance
controls. program.

Effective risk assessment and management efforts help

organizations optimize their operations, even with increased
risks and regulatory burdens.

There can certainly be a level of ambiguity when one hears the

term compliance risk assessment. It can easily be confused
with other reviews or examinations an organization conducts.

What is not a compliance risk assessment?

 AUDITS OR INVESTIGATIONS
A compliance risk assessment is not intended to serve as a financial or
operational audit, nor is it considered an investigation. However, issues and
circumstances that require a deeper examination may certainly be
discovered during the compliance risk assessment process.

COMPLIANCE PROGRAM
EFFECTIVENESS ASSESSMENT
A compliance risk assessment should not be confused with a compliance
program effectiveness assessment, which is performed to review the
organization's compliance program. It focuses on the impact of compliance
processes and activities occurring as part of the compliance program and
whether they are effective. However, there can be some overlap between
the two. An organization cannot assess risks without understanding how well
its compliance program mitigates them. Conversely, an organization cannot
measure the effectiveness of a compliance program without identifying legal
and regulatory risks to the organization.

ENTERPRISE RISK
ASSESSMENT
Enterprise risk assessments are a different type of risk assessment. They are
the broadest of all risk assessments as they entail looking at the full range of
business risks, including strategic, operational, financial, and reputational
risks. However, since compliance risks touch many areas, organizations
should consider integrating the compliance risk assessment into the
existing enterprise risk management (ERM) process. Efficiencies can be
gained as risk issues and operational processes often overlap.
Organizations can develop more effective mitigation strategies if process
interdependencies are understood.
Approaches to risk management and
risk assessment methodologies can
vary significantly among healthcare
organizations and conducting a
compliance risk assessment is more
art than science. There is no perfect or
scientifically correct methodology and
approach. It can be as simple as
reviewing documentation, performing
a spot-check on potential risk,
sending surveys to employees,
conducting interviews with key
leadership and staff, or any
combination of those efforts. The
effective management of risk depends
on professional expertise, intimate
knowledge of the organization, and a
keen sense of how much risk
tolerance the organization truly has.
Why Conduct a
Compliance Risk
Assessment?
There are undoubtedly many reasons healthcare
organizations should conduct periodic compliance risk
assessments. Benefits include:

Addressing areas of increased government scrutiny

by helping ensure the organization has controls in
place to mitigate the risk and prevent or decrease
fines, penalties, and reputational damage.

Identifying blind spots where risk is not being

managed adequately or may have otherwise
gone undetected, resulting in potentially
substantial harm to the organization.

Supporting strategic changes by utilizing results to

provide managers with critical information on
compliance risks and mitigation strategies.

Engaging employees and management

throughout the organization, which helps to foster
a culture of compliance further.

Demonstrating a proactive approach to

compliance is a key characteristic of an effective
compliance program.
Regulators expect healthcare
organizations to conduct
compliance risk assessments.
The United States Sentencing Commission Guidelines Manual (Federal

Sentencing Guidelines) recommends organizations implement a periodic

compliance risk assessment process to more timely review and prioritize
risks.

“In implementing [a compliance program], the

organization shall periodically assess the risk of
criminal conduct and shall take appropriate steps
to design, implement, or modify each requirement
set forth…to reduce the risk of criminal conduct
identified through this process.”

The Department of Justice (DOJ) updated Evaluation of Corporate

Compliance Programs in June 2020. It primarily serves as guidance to

federal prosecutors on determining the severity of punishment an
organization should face in the event of a compliance failure. However,
this update also seeks to provide guidance and transparency to
organizations by communicating the DOJ's expectations of a well-

designed and properly executed compliance program. It emphasizes that

a periodic risk assessment is the starting point of a well-designed
compliance program. It must be ongoing and updated timely so that the
organization's response to new and evolving high-risk areas is dynamic
and comprehensive.
The Compliance Risk
Assessment Process
 IDENTIFY RISKS The first step is to develop a list of specific
risks, situations, or events that could lead to an adverse event
within the organization. In doing this, one must consider
internal and external sources of risk.

INTERNAL SOURCES OF RISK

Compliance/Hotline Reports Compliance Policies/Procedures Prior

Auditing/Monitoring Results Prior Risk Assessments

Compliance concerns from operational leaders, internal audits, legal and
risk management (via interviews, questionnaires, etc.)

Customer/Patient Complaints or Grievances Conflict of Interest Disclosures

Claims Denials Reports
 EXTERNAL SOURCES OF RISK

OIG Work Plan OIG Fraud Alerts

OIG/DOJ Enforcement Actions

CMS and MAC Memos, Alerts, Reports, etc.

New or recently updated National and Local Coverage Determinations (NCDs

and LCDs)

Approved RAC Audit Topics

OCR Alerts, Enforcement Actions, etc.

New or updated regulations, laws, guidance, etc.

Once risks have been identified, they must be mapped to

specific operational areas or processes to assess the potential
for an adverse event. We outline common compliance risks in
the physician practice space on the following page.
Compliance Risks for
Physician Practices

• E/M Services – Documentation &

Coding
• Diagnosis coding/HCCs/Risk
Adjustment
• EHR Documentation Practices
• Outside Activities/Conflicts of
Interest
• Use of Advance Practice Providers
• Physician Relationships with
Vendors
• HIPAA Privacy/Security
• Financial Relationships with
Physicians and Other
Referral Sources
• Telehealth/Telemedicine
• Waiving of Patient
Payments/Professional Courtesies
• Annual Wellness Visits
• Emergency Preparedness
 ASSESS RISKS Once specific risks have been identified, the
next step is to assess them by conducting a likelihood and
impact analysis by assigning a likelihood and impact score for
each risk to ultimately attain a final risk score for each risk. The
likelihood score primarily considers the effectiveness of existing
controls to mitigate the threat. The higher the degree of
awareness and the more controls in place, the lower the
likelihood for the threat to occur. The impact score considers
the severity of harm to the organization should the adverse
event occur. Below are the criteria that must be considered
when assigning a likelihood and impact score.

IMPACT LIKELIHOOD

Magnitude of the Potential Loss Probability an adverse event will

occur

Financial (e.g., fines, penalties) Consider current regulatory

scrutiny

Legal implications How prepared is the

organization for this risk area

Mission Consider existing controls in

place

Reputation Ability to detect and respond

to the adverse event before it
occurs
Likelihood and Impact Scoring Scale Example

IMPACT LIKELIHOOD

Catastrophic Frequent
Likely to occur soon and often

Major Certain
Expected to occur eventually

Moderate Occasional
May occur intermittently

Minor Unlikely
Not expected but possible

Insignificant Rare
Not expected to occur

Each risk's impact and likelihood scores are combined (i.e.,

added or multiplied) for a total score that will determine the
risk's relevance for further action. A risk assessment chart can
be developed to demonstrate where the identified risks rank
based on the likelihood and impact analysis. We provide a
basic example of a risk assessment chart on the following
page.
 Risk Assessment Chart Example

IMPACT LIKELIHOOD OVERALL RISK

# RISK RISK RATING LEVEL
(1-5) (1-5)
(Low/Medium/High)

The most relevant items are prioritized for follow-up action

and placed on the compliance work plan based on scoring
and resource availability.
Develop the
Compliance Work Plan
An organization must establish appropriate action plans to address and

mitigate the prioritized risks. Once completed, the prioritized risks are

documented on the compliance work plan with specific timelines.

Typical compliance work plan activities

include audit projects, monitoring support,
education and training, policy and procedure
updates, and technology implementation.

The compliance risk assessment and development of the compliance work

plan should be ongoing throughout the year. The compliance officer must

evaluate new data (e.g., new operations, laws, regulations, OIG Work Plan

updates) throughout the year to identify and reassess risks to the

organization. The compliance work plan should allow for modifications to

address new priorities and issues as they arise.

It is imperative to communicate with executive leadership and the

organization's Board throughout the entire process. All aspects of the

process, including the findings, recommended corrective actions, and

compliance work plan updates, should be regularly reported. The process

helps demonstrate an effective compliance program and risk assessment

process; the OIG will ultimately hold them responsible for attaining

compliance. Additionally, the DOJ stipulates those individuals can be held

accountable for non-compliance and corporate wrongdoing.

Monitor and
Track Progress
It is vital to continually monitor all
action plans to track progress,
determine if resource changes are
warranted, and ensure they are
completed before the established
deadlines. The compliance officer
should report the status of
compliance work plan action items to
executive leadership and the Board. It
helps to create a detailed tracking
tool to track progress toward action
plan completion. Finally, it is critically
important to document the entire
compliance risk assessment process
to demonstrate compliance and
inform business decisions as
necessary down the road.
Conclusion
Healthcare organizations should be prepared
to continually address new risks as they arise,
and their compliance program must include
regularly conducted compliance risk
assessments. The need for compliance risk
assessments will only increase because of the
pace of change in the healthcare business
environment. Thus, compliance functions will
need to be more adept at compliance risk
assessments, and compliance officers must be
more knowledgeable in conducting the
assessments. An accurate compliance risk
assessment is one of the most important tasks
a compliance officer should complete.