Introduction

Corporate compliance audits are critical components of a corporation’s business operations regardless of industry, size, location, or complexity.  These audits are a means of ensuring that the corporation is adhering to various relevant federal laws and regulations.  Federal agencies are increasingly scrutinizing corporations that fail to maintain compliance policies or that implement substandard policies, as these are often red flags of fraud, deceit, or other instances of internal misconduct.  Penalties for noncompliance can be devastating for a corporation and can include civil and criminal fines, reputational harm, loss of license or ability to do business with the government, etc.

It is incumbent upon corporations to ensure that their business regularly monitors, evaluates, and optimizes its compliance policy.  The ideal way to achieve this goal is to retain a team of corporate compliance attorneys and professionals who can audit your corporation’s compliance policies and recommend strategies for improvement.  This helps achieve an attitude of full compliance with the law—both internally within the corporation and externally to federal agencies. – Dr. Nick Oberheiden, Founding Attorney of Oberheiden P.C.

What is A Corporate Compliance Audit and Why Is It Important?

A corporate compliance audit is defined broadly as an independent review and evaluation of a corporation’s internal operations and procedures to determine if it is compliant with applicable laws, regulations, and guidance.  Compliance audits verify whether the corporation is adhering to its bylaws, internal compliance and reporting procedures (e.g., whistleblower program), terms of its contracts, code of conduct and code of ethics, etc.  These audits also examine the strength of the corporation’s internal controls, due diligence procedures, risk assessment processes, and policies regarding reporting, recordkeeping, and documentation.

Compliance audits are important because they help detect gaps, inconsistencies, or other weaknesses within a corporation’s operations so that they can be remedied accordingly.  This, in turn, lessens the risk exposure of the corporation to damaging consequences such as negative media attention, reputational harm, federal investigations, and sanctions, and other penalties.  For instance, financial and accounting crimes under the Sarbanes-Oxley Act of 2002 (“SOX”) as well as allegations of bribery or corruption under the Foreign Corrupt Practices Act (“FCPA”) can wreak havoc on the business’ future.  

Additionally, compliance audits are important for helping corporations stay abreast of all changes that affect their business.  The legal, regulatory, and compliance environment of a business is constantly evolving, thus mandating that corporate management continuously implement a regular auditing system of its compliance processes.  The objective of these audits is to develop solutions and recommendations to remedy the identified weaknesses.  Such solutions and recommendations typically entail corrective action plans to strengthen the effectiveness of a corporation’s compliance policy to better detect, monitor, and correct internal weaknesses or instances of misconduct.

A Successful Corporate Compliance Audit Checklist

1. Retain an independent attorney and auditor to evaluate the effectiveness of your business’ compliance policy.  It is critical that the professionals you retain to audit the effectiveness of your compliance policy are independent—meaning that they do not have any financial or personal interests to the corporation nor in the results of the audit.  This guarantees an objective and impartial evaluation.  The attorney and auditor can provide you with an opinion as to your compliance policy’s effectiveness as well as recommendations for improvement. 

2. Ensure compliance with existing laws and regulations via internal compliance reviews.  Sometimes, companies find it beneficial to perform periodic internal audits of their compliance policy and business operations before a formal corporate compliance audit is performed.  This allows the corporation to gauge how it is managing its internal processes and operations as well as whether it is compliant with laws and regulations.  Such internal audits can vary in complexity depending on the corporation’s industry.  For instance, healthcare companies must comply with the Health Insurance Portability and Accountability Act (“HIPAA”), a federal statute that protects patient data from improper disclosure.  Therefore, many healthcare companies also perform healthcare corporate compliance audit to assess their company’s effectiveness at protecting and securing patient personal information.

3. Understand both the legal and regulatory landscape where your business operates.  Every corporation operates in a different legal and regulatory environment.  Therefore, it is imperative that corporations develop hand-tailored compliance programs that reflect the specific legal and regulatory environment under which each corporation operates.  This also includes understanding the progress, weaknesses, and success of your competitors.  As some examples, the following factors will affect how a corporation should structure its compliance policy:

• The federal statutes that govern the corporation’s operations and industry (e.g., healthcare companies will need to be aware of federal laws regarding governmental programs such as Medicare; corporations doing business with foreign parties will need to fully understand the FCPA, which prohibits corruption and bribery);

• Location and size of business;

• The complexity of business transactions;

• Number of personnel;

• The ownership type of business;

• Products and services offered;

• Miscellaneous factors such as environmental considerations.

4. Always be vigilant of new technological developments that could impact your business.  Technology is constantly evolving; so too should business operations to align with such changes.  Nearly all corporations are researching ways to optimize business strategies and automate business operations to improve output and cut costs.  Staying abreast of new technological developments allows corporations to improve their business, stay competitive, and increase profit.  Further, incorporating technology within compliance audits may enable corporations to detect weaknesses and improve operations in a more efficient and timely manner.

5. Ensure an active and positive attitude by upper management as well as personnel knowledge of business operations and risks.  An effective compliance policy is only as good as its implementation.  For this reason, it is critical that a strong example be set within the corporation.  This example must be set by those in a position to make a significant impact—typically corporate management and the board of directors.  These individuals should develop, practice, and enforce a corporate code of ethics and conduct.  In addition, all personnel—regardless of seniority and position—should regularly seek to improve their knowledge of business operations and risks.  The above can guarantee that the corporation is more likely to receive a positive audit review of its compliance policy.

6. Focus on the key high-risk areas of federal corporate compliance.  There are some transactions that inherently pose greater risks to a corporation than others.  As explained by the Corporate Compliance attorneys at Oberheiden, P.C., examples of these critical areas include the following: antitrust compliance, consumer finance compliance, data security compliance, employment law compliance, environmental compliance, FCPA compliance, Food, Drug and Cosmetic Act (“FDCA”) compliance, Federal Trade Commission (“FTC”) compliance, industry-specific compliance, and securities compliance.

7. Require annual training of all personnel members—including upper management.  An important component of a successful compliance policy—and a factor that will be evaluated during a compliance audit—is the presence of a consistent training program for personnel.  All individuals employed by the corporation should receive regular training sessions on evolving laws, the changing business environment and risks, and other market conditions.  Such training should also target upper management.

8. Implement a comprehensive system for the monitoring, recording, and documentation of corporate information.  Important keys to a successful corporate compliance audit are company-wide procedures that provide for continuous monitoring of business operations, recording of corporate transactions, and documentation and maintenance of all information.  Corporations should ensure that all their transactions, as well as changes to corporate procedures, are documented in an audit trail that records the modifications made.  If you are unable to accurately track your transactions in an audit trail, you may not pass your compliance audit because there will be a high indication of fraud or other forms of internal misconduct.

Conclusion

Corporate compliance audits are vital to the successful business operations of corporations.  A compliance audit is a process that evaluates whether the corporation is following both corporate internal rules such as bylaws and the code of conduct as well as external rules such as relevant federal statutes.  Failure to maintain compliance or implementing substandard policies can lead to penalties, fines, and reputational harm.  Federal agencies have increased their investigative efforts of corporations with weak compliance policies since weak policies are good indicators of fraud, deceit, or other forms of misconduct.  

As market risks are constantly changing, corporations need to reassess the effectiveness of their compliance policies and be prepared for an audit of their business operations.  Retaining an independent team of compliance audit professionals—including both attorneys and auditors—can protect your business by ensuring that you are prepared for an audit and are fully compliant with all applicable rules, regulations, and guidance.