Maturity Model Final June 1 SCCE.pptx [Read-Only]

6/2/2015Benchmarking ComplianceEffectiveness:Developing a Maturity Model to Measure YourCompliance Program and Report to YourBoard/Audit CommitteeRobert F. RoachVice President, Chief Global Compliance OfficerNew York UniversityJune 1, 2015Compliance Maturity ModelThe Challenge:Measuring Compliance ProgramEffectivenessCompliance Maturity ModelThe Challenge:Measuring Compliance Program Effectiveness1. The StandardWhen establishing and implementing a ComplianceProgram, most organizations (including Universities)attempt to follow the U.S. Federal Sentencing Guidelinesfor Organizations:Section 8B2.1 Effective Compliance and EthicsPrograms.1

6/2/2015Compliance Maturity Model2. The Guidelines don’t always help!While the Guidelines set forth basic elements of an effectivecompliance program, they make clear that: No single compliance program design fits everyorganization. An organization's industry, size, structure and mission allinfluence program design and operation.3. The Challenge:The Guidelines direct us to have an “effective” program, buthow do you define and measure the effectiveness of yourCompliance program?Compliance Maturity Model4. Practical Issues Easier to track program activities than results Difficult to determine which compliance activities driveresults Difficult to assess employee and management behaviorobjectively and consistently over time Lack of useful benchmarks for comparison Often difficult to glean actionable information from selfassessmentsCompliance Maturity ModelCapability Maturity Models2

6/2/2015Compliance Maturity ModelCapability Maturity ModelsThe concept of a Capability Maturity Model was developed atCarnegie Mellon in the 1980s for the U.S. DefenseDepartment to help measure the capability of potentialvendors in the software industry to fulfill governmentcontracts.The term "maturity" refers to the degree to which anorganization’s processes have been formalized, implementedand integrated into an organization's operations.Compliance Maturity ModelCapability Maturity ModelsCapability Maturity Models have been developed for manyfields and areas.With a Compliance Maturity Model we hope to provide: A useful means for assessing your compliance programagainst recognized standards A method for identifying “next steps” required to advanceyour compliance program A process for measuring progress against internal andexternal benchmarks A tool that can be used to measure progress in specificcompliance areas and projects or your overall complianceprogramCompliance Maturity ModelIn the next sections of this presentation we will cover: A Compliance Maturity Model (CMM) that focuses onelements of a compliance program The general “stages of maturity” for organizationalcompliance processes3

6/2/2015Compliance Maturity ModelA Compliance Maturity Model (CMM)Compliance Maturity ModelCompliance as an Afterthought:Many organizations have “bolted on” compliance programsthat are separate and apart from their “business” operations.They have not integrated a focus on compliance riskmanagement within operational and decision makingprocesses.The overall results are fragmented compliance programs thatare complicated to operate and difficult to coordinate,manage, and monitor. These systems also tend to bereactive rather than planned or strategic.Compliance Maturity ModelCMM Maturity LevelsA CMM focuses on integration of your compliance programsinto organizational business processes by analyzing the“maturity” of your program with levels that range from adhoc practices, to formally defined steps, to managed withresult metrics, to active optimization of processes. As anorganization moves up the maturity model, ownership spreadsacross the organization and becomes embedded within thevery culture of the organization.Note: capability maturity models vary in the number of“maturity” levels they use – usually three to five. They alsouse somewhat different descriptive labels. We havedeveloped a CMM with five levels and the most frequentlyused labels for maturity levels.4

6/2/2015Compliance Maturity Model1. Ad Hoc: Procedures are usually informal, incomplete andinconsistently applied.2. Fragmented: There are some compliance controls in place, but theyare not consistent across the organization. Often limited to certainareas or managed in “silos” (e.g. EHS, Finance, Research, etc.)3. Defined: Compliance Controls and procedures are documented andstandardized across the organization4. Mature: Compliance procedures are an integral part of businessprocesses and periodic reviews are conducted to access effectivenessof the program5. Optimized: Regular review and feedback are used to ensurecontinuous improvement towards optimization of complianceprocesses; elements are often automated, which are more effective atpreventing compliance failures and ultimately less costly than manualcontrols focusing on detectionCompliance Maturity Mode - OrganizationCompliance Program Maturity - Organization3.Defined2. Fragmented5. Optimizing4.Mature1. AdHocCompliance Program Maturity OrganizationA.B.C.D.E.Ad HocFragmentedDefinedMatureOptimizing5

6/2/2015Compliance Maturity ModelCMM – Focused on“Federal Sentencing Guidelines” ElementsCompliance Maturity Model - StructureStructure and Accountability Leadership, Distributed Responsibility andAdequate Resources Enterprise‐Wide Coordination and Oversight Demonstrated Enterprise CommitmentNYUComplianceStructureAudit & ComplianceCommittee of theBoard of TrusteesOversees the implementation and effectiveness of NYU's Compliance Programand monitors the University’s compliance with its legal, grant, contractual andpolicy obligations. The Vice President and Chief Global Compliance Officerreports regularly to the CommitteeOffice of thePresident / OCRMOCRM, led by the Deputy President, Diane Yu, and the Vice President and ChiefGlobal Compliance Officer, facilitates communication among key complianceofficers through our compliance committees and University‐wide ComplianceProgramUniversityCompliance & RiskSteering CommitteeCompliance & RiskCommitteesUniversity Leadership committee chaired by Deputy President, Diane Yu, andstaffed by OCRM, approves the University’s ethics, compliance, and trainingpriorities and oversees the University’s compliance effortsOCRM co‐chairs three Compliance & Risk Committees:The Compliance & Risk Officers Working Group New York, Abu Dhabi, ShanghaiThe Schools Compliance & Risk Officers TaskforceThe Global Compliance & Risk Officers Taskforce186

6/2/2015NYUComplianceOCRM Compliance CommitteesCOWG: includes compliance officers from academic andadministrative departments, including NYU Abu Dhabi,who are responsible for day to day compliance activities.COWG currently has a membership of more than 25compliance officers.Compliance OfficersWorking Group(COWG)Schools ComplianceOfficers Taskforce(SCOT)Global ComplianceOfficers Taskforce(GCOT)SCOT: includes representatives appointed by the deansand directors of all of NYU’s Schools, Colleges and majorInstitutes, including NYU Poly and the Center for UrbanScience and Progress (CUSP). SCOT was formed in 2012 asa forum for Schools to discuss their unique complianceconcerns and as a vehicle to enhance compliancecommunication with COWG and GCOT.GCOT: provides a forum for administrators at WashingtonSquare who have responsibilities for the academic andadministrative development at the Global Sites.Compliance Maturity Model - Structure1. Ad Hoc2. Fragmented3. Defined4. Mature5. OptimizedThere is no formalcompliance structureSenior management andBoard discouragenoncompliance but notconsistent in follow throughA compliance structure hasbeen established, withaccountability assigned tokey risk area officersCompliance riskassessments andmitigation plans arecompleted by risk areaofficers on a regular, timelyand consistent basisNetwork of complianceofficers representing everysignificant operation inplace and they meetregularly to coordinatecompliance activitiesNo Independent oversightAccountability is broadlyunderstood but not formallydocumented.Senior ComplianceCommittee exists, includesrepresentatives of keyorganizational activitiesReporting by risk areaofficers to ChiefCompliance Officer istimely and consistentSenior ComplianceCommittee considerscompliance a strategicpriority. Compliance riskscenarios have beenidentified, assessed andmapped to compliancecontrols, which areupdated at least annually.Oversight and monitoringare inconsistentAccountability is notdefinedSenior compliancecommittee may exist, butcompliance activitiesreactive and in silosChief Compliance Officeror other individual with dayto day responsibility forcompliance appointedThe senior compliancecommittee meets at leastquarterly, receives regularreports by ChiefCompliance Officer,actively plans forcompliance contingenciesThe Board/AuditCommittee and executivemanagement show ademonstrated commitmentto compliance throughoutthe organization.Compliance risks are notunderstoodCompliance risks areunderstood but not formallydocumented.Process in place foridentifying compliancerisks and developingmitigation plans byassigned risk area officersChief Compliance Officerhas independent and directaccess to Board or AuditCommittee. Makes regularreports on complianceactivities to Board/AuditCommittee.Compliance, riskmanagement and internalaudit have implementedintegrated work plans.Integrated functions aresupported by automatedprocesses.Compliance Maturity Model - StructureStructure and Accountability3.Defined2. Fragmented5. Optimizing4.Mature1. AdHoc7

6/2/2015Structure and AccountabilityA.B.C.D.E.Ad HocDefinedFragmentedMatureOptimizingCompliance Maturity Model - PoliciesPolicies and Procedures Distributed and Assigned Responsibility Development and Publication Accessibility and Communication Policy Tracking, Review and riendly! Search by keyword, category or date rangeNeed helpfinding anNYU policy?ContactDianeDelaney atour office –Diane’semail is onthe policiespage248