Getting It Right: The Anatomy of a Thorough Compliance Investigation
Written by: Jordan Johnson, MSHA, iMPaCT
Conducting a compliance investigation is a vital component of any organization’s effort to uphold legal, regulatory, and internal policy standards. Whether triggered by a whistleblower complaint, routine monitoring, or audit findings, these investigations must be handled with precision, neutrality, and diligence.
A successful compliance investigation does not simply uncover wrongdoing; it ensures fairness, protects the organization from liability, and reinforces an ethical culture.
Central to the investigation process is the thoughtful review of data, the involvement of relevant experts, and the application of legal precedent under the principle of stare decisis—the legal doctrine of standing by what has already been decided. This principle ensures consistency with prior decisions and predictability in legal outcomes.
As detailed in this article, a comprehensive approach to conducting compliance investigations relies on clearly defined steps—from determining scope to implementing corrective actions.
Defining the Scope
The first critical step is defining the scope of the investigation. Investigators must clarify what triggered the investigation—such as internal audits, regulatory inquiries, or employee complaints—and identify the specific laws, policies, or standards at issue.
Common regulations involved include:
- HIPAA
- The False Claims Act
- The Sarbanes-Oxley Act
- The Stark Law
Defining the scope early ensures the investigation remains focused, avoids unnecessary expansion, and uses resources efficiently. Investigators should also establish clear objectives, such as:
- Determining if misconduct occurred
- Assessing legal exposure
- Recommending next steps.
- Additionally, creating a timeline is essential for managing the process and ensuring timely resolution.
Collecting and Reviewing Data
Once the scope is established, the next step is to collect and review relevant data. The strength of any compliance investigation lies in the quality and completeness of its evidence. Investigators must gather documents—both electronic and paper—including
- Emails
- Audit logs
- Financial reports
- Operational records (e.g., patient or client files)
Interviews with employees, witnesses, and third parties provide vital context and can corroborate written records. In some instances, observational audits at physical sites may be necessary to detect procedural lapses or systemic noncompliance. The goal is to paint a complete picture of what happened and why.
Data Interpretation with Expert Input
Data review is not merely about compiling information—it requires skilled interpretation.
Subject matter experts such as:
- Attorneys
- Forensic accountants
- Industry consultants are often brought in to help analyze patterns, detect irregularities, and assess whether the evidence indicates intentional misconduct, negligence, or simple error.
These experts can determine compliance with applicable laws, highlight anomalies such as fraudulent billing or kickbacks, and compare practices against industry norms. Their input ensures the findings are objective, accurate, and defensible, grounded in technical knowledge and real-world standards.
Applying Legal Precedent
Legal precedent plays a significant role in interpreting findings. The doctrine of stare decisis, meaning “to stand by things decided,” ensures consistency with past judicial or regulatory interpretations.
Investigators should review:
-
Court cases
-
Administrative rulings
-
Agency guidance (e.g., CMS, DOJ, SEC)
This legal framework helps organizations assess risk, predict how regulators may view the issue, and ensure that any corrective measures align with established expectations. It also ensures fairness by preventing arbitrary enforcement and upholding equal treatment across similar cases.
Conducting Interviews
Employee and witness interviews are another critical aspect of compliance investigations. These conversations must be conducted carefully and professionally.
These conversations must be conducted carefully and professionally. Investigators should be well-prepared, having reviewed relevant documentation beforehand. Questions should be neutral and non-leading to avoid influencing responses. Confidentiality should be emphasized, though with the caveat that full anonymity may not always be possible depending on the nature of the case. Interviewees should also be advised of their legal rights, especially in situations where disciplinary or legal consequences could follow. Statements gathered during interviews should always be verified and compared to existing evidence to confirm accuracy.
Analyzing Findings and Assessing Risk
After collecting data and conducting interviews, the organization must analyze findings and assess the associated risks.
Several factors determine the severity of noncompliance.
- Was the behavior intentional or inadvertent?
- Could it lead to significant regulatory penalties or civil liability?
- Is the organization at risk of reputational harm?
- How difficult or costly would it be to remedy the problem and prevent recurrence?
By categorizing findings according to severity and likelihood of recurrence, compliance teams can prioritize actions and allocate resources accordingly. This structured risk assessment informs the overall strategic response.
Implementing Corrective Actions
The next step is developing and implementing corrective actions. These actions must be proportional to the violations uncovered and designed to prevent future issues.
Common corrective measures include:
- Revising or clarifying policies and procedures
- Providing targeted staff training
- Imposing disciplinary actions
- Strengthening internal controls
In some cases, organizations may be legally required to self-report violations to regulatory agencies and cooperate with enforcement efforts. Transparency in this process can demonstrate a strong compliance culture and may even mitigate potential penalties.
Documenting the Investigation
Documentation is the final but equally important step. Every phase of the investigation should be thoroughly documented to ensure transparency, credibility, and accountability.
The final investigation report should include:
- The background and scope
- All data and records reviewed
- Summaries of interviews
- Relevant legal standards and precedents
- A clear statement of findings
- Any corrective actions recommended or taken.
This report serves as both an internal resource and an external defense if regulators, auditors, or legal counsel later examine the matter. It reflects the organization’s commitment to ethical conduct and provides evidence of a methodical, legally sound approach.
Conclusion
In conclusion, conducting a compliance investigation is a complex process that demands thoughtful planning, meticulous data handling, and expert analysis. Rooting the investigation in legal precedent through stare decisis ensures fair and consistent outcomes, while expert interpretation strengthens the objectivity of findings. Ultimately, a well-executed investigation does more than resolve a specific issue—it reinforces an organization’s integrity, demonstrates accountability, and strengthens its ability to withstand future regulatory scrutiny. Organizations that consistently conduct robust investigations and implement meaningful reforms will be better equipped to navigate the ever-evolving regulatory landscape while preserving trust and upholding their reputations.
References:
Evaluation of Corporate Compliance Programs (Updated June 2020).
OIG Compliance Program Guidance for Hospitals.
United States Sentencing Guidelines, Chapter 8—Sentencing of Organizations
The Complete Compliance and Ethics Manual.
Sarbanes-Oxley Act (2002), Pub. L. 107–204
Stark Law (42 U.S.C. § 1395nn)
Health Insurance Portability and Accountability Act (HIPAA), 45 C.F.R. Parts 160, 162, and 164
Witness Preparation and Examination for Corporate Investigations.
A Resource Guide to the U.S. Foreign Corrupt Practices Act (2nd edition, 2020)
Ready to Strengthen Your Compliance Strategy?
At NAMAS, we equip auditing and compliance professionals with expert-led education that helps you lead with confidence. If you’re looking to sharpen your investigative skills or ensure your organization is audit-ready, explore our live trainings, certification bootcamps, and on-demand resources.
Stay ahead. Stay compliant. Stay empowered.
About the Author:
Jordan Johnson, MSHA, iMPaCT
Jordan Johnson, MSHA is committed to ensuring that our patients receive the highest level of cancer care in a patient centric environment. Providing clients with the most innovative and effective solutions and education help increase productivity, revenue and employee & patient satisfaction. Embracing and navigating with data driven approaches to increase efficiency and reduce waste. I also want to ensure that our employees stay motivated and committed to the vision of serving our patients.
