July 2004 · Volume 86 · Number 6

Chief Compliance Officer: Ensuring Self-Governance Responsibilities 
by Wayne Schmidt
In the past 20 years, there have been spectacular scandals involving major businesses, savings and loan associations, and brokerage houses. Executives and their accountants cooked the books and then shredded and altered documents to cover their misconduct. This provided the impetus for the Sarbanes-Oxley Act of 2002 (SOX), which requires publicly traded companies to adopt and periodically review the effectiveness of their internal controls systems.
Brokerage houses have responded to SOX by creating an internal office of compliance, headed by a chief compliance officer (CCO). While some organizations have appointed a new vice president, others have added the CCO title and responsibilities to the duties of the organization’s chief legal officer or chief financial officer.
The CCO movement has spread internationally, and under Germany’s Corporate Governance Code (2002), multinational firms have set up a compliance office to enforce a zero-tolerance policy toward legal and ethical violations.
Hospitals and other health care institutions are complying with the new privacy regulations mandated by the Health Insurance Portability and Accountability Act (HIPAA) by appointing a CCO to monitor HIPAA and other regulatory compliance. Banks and other financial services companies also have embraced the CCO concept. And a financial CCO certification program is offered by various organizations.
Common threads among organizations with CCOs is that they are substantially affected by federal and/or state laws; they operate under a considerable number of opaque regulations; they are particularly susceptible to media scrutiny; and they are frequently exposed to serious liability claims. Because police agencies and correctional institutions operate in a similar environment, the concept of a centralized compliance office warrants serious examination by local government managers.
Criminal Justice Compliance Office 
Successful businesses have learned that you can pay now for risk reduction systems, or you can pay later in the form of lawsuits and jury verdicts. Almost always, an after-verdict payment is larger than the cost of prevention. Police and corrections agencies can be slower than the private sector to adopt controls, in part because judgments are usually paid from a general fund and not out of the agency’s own annual budget.
Police administrators, however, must actively monitor such concerns as:
1.	Adherence to constitutional requirements relating to the use of force, arrests, the stopping of pedestrians and motorists, searches, seizures, electronic surveillance, infiltration, and interrogations. 
2.	Violations of internal rules, regulations, policies, procedures, and standards of conduct. 
3.	Unauthorized releases of criminal histories and driver information. 
4.	Improper disclosures of personnel information. 
5.	Illegal or unethical access to restricted data or privileged information. 
6.	Inadequate investigations of citizen complaints about officer misconduct. 
7.	De-policing, profiling, and other equal protection failures. 
8.	Adherence to injunctions and other judicial decrees. 
9.	Misuses of funds, equipment, or personnel. 
10.	Safety violations. 
11.	Employee whistle blowing. 
Jail administrators must actively monitor similar matters, including:
Internal inspections and audits, like accreditation, will require a time commitment from managers and supervisors. But the establishment of a central compliance office does not require a substantial budget. Duties and responsibilities may shift, but additional personnel are not required.
1.	Proper adherence to constitutional requirements relating to the use of force, prisoner and cell searches, and access to courts and counsel. 
2.	Violations of internal rules, regulations, policies, procedures, and standards of conduct. 
3.	Improper disclosures of personnel information. 
4.	Deficient investigations of inmate complaints about officer misconduct. 
5.	Indifference to inmate-on-inmate physical or sexual assault. 
6.	Inadequate sanitation and medical care. 
7.	Wrongful censorship of inmate mail. 
8.	Proper adherence to injunctions and other judicial decrees. 
9.	Safety violations. 
10.	Employee whistle blowing. 
Methodology
There are many components in an effective compliance system. Some of the more prominent ones are:
Periodic inspections. An audit manual and checklists help ensure uniformity. In medium-sized agencies, inspections can be delegated to divisional commanders and unit supervisors, while in larger agencies, specially trained internal investigation personnel could perform inspectional duties.
Random audits. Nonpatterned examinations encourage voluntary compliance and uncover errors and misconduct. This method has proven effective in detecting and reducing substance abuse.
Personnel education and training. Workers need to be trained to follow standardized policies and procedures, while supervisors and managers need to be educated on how to implement and interpret policies and procedures. Ethics awareness also should be a component of in-service training programs.
Inducements. Compliance proficiency can be a component of periodic employee competency ratings, leading to promotion and assignment preferences.
Fairness and objectivity. Employee associations need assurance that compliance inspections and random audits will be conducted on a nonselective basis, in a standardized manner, and that assessments will be free from bias and political or fraternal influence. Union leaders have a fiduciary duty to question the way a compliance office is implemented and how it functions. For its part, management should be prepared to demonstrate how effective compliance can reduce citizen (or inmate) complaints and minimize liability for the agency and its employees.
Compliance officers also need to report what is being done well, along with any improprieties that might be discovered. 
Funding and Organizational Staffing
Management will have to define the scope of inspections and audits, in consultation with the entity’s legal and risk management offices. It is premature to suggest targets and methodology in the preplanning stages.
Internal inspections and audits, like accreditation, will require a time commitment from managers and supervisors. But the establishment of a central compliance office does not require a substantial budget. Duties and responsibilities may shift, but additional personnel are not required.
The CCO will need to learn new skills and methods, but except in the largest agencies, the assignment requires only the conferring of additional authority, duties, and responsibilities. In medium-sized agencies, the commander of the internal affairs unit or a civilian risk manager could fulfill this role. In smaller agencies, however, a deputy chief (or chief deputy sheriff) could be designated the CCO. If the agency is accredited, the accreditation manager could coordinate the compliance office.
The CCO should report directly to the city or county executive and agency head on compliance matters, without exhausting a chain of command. He or she should also be able to contact the agency’s legal representatives directly and to discuss problems or concerns from a legal perspective.
Similarly, all employees should be able to contact the CCO directly, especially if they have ethical questions or need interpretive guidance on agency policies and procedures. Normally, paramilitary courtesy entails informing one’s superiors that the CCO’s opinion will be sought.
Several communities might want to form a cooperative arrangement, whereby officers from one agency would conduct random and periodic compliance inspections of participating sister agencies. This model would relieve superior officers of having to confront their direct subordinates and coworkers and would minimize any bias or favoritism.
A multiagency inspections team standardizes the inspections process for all participating agencies. Although the results still would be given to each agency head and CCO for review and remedial action, greater transparency results when outsiders are involved. 
Benefits of Central Compliance
1.	The local government manager and the police chief (or sheriff) will get the needed periodic assurance that subordinates are properly interpreting and following agency policies and procedures. 
2.	Because administrative negligence often is alleged in lawsuits, civil juries need objective proof that management has established a system to reveal mistakes, to uncover misconduct, and to encourage professional behavior. This proof they will obtain with a CCO in place. 
3.	Political leaders are less likely to overreact to partisan criticisms by special-interest groups when management has adopted a reliable internal control system. 
4.	Periodic reporting by the CCO enhances agency transparency and provides assurances of proper self-governance. 
5.	If the agency currently has a citizen oversight panel, the CCO is in a strategic position to coordinate and converge the interests of the agency and panel. 
6.	If the agency is accredited or in the process of achieving accreditation, the CCO will be a pivotal participant. 
Wayne Schmidt, Park Ridge, Illinois (AELE@aol.com), is a Chicago-area police attorney. Since 1988, he has served as cochair of the legislation committee of the International Association of Chiefs of Police, Alexandria, Virginia.