The CCO Who Reports to the CFO: Rebuilding Elements Two Through Seven
You are the newly hired chief compliance officer at a three-hospital, 620-bed nonprofit system. In your first week you learn that the previous CCO resigned 11 months ago and the function was absorbed by the CFO; the compliance committee last met 14 months ago; the board gets a 20-minute compliance update each December; the hotline is answered by an outside vendor, but no one logs or trends the calls; policies were last revised in 2019 and still cite pre-2015 billing rules; and the internal audit plan is set by Finance. The CEO says she wants compliance to be 'visible,' yet the draft budget cuts your department 15% and adds no headcount. Medicare Advantage and Medicaid make up 58% of net revenue.
1. The CEO's first instruction is to 'update every policy to the current billing rules within 60 days.' Explain why that is the wrong first priority, naming which of the OIG seven elements are most impaired and which single structural change matters most.
Read the worked answer
Why policy-first fails. A policy set is element one and is necessary but inert on its own; it produces paper compliance unless elements two through seven operate. Here the impairment is concentrated elsewhere:
- Element 2 (compliance officer and committee): no functioning committee for 14 months, and the CCO role was folded into the CFO - the officer who sets the budget and owns revenue cycle also owns the control function.
- Element 5 (monitoring and auditing): the audit plan is set by Finance, so the function that benefits from favorable coding selects what gets tested.
- Element 4 (communication): the hotline is answered but never logged or trended, so no reporting channel actually reaches decision-makers.
- Elements 6 and 7 (discipline and corrective response): no evidence exists that either is operating.
Rewriting policies would not fix any of these, and it would consume the only credibility capital you have in your first quarter.
The structural change that matters most is restoring functional independence with a visible reporting line - CCO to CEO with a dotted (or, preferably, direct) report to the board/audit committee, a committee charter, and quarterly minutes. Independence is what makes the other fixes durable; a competent CCO under the CFO will keep being outvoted on audit scope and budget.
2. You have 15 minutes on the audit committee agenda in 10 days, and the CFO will be in the room. State your three asks, the single strongest argument for each, and one thing you should not do.
Read the worked answer
Ask 1 - Amend the compliance charter so the CCO has a functional reporting line to the audit committee (and meets with it in executive session at least annually). Argument: the audit committee already owns oversight of internal control and financial reporting; compliance risk is the same category of board-level risk, and directors cannot discharge their Caremark-style oversight duty on a 20-minute December briefing. Framing it as a governance duty, not a turf fight, keeps the CFO from experiencing it as an attack.
Ask 2 - Restore the committee and the hotline analyst position, funded from the 15% cut. Argument: the hotline currently generates data nobody analyzes, which is worse than no hotline because it documents that the organization saw nothing. Cost is a fraction of one recovered overpayment or one excluded-employee event.
Ask 3 - Approve a risk assessment before the 2026 audit plan is finalized. Argument: the plan is currently set by the department with the most exposure to coding and revenue-cycle findings; the audit committee is approving a plan built by the audited.
Do not do: ambush or personally blame the CFO in the room, and do not offer legal conclusions about past conduct you have not investigated. Present it as a maturity roadmap with dates, and bring the CEO along beforehand.
3. Why does a 58% Medicare Advantage and Medicaid payer mix materially raise the stakes on the untrended hotline and the inactive compliance committee?
Read the worked answer
The exposure is federal, not just commercial. Medicare Advantage plans are federal health care programs for purposes of the Anti-Kickback Statute and the Civil Monetary Penalties rules, and Medicare Advantage claims are 'claims' for purposes of the False Claims Act; Medicaid brings a parallel state false claims regime and its own provider-payment prohibitions. That means billing, coding, and remuneration problems that might once have been a payer-contract dispute become treble-damages-plus-per-claim-penalty exposure, with individual liability and exclusion risk.
The hotline gap converts detection into discovery by outsiders. A large share of health care false claims matters begin with an internal report - an employee, a former employee, a competitor. An untrended hotline means the organization gets no early warning, no opportunity to investigate and quantify, and no documented corrective action to show in a later enforcement conversation. It also means the 60-day overpayment clock is likely to be triggered by a government letter rather than by internal analysis, which is the worst possible starting position.
The dormant committee matters in the same way. Enforcement counsel and the OIG assess whether the program was effective in practice, not whether it existed on paper. Fourteen months without minutes is the single easiest fact for a relator's lawyer to use to argue that the organization was indifferent, and indifference is exactly what supports the knowledge element under the False Claims Act.