When the Compliance Officer Reports to the CFO Under Investigation
A 200-bed community hospital's compliance officer, hired 11 months ago, reports directly to the CFO. The CFO also chairs the compliance committee and signs off on the compliance work plan. The compliance officer discovers that the CFO approved a physician compensation arrangement that appears to exceed fair market value by roughly 22% based on a valuation obtained 3 years ago and never refreshed. When she raises it, the CFO tells her the valuation is fine and asks her not to escalate until after the bond issuance closes in 6 weeks. The compliance officer has a documented conversation with the CEO, who defers to the CFO. The hospital's compliance program is described in its code of conduct as "effective and independent."
1. Evaluate the structural defect and recommend specific changes, distinguishing what can be fixed now from what requires board action.
Read the worked answer
The reporting line is the defect: a compliance officer who reports to the CFO cannot independently investigate the CFO. Federal guidance on effective compliance programs treats independence and adequate authority as core elements, and the arrangement described - CFO chairs the committee, approves the work plan, and is the subject of the concern - fails all three. Immediate steps within the officer's control: document the concern, the valuation gap, and the CFO's instruction in writing; retain the original valuation and any communications; and preserve records given the bond issuance creates a foreseeable document-retention trigger. Steps requiring board action: move the reporting line to the CEO, the board, or the audit committee; remove the CFO from chairing the compliance committee; and have the audit or compliance committee, not the CFO, commission an independent refreshed valuation. The officer should escalate to the board audit committee now, because the CFO's request to delay past the bond closing is itself a red flag - the disclosure obligations connected to a bond offering can make silence materially worse. She should not accept the 3-year-old valuation as conclusive; a 22% gap over FMV is a Stark and AKS exposure that requires a qualified independent opinion.
2. What should the compliance officer do about the request to wait 6 weeks?
Read the worked answer
Decline, and put the refusal in writing. A request to delay escalation until a financing event closes converts a compensation question into a potential securities disclosure problem and undermines any later claim that the program operated in good faith. The officer's duty runs to the governing body, not to the executive who chairs her committee. Practical path: notify the audit committee chair immediately in writing, state the facts and the reason for urgency, and ask for direction. If no independent channel exists, the officer should consider whether outside counsel or a regulator reporting channel is appropriate, and should consult her own counsel about whistleblower protections. She should also confirm whether the bond documents contain representations about compliance program effectiveness that are now inaccurate.