forms as compliance controls · vio\൬ations of regulation z’s credit card requirements were...

$: FORMS AS COMPLIANCE CONTROLS · Vio\൬ations of Regulation Z’s credit card requirements were also identified. In short, customers did not have all the information th對ey needed$
FORMS AS COMPLIANCE CONTROLSIMPROVE COMPANY COMPLIANCE USING FORMS

DUSTIN BORKLUND 1

Presenter

Presentation Notes

People don’t think of forms as compliance controls. You all know what forms are. If you don’t know what a compliance control is, we will talk about it, but first who am I?

DUSTIN BORKLUND

Certified Forms Consultant

Certified Compliance and Ethics Professional

Plain Language

Electronic Forms Technologies

Economic Order Quantity

Healthcare

Auto Finance

[email protected]

www.linkedin.com/in/borklund

DUSTIN BORKLUND 2.

I WASN’T ALWAYS A COMPLIANCE PERSON

Constantly wanting to eliminate or rewrite required disclosures to make them readable.

Frustrated with legalese.

Revisions from outside counsel made no sense.

Never provided the law that the form was trying to comply with.

Lawyers would sometimes review my forms and simply use a red pen to add redundant words.

I had to explain to my form owners that features and words were legally required.

I wanted to include dynamic features in electronic forms but Legal needed to see all permutations.

Many customer complaints were related to problems I was trying to fix.

Legal/Compliance would write disclosures themselves or copy disclosures directly from the law.

Review cycle took too long.

Translation lawyers would fight with professional translators over minor words.

DUSTIN BORKLUND 3

Presenter

Presentation Notes

I was usually the one fighting against Compliance, which I saw as unnecessary red tape, the DEPARTMENT of NO, as I was on the side of Business, Marketing, and the Customer.

FORMS ARE THE COMPLIANCE PROGRAM’S BEST FRIEND

Blank forms are evidence of a company’s compliance program working.

Forms are scrutinized in regulatory compliance exams.

Forms are requested in investigations and discovery.

Forms are often the only contact a customer will have with a company like Toyota.

Forms are the face of the company to many customers.

Forms were constantly updated to meet legal requirements – about 5% of forms per year at TFS.

Forms can contain field-level validations that make the user fill it out correctly, check for math errors, etc.

Forms can contain form-level validations that prevent the form from being sent if it is not complete (or not compliant).

Well designed forms reduce risk.

Unreviewed, stale and unnecessary forms increase risk.

DUSTIN BORKLUND 4

Presenter

Presentation Notes

But then I got a little training and woke up. I still felt strongly about forms being the lifeblood of an organization, so I changed my tune. I became a compliance ambassador, or enthusiast if you will, and promoted forms as compliance controls.

WHAT WE WILL COVER TODAY…

The Doctor’s Office

Compliance 101

Compliance Failures

Plain Language

Forms Compliance

PracticesExamples Q & A

DUSTIN BORKLUND 5

THE DOCTOR’S OFFICE

DUSTIN BORKLUND 6

Presenter

Presentation Notes

This is all you have when you get to a new doctor’s office. You know you are going to get one of these when you get there….

THE CLIPBOARD

New Patient Questionnaire (Why?)

Insurance information (On the card)

Privacy Policy (Did I get it?)

Health History (a hundred Yes/No questions)

Communications Consent

Some you are signing in blank

Some obligate you to pay whatever they say regardless of what the insurance company says

DUSTIN BORKLUND 7

Presenter

Presentation Notes

They tell you to come early, in fact, to do some paperwork.

IS YOUR HEALTHCARE AS GOOD AS YOUR FORMS?

DUSTIN BORKLUND 8

Presenter

Presentation Notes

Does the healthcare you receive reflect the quality of the forms they provide? Does the compliance in the front office reflect the compliance in the examination room?

COMPLIANCE 101A QUICK INTRODUCTION TO COMPLIANCE AND ETHICS

DUSTIN BORKLUND 9

Presenter

Presentation Notes

In order to talk about forms as compliance controls, we need to do a little Compliance 101. By show of hands, how many people are currently considered compliance officers, compliance managers or compliance staff for their company? How many people work in a department within the compliance, risk or legal department? Who is aware of their compliance department? Who doesn’t have a compliance department? OK good, moving on…

COMPLIANCE IS THE SECOND LINE OF DEFENSE AGAINST RISK

…customer facing operational management has ownership, responsibility and accountability for directly assessing, controlling and mitigating risks

DUSTIN BORKLUND HTTPS://WIKI.TREASURERS.ORG/WIKI/THREE_LINES_OF_DEFENCE_MODEL 10

1st

2nd

3rd

…consists of independent risk management, compliance and operational risk functions, including oversight…monitors the implementation of effective risk management practices by operational management and assists the risk owners in reporting adequate risk related information.

…internal audit, reporting directly to the board. Internal audit reviews and reports on both the first and the second lines of defense.

Presenter

Presentation Notes

First line defense is your customer service department and their management. Anyone who deals with customers. It can be your web site or app as well. Second line of defense is Legal, Compliance, Risk Management, HR, etc. Third line of defense is Internal Audit. They come in and do an independent assessment, report directly to the Board or the Owners and leave. They measure the first and second lines of defense.

https://wiki.treasurers.org/wiki/Three_Lines_of_Defence_Model

COMPLIANCE IS…

a system of individuals, processes, and policies and procedures developed to ensure compliance with all applicable federal and state laws, industry regulations, and private contracts governing the actions of the organization.

a living, ongoing process that is part of the fabric of the organization.

a commitment to an ethical way of conducting business and a system for helping individuals to do the right thing.

DUSTIN BORKLUND 11

education enforcement prevention detection collaboration

COMPLIANCE IS NOT…

the responsibility of the Compliance Department.

DUSTIN BORKLUND 12

education enforcement prevention detection collaboration

COMPLIANCE’S VALUE PROPOSITION

US Federal Sentencing Guidelines for Organizations

“An organization “shall periodically assess the risk of criminal conduct and shall take appropriate steps to design, implement, or modify each requirement [of its compliance and ethics program] to reduce the risk of criminal conduct identified through this process.” (§8B2.1(c))

“Risk management elements: Standards and Procedures (Internal Controls), monitoring, auditing, periodic evaluation. (§8B2.1(b)(1)(5))

DUSTIN BORKLUND 13

SEC CFPB DOL FTC HHS OIG

Presenter

Presentation Notes

Value proposition means how does the Compliance Department contribute to the bottom line?


US Federal Sentencing Guidelines for Organizations

Have a working CMS (Compliance Management System)

Self Disclose

DUSTIN BORKLUND 14

SEC CFPB DOL FTC HHS OIG

Presenter

Presentation Notes

Is 95% off a $100 million consent order a good deal?


Reduce Fraud Association of Certified Fraud Examiners has

determined that the typical company loses 5-6% of its annual revenue to fraud

DUSTIN BORKLUND 15

Keep people out of jail Officers and owners who knowingly

permitted compliance failures could face jail time.

Presenter

Presentation Notes

Besides the 95%, keeping your officers and owners out of jail, a compliance department helps minimize fraud which affects all business to the tune of 5-6%.

NINE COMPONENTS OF A CMS

Risk Assessments

Policies & Procedures

Support from the Top

Third Party Management

Training

Testing and Monitoring

Reporting and Investigating

Enforcement

Prevention

DUSTIN BORKLUND 16

RISK ASSESSMENTS

Risk Assessments

Policies & Procedures

Support from the Top

Third Party Management

Training

Testing and Monitoring

Reporting and Investigating

Enforcement

Prevention

DUSTIN BORKLUND 17

Presenter

Presentation Notes

The first, and perhaps most important step in Compliance, is determining risk. The US Federal Sentencing Guidelines says you must allocate resources according to their risk. If you don’t do this you’re going to run out of money, people, etc. and you will be just putting out fires.

EXTERNAL AND INTERNAL INPUTS

EXTERNAL INPUTS

Trade journals, business press

Legal notices and subscriptions

Enforcement activities and trends

Social Media and marketplace trends

Industry benchmarking and practices

Complaints

DUSTIN BORKLUND 18

INTERNAL INPUTS

Talk to managers and front-line people

Past incidents and investigations

New business operations

Security issues

Internal audit

Changing Incentives

Hotline records

INHERENT VS RESIDUAL RISKS

DUSTIN BORKLUND 19

INHERENT RISK

Risk without any management activity or before controls are in place.

EXAMPLE: Automated Expense Reports cause disbursement of funds based on whatever is reported, instantly.

RESIDUAL RISK

Level of risk that remains after appropriate controls have been put in place.

EXAMPLE: Expense Reports have built-in limits, approval authorities, and validations that must be met before funds are disbursed.

Presenter

Presentation Notes

Now, there are two kinds of risks – Inherent and Residual.

SCORE RESIDUAL RISKS ON TWO OR MORE LEVELS

Scope

Impact

Financial

Legal

Reputational

Likelihood

DUSTIN BORKLUND 20

Presenter

Presentation Notes

Use risk attributes appropriate to your business to score your risks. Also, find out if your company as a Risk Appetite Statement and us that to inform this chart.

DEVELOP AN ACTION PLAN

ACTION PLAN

Allocate resources based on Risk Appetite

Implement new or revised Policies & Procedures

Conduct targeted training

Recommend stronger technology controls

Suggest Org Chart changes

Performance Management

DUSTIN BORKLUND 21

DON’T FORGET

Compliance Department doesn’t implement controls, they recommend, check, evaluate, report, etc. the controls put in place by the company.

CMS

Compliance Department oversees the Compliance Management System to track all of this.

POLICIES & PROCEDURES

DUSTIN BORKLUND 22

POLICIES

The rules written by and for the company.

The WHAT

PROCEDURES

The guidelines or steps written by the company in order to support the Policies.

The HOW

CODE OF CONDUCT

DUSTIN BORKLUND HTTPS://WWW.VERIZON.COM/ABOUT/OUR-COMPANY/CODE-CONDUCT 23

Presenter

Presentation Notes

All big US companies and many small and medium sized companies have a Code of Conduct.

https://www.verizon.com/about/our-company/code-conduct

CODE OF CONDUCT

CODE OF CONDUCT TOPICS

Sexual harassment policy

Workplace violence

Employee privacy

Misconduct off the job

Conflicts of interest

Insider trading

Whistleblower/Non-retaliation

DUSTIN BORKLUND 24

Use of company equipment

Company information nondisclosures

Expectations for customer relationships and suppliers

Policy on accepting or giving gifts to customers or clients

Bribes

Relationships with competition

EXECUTIVE MANAGEMENT / TONE FROM THE TOP

DUSTIN BORKLUND 25

CEO

CFO COO CIO General Counsel

CCO

Executive Assistant

VENDOR MANAGEMENT

DUSTIN BORKLUND 26

Presenter

Presentation Notes

Credit Card Administration Some banks hire vendors to administer and market credit card programs. In one case, a vendor was marketing a balance transfer credit card program as a way for bank customers to obtain a new credit card while paying down the balance on an existing one. However, the vendor did not properly disclose all of the fees connected to the product. Bank management was not monitoring or reviewing the vendor’s activities and did not identify the errors. This action by the vendor ultimately resulted in a finding of deceptive marketing practices based, in part, on the vendor’s failure to correctly disclose fees. Violations of Regulation Z’s credit card requirements were also identified. In short, customers did not have all the information they needed about the product to make an informed decision and did not learn about certain features until after they had been assessed nonrefundable fees. Bank management assumed that the vendor was responsible for compliance because the vendor made the credit decisions and owned the credit card receivables. However, the bank’s name was on the credit cards, and under the agreement between the parties, the bank was deemed a creditor in the transaction. The bank was therefore accountable for the compliance violations, not to mention the reputation risk of having its name associated with a deceptive practice. It is also noteworthy that the Consumer Financial Protection Bureau undertook three enforcement actions against three major credit card issuers this year, all of which involved compliance issues with vendors hired by the card issuers. The enforcement orders contained specific provisions requiring the issuers to change their compliance management systems concerning oversight of vendors. YOU CAN’T OUTSOURCE COMPLIANCE

TRAINING AND COMMUNICATION

DUSTIN BORKLUND 27

Questions a Compliance Officer asks:

Is it targeted?

Is it measured?

Is it required?

Is it online, in person, of sufficient length and depth?

Does it address the risks?

Is it documented?

Is it current/accurate?

Is it in the language of the audience?

HOTLINE AND NON-RETALIATION

DUSTIN BORKLUND 28

Managed by a third-party?

Non-retaliation statement for good faith reports?

Periodic reports to the Board or Owners?

Timely investigations?

Multiple avenues (phone, email, web form, etc.)?

Language appropriate?

COMPLIANCE FAILURE

DUSTIN BORKLUND 29

Presenter

Presentation Notes

American Express CFPB Consent Order 8/23/17 PRVI Amex card for PR, USVI, Guam, etc. with terms worse than continental US terms. Certain collections offers in PR were not provided to Spanish speakers. $95 million in remuneration to victims WHAT COULD A FORMS PROFESSIONAL DO?

COMPLIANCE FAILURE

DUSTIN BORKLUND 30

Presenter

Presentation Notes

Federal Debt Assistance Association, LLC, CFPB Sued on 10/12/17 Looks like Federal Notice Falsely advertised that they would eliminate or reduce consumers’ principal balances by at least 60 percent WHAT COULD A FORMS PROFESSIONAL DO?

PLAIN LANGUAGE

DUSTIN BORKLUND 31

Presenter

Presentation Notes

Can you do this? Plain Language is just “Communication that your audience or readers can understand the first time they hear it or read it.” Plain Language is one area that a form professional can improve an organization’s compliance immediately. There are tons of resources online and even at this conference, but if you can turn this into this, you are immensely valuable to your Compliance Program, the legal department and even the customer service department.

PLAIN LANGUAGE

DUSTIN BORKLUND 32

Use a Plain Language Checklist

Get the Checklist approved by Legal, Marketing and Compliance

Write a Corporate Policy for Plain Language

Provide materials to, or hold a class for, other writers in your company

Employ a Plain Language expert to evaluate your company

Presenter

Presentation Notes

Without going deep into Plain Language, here are my recommendations to you.

PLAIN LANGUAGE

DUSTIN BORKLUND 33

Resources

http://centerforplainlanguage.org/

https://writing.wisc.edu/Handbook/ClearConciseSentences.html

https://www.michbar.org/generalinfo/plainenglish/home

http://www.plainenglish.co.uk/how-to-write-in-plain-english.html

www.faa.gov/about/initiatives/plain_language/basic_course/

https://www.plainlanguage.gov/

Presenter

Presentation Notes

The Internet is full of plain language resources because it’s a law that government must always use plain language. Here are just a few of the good ones.

OTHER AREAS FORMS PROS HELP

DUSTIN BORKLUND 34

Was the form approved by all necessary stakeholders?

Do you have the forms translated properly?

What problems does the Audit Department see in our Expense Reports?

Are there prohibited or unfair questions on our Credit Applications or our Employment Applications?

Is the information in the small type more important than the information in the large type?

Presenter

Presentation Notes

These are just examples, but with a compliance mindset you will see your forms in a way you haven’t before. If you take the right steps, your forms area will be empowered to be “compliance deputies” and protect the company.

IN CONCLUSION…

DUSTIN BORKLUND 35

Forms are a reflection of the company or government agency.

Compliance is increasingly important and forms play a role.

As a Forms Professional you have an opportunity to impact compliance.

Presenter

Presentation Notes

As Forms Professionals, we have a responsibility for compliance. Not only does the content need to comply with the law, it needs to fit our company ethic, be understandable, be easy to use, and consistently reflect the brand.

FORMS AS COMPLIANCE CONTROLSIMPROVE COMPANY COMPLIANCE USING FORMS

DUSTIN BORKLUND 36

Q&A

Presenter

Presentation Notes

What questions do you have for me?

forms as compliance controls · vio\൬ations of regulation z’s credit card requirements were...

Documents