For life science compliance professionals, one message came through clearly during Mary Riordan’s Annual OIG Update at the 27th Annual Pharmaceutical and Medical Device Ethics and Compliance Congress: Compliance programs are under increasing pressure as challenges grow and government expectations rise.

Ms. Riordan, Senior Counsel with the OIG, covered recent enforcement actions, Corporate Integrity Agreements (CIAs), compliance guidance, and areas receiving increased scrutiny.

Across those topics, a common theme emerged: effective compliance requires active monitoring, strong governance, relevant training, and a willingness to look beyond the usual risk areas.

Following is NXLevel Compliance’s synopsis of key messages, with an emphasis on potential implications for compliance training.

Compliance Risks Aren’t Limited to Sales

Kickbacks continue to be a major focus, with recent enforcement actions involving specialty pharmacies, patient assistance foundations, speaker programs, consulting arrangements, meals, travel, and other HCP interactions.

But compliance teams also need to think more broadly about who creates risk.

Recent CIAs have expanded the focus from traditional sales representatives to “field personnel,” including other employees who also interact with HCPs, healthcare organizations, and formulary decision-makers. A recent settlement between DOJ and Veloxis, for example, included alleged misconduct involving Market Access activities.

For compliance training, that’s an important reminder. Training shouldn’t be one-size-fits-all or focused primarily on sales. Market Access and other field-based teams encounter different compliance situations and need training tailored to those real-world risks.

Policies Are Only the Starting Point

Ms. Riordan highlighted recent enforcement cases that show what can happen when companies have rules, but employees find ways around them.

They included examples of employees manipulating expense reports to stay within meal limits, paying for inappropriate travel and entertainment, and paying consulting invoices for work that wasn’t performed.

That’s why monitoring matters. Compliance teams need to look at everything from HCP call notes and electronic communications to consulting agreements, advisory board records, meals, and travel. Field ride-alongs can provide an additional window into what’s really happening.

Training can be another important part of that equation. Rather than simply explaining policies and spending limits, effective training can put employees into realistic scenarios and challenge them to recognize the risks, make the right decisions, and know when to ask for help.

Just as importantly, monitoring results can help inform future training. If audits or field monitoring uncover recurring areas of confusion, those findings can become the basis for targeted education and reinforcement.

AI Is Joining the Compliance Conversation

Generative AI is also showing up in recent CIAs. Organizations and Independent Review Organizations may be required to disclose certain uses of generative AI and independently verify the accuracy of AI-generated output.

Even for companies that aren’t operating under a CIA, there’s a useful takeaway: employees using AI need to understand the related compliance expectations, including the importance of human review and accountability.

Compliance Needs a Seat at the Table

The OIG is also continuing to emphasize compliance independence and authority. Principles from its 2023 General Compliance Program Guidance are appearing in newer CIAs, reinforcing expectations around direct access to senior leadership and boards, compliance officer independence, and meaningful oversight by compliance committees and directors.

That same philosophy applies to training. Training shouldn’t exist simply to check an annual requirement off the list. It should support the risks the compliance program is actually identifying and help employees put policies into practice.

From Knowing the Rules to Applying Them

Perhaps the biggest takeaway from the OIG update is that effective compliance is increasingly concerned about what happens in the real world.

Policies and training provide the foundation, but organizations should be asking deeper questions: Does our training reflect the situations employees actually encounter? Are we reaching all the people who create or manage compliance risk? Can employees recognize a problem when there isn’t an obvious right answer?

Ultimately, good compliance training should help people recognize risk and make better decisions when it counts.

Thanks for reading!

-Paul Nash

pnash@nxlevelsolutions.com

NXLevel Compliance