Your First 30 Days: A Fresh Look at Your Compliance Program

One of the things consultants value about working at BluePeak Advisors is the opportunity to step into roles within a health plan that other consultants do not always experience firsthand. Over the years, we have provided interim support in many areas, but one of the roles we are asked to fill most often is Medicare Compliance Officer.

When a compliance officer leaves, whether for a new opportunity or because the organization is ready for a different direction, it creates an immediate leadership gap. BluePeak is often asked to step in while the plan searches for a permanent replacement.

These assignments put us back in the health plan seat. We roll up our sleeves, work alongside the team, and experience the same day-to-day pressures they do. But because we are new to the organization, we also notice things that may have become part of the background.

That perspective raises an important question: How often do compliance leaders intentionally step back and look at their programs as if they were seeing them for the first time?

When you have lived with the same processes, meetings, risks, and challenges for months or years, it is easy for “the way we do things” to become simply the way things are. Fresh eyes may uncover overlooked risks, reveal opportunities for improvement, or validate that the program is working as intended.

The first 30 days in a compliance leadership role are not about changing everything at once. They are about listening, observing, and understanding how the program really works before deciding where to focus. We are diving deep into the question, “If I were taking a fresh look at a Medicare compliance program today, where should I start?”  Our consultants agree that you should start with three focus areas:

01Start with culture

One of the first things we suggest to pay attention to is the culture of the compliance team and the role compliance plays across the organization. Culture is where “tone at the top” becomes visible.

Is compliance invited to the meeting? Do business partners raise concerns early? Is the team seen as part of the solution, or as the group that slows things down?

Our consultants have worked in organizations where people avoided compliance because they were afraid of getting in trouble, causing an overreaction, or creating more work for themselves. That may not have been the message compliance intended to send, but it was the message people received.

When issues are not raised early, the organization loses the opportunity to understand the root cause, correct the problem, and prevent it from happening again.

The answers may tell you as much about the effectiveness of the program as any policy, dashboard, or committee report.

02Determine whether compliance is operational

There is a difference between providing traditional compliance support and practicing what we think of as operational compliance.

Operational compliance means rolling up your sleeves to understand why noncompliance is happening, not simply identifying that it happened. It requires looking beyond a finding to understand the processes, systems, handoffs, ownership, and decisions that contributed to it.

Teams that work this way tend to build stronger relationships with the business because they understand the work behind the issue. They are better positioned to help identify solutions that are both compliant and operationally realistic.

The structure will look different in every organization. Some compliance teams own regulatory reporting, day-to-day issue management, or other “run the business” responsibilities. In other organizations, those activities sit with operations. Neither model is automatically right or wrong.

What matters is whether the team understands what it owns, is equipped to fulfill those responsibilities, and remains close enough to the actual work to recognize risk. If compliance is too far removed, important operational context can be missed. If it is too embedded, maintaining independence can become more difficult.

A new or interim compliance officer should understand that balance before deciding what needs to change. An established compliance officer should revisit it periodically rather than assume the existing structure is still the right one.

03Revisit the risk assessment

One of the first documents our consultants ask for is the most recent compliance risk assessment.

Does one exist? If not, that tells you something right away.

A strong risk assessment should drive the monitoring and auditing work plan and help the compliance team focus its limited time and resources on the areas of greatest concern. But the presence of a risk assessment does not necessarily mean it is doing that.

Then ask the harder question: If we started our risk assessment from scratch today, would we identify the same risks?

Changes in leadership, staffing, vendors, systems, operations, and regulatory expectations can alter the risk picture quickly. A risk assessment that was meaningful when it was completed may no longer reflect where the organization is most vulnerable.

Looking at it with fresh eyes can reveal whether it is actively guiding the program or has become an annual exercise that produces a document but does not meaningfully affect the work.

Get comfortable with the uncomfortable

Being a compliance officer can be a thankless job. Compliance usually is not called when everything is going well. More often, we are asked to step in when something has gone wrong, the answer is unclear, or the organization is facing a difficult decision.

In a program as complex as Medicare, a compliance function that sees only sunshine and roses may not be looking closely enough.

One of the first things a compliance officer learns is how to be uncomfortable. Our advice is to get comfortable with that, at least for a while.

You do not need to have every answer on day one—or even by day 30. You do need to ask the right questions, make room for honest conversations, and be willing to challenge assumptions. The goal of those first 30 days is not to arrive with a list of fixes. It is to understand the culture, how the team operates, and where the organization’s risks are so the path forward becomes clearer.

Take another look

Try looking at your program as if you were the new Compliance Officer walking in tomorrow. What would you want to understand in your first 30 days?

What would you ask about first? What would surprise you? Where might the documented process differ from what happens in practice? What have you stopped questioning simply because it has always been done that way?

You do not need to wait for a leadership transition to benefit from fresh eyes. Sometimes the most valuable thing a compliance team can do is step back from the day-to-day, test its assumptions, and take an honest look at whether the program is working the way it thinks it is.

That outside perspective may reveal risk, but it can also identify what is working well and where the team has built a strong foundation. Either way, it gives the organization a clearer view of where to focus next.

Sometimes the best question is not simply, “Are we compliant?” It is, “What might we see if we looked again?”

Very truly yours,
BluePeak consultants who have served as Interim Compliance Officers

This is the first article in BluePeak’s “From the Desk of an Interim Compliance Officer” series, focused on practical lessons from inside the compliance function.