The Investment Deep Dive, Part 2: What Does Compliance Investment Actually Buy You?
Watch Now
Listen Now
-
Most CEOs ask Ross Ronan the same question: how much should we spend on compliance? In Part 2 of The Investment Deep Dive on The Compliance Advantage, Ross moves from the HCCA and SCCE benchmarking data into real boardroom scenarios and shows there is no magic number. There is a starting point, a budget you set, and a program you actually run. He walks through what the data says for a $75 million organization with 1,500 employees, how the picture shifts at $200 million and 4,000 employees, and why the two largest line items are almost always the compliance officer and auditing and monitoring. He explains why private equity sponsors tend to lean into compliance once they see the benchmarks, since the Department of Justice and the Office of Inspector General have made their expectations for healthcare investors clear. He covers what payers, including Medicare under the Affordable Care Act, assume about your program before they pay a claim, and how compliance partners with every department from human resources to revenue cycle. The throughline is simple: a strong compliance investment starts with the right compliance executive, someone who can be a strategic partner, run the program, and understand the business. Build from there and the program scales with the company.
-
How much should a healthcare organization spend on compliance?
There is no single right number. The HCCA and SCCE survey data gives a starting point. For a $75 million organization with about 1,500 employees, that benchmark lands in the 150 to 250 thousand dollar range. The real driver is the volume of compliance issues an organization is managing. More issues means more resources, regardless of revenue or headcount.
What are the two biggest costs in a compliance program?
The compliance officer and auditing and monitoring are almost always the two largest line items. Items like a third party helpline and policy management are small, incremental dollars by comparison.
How should a CEO bring compliance budget data to the board?
Use the benchmarks to set the starting point, then set the budget and keep it. Ross describes putting the first commitment in place, around $150,000 for a mid-size organization, and treating it as a permanent part of the budget and the culture. After that, adjustments as the company grows are minor. The mistake is funding it for six months and then pulling it back.
Why do private equity sponsors invest in compliance?
Sponsors have made a large investment they need to protect, financially and reputationally, and their limited partners expect them to do the right thing. The Department of Justice and the Office of Inspector General have made clear they expect investors in healthcare to operate responsibly. Once a sponsor sees the benchmark for what compliance should cost, RHC often becomes a strategic partner rather than a vendor.
What do payers expect from a healthcare compliance program?
If you bill and collect from Medicare and Medicaid, the Affordable Care Act requires a compliance program in place, with the Office of Inspector General providing the guidance on what it should look like. Enrolling in federal healthcare programs is a commitment not to defraud them. Commercial payers carry the same expectation. When a UPIC, RAC, or CMS audit begins, the first question is how you are complying.
What does a strong compliance investment actually buy you?
It starts with the right compliance executive: someone who can be a strategic partner, run the program, and understand the business. Once that person is in place, the rest becomes easier, and their work can be augmented with specialists and third party support. Building bottom up, by assigning compliance to someone else and funding around them, rarely scales and usually costs more later.
-
Interviewer (24:19)
Welcome back. In part one, we walked through the HCCA benchmarking data on compliance investment. Now let's make all of this real. Ross, if a CEO is running a $75 million organization with about 1,500 employees, what does this data tell them?
Ross Ronan (24:39)
This is a very common number that we see a lot in the $75 million range. Whether they're traveling from 50 to 75, or 25 to 50, $75 million with about 1,500 employees is very common. And this is really where the risk pain point gets to be higher.
For these organizations, at some point you need to hire a CFO. If you're getting five, ten million in revenue, at some point you need to go in and establish your compliance program and make that investment.
So if you're about $75 million with 1,500 employees, from the revenue standpoint, we see about 66% of those companies that fall within this 50 to 100 million dollar range spend over $100,000 in compliance. They've really set that budget in place. And about half of them spend more than $250,000.
So you have this range between 100 and 250 thousand dollars. That's really a sweet spot. And when you think about the employee size, the one thousand to three thousand range, about 78, 79% invest more than $100,000, and about 50 to 60% actually spend more than $250,000. They do correlate quite a bit, give or take about 10%.
So for a size of about $75 million with 1,500 employees, you'd be in the 150 to $250,000 range, which would be about where your sweet spot is to put your compliance budget in place and resource it accordingly.
Interviewer (26:10)
What about a larger organization, say $200 million, 4,000 employees? How does the picture shift?
Ross Ronan (26:19)
It shifts quite a bit, because there's a lot of revenue that is coming most likely from government payers, government funds. So once you start getting your capacity a little bit bigger, your risk shifts a little bit more.
In the $200 million range, you'd be looking at about 60% of your peers spending more than $250,000 a year. And that's not just the compliance officer, it's your compliance staff as well as your helpline, your audits, and your policy management if you're doing that. But those are small, incremental dollars compared to the resources. The two top expenses in a compliance program are your compliance officer and your auditing and monitoring. Those are generally the biggest expenses you have.
So when you look at the $200 million range and the 4,000 employees, when you get up in the employee range, you're talking a little bit more, like 80% spending over $250,000. So you have 60% on the $200 million range, but your employee size at 4,000 is going to drive you up a little bit more, because more people are spending more money with a lot more people associated with the organization.
Interviewer (27:49)
How does this kind of data change the dynamic when you're sitting in front of a board?
Ross Ronan (27:59)
Like I've said in the past, I get asked all the time, what should our spend on compliance be? And there's not a “should” out there. There's a, is your compliance program working? Is it living? Is it breathing? Is it doing what it needs to do? And if it's not, and your compliance person, if it's the right compliance person, is saying I need more resources, I need more consultants, like auditors, to do my job more effectively and provide that information to you, you need to listen to what they say.
I wish there was a benchmark to say this is what it's going to do. But we use these benchmarks in front of boards and CEOs to say, this is where we need to start. This is where we need to put a pin in the map, put a budget together, and this is where we need to start.
And once you've made that first commitment and investment in compliance, especially when you're talking to boards and CEOs, once you put the first $150,000 into that budget and you set it and forget it, adding 50, adding 100 here and there as you grow doesn't become such a monumental task.
So when you're having that conversation with your CEOs and your board members, saying this is what we need to put into this because I think that's the appropriate amount and we can scale and grow with it, and any changes thereafter are de minimis or not material in the big scheme of things, people start going, okay, I get it. That makes sense.
These survey results help us as compliance people, as consultants, as anybody who's saying you need a compliance program, to say this is where you need to start. And you can adjust as you go along. But don't think you're going to put it in there for six months and then take it away. You need to put it in there, set it, forget it, make it part of your culture, part of your budget, and grow from it. It'll allow you to grow a lot faster.
Interviewer (29:58)
What about private equity backed organizations? How does this play with sponsors?
Ross Ronan (30:29)
With the private equity group, they kind of get it. If you're private equity backed, the majority of them have made a huge investment in an organization. And once they've made that investment, they need to protect it. It's not just financially, it's also reputationally. From a business standpoint, they want to make sure they're part of something that is good. And their LPs who have invested in their funds want to make sure they're doing the right thing.
So when it's private equity backed, there's a bit of a shift to say, I need all the protections we can get so that nobody does anything wrong and we're not putting ourselves at risk. Additionally, the Department of Justice and the OIG have made it abundantly clear that they want to ensure private equity groups and venture capitalists, people who are investing in healthcare, are doing the right thing. So there's a bit of scrutiny and a lens on those different groups.
Now, what I've experienced in my tenure is that when you've explained what those costs should be, from a benchmarking standpoint, you start to become a strategic partner to those private equity groups. They say, I see that you're looking out for us, and I see that you're not talking me into something, you're educating me on what we should be spending on those resources. And at that point, they really do want to take a very strong compliance posture because of their investment, and they really do understand what that investment should be in the program.
Interviewer (32:08)
How do you think about the relationship between compliance investment and payer relationships?
Ross Ronan (32:17)
There is an expectation from a Medicare standpoint. The Affordable Care Act indicates that if you bill and collect from the Medicare and Medicaid program, you will have a compliance program in place. What that looks like is up to you. Obviously the OIG puts the guidance in place to say what it should look like, but the Affordable Care Act says you need a compliance program in place.
So the payers, there is an expectation on a governmental standpoint that someone is complying with it, because when you do enrollment into these federal healthcare programs, you are making a commitment that you will not defraud them, and that you will do everything in your power to preserve the federal funds and not commit fraud, waste, and abuse. So when that onus becomes on you, the payers say, you told me you were going to do this, you told me you were going to have a compliance program, you told me you're not going to submit false claims or inappropriate claims.
And I think on the commercial side there's a lot of expectation as well. I know a lot of these big commercial companies like United and Aetna have huge compliance programs. So when they have huge compliance programs and they're paying lots of sums of money to providers, the assumption is that the providers have compliance programs too, so that they are preserving the healthcare costs and we're not paying for things that are not appropriate.
So the payers do play a big role in what we do and what we don't do. When you talk about UPIC audits or RAC audits or CMS audits, the first thing I'll ask is, what is your compliance program? How are you complying with it? I had a call the other day with a payer and they asked that question: tell me how you're going to comply with our enrollments and our payments to your providers. So it plays a huge role in what that investment should be.
Interviewer (34:09)
How about the day-to-day? Where do you see compliance investment showing up in day-to-day operations beyond the boardroom?
Ross Ronan (34:18)
It really is a partnership. When you have a good compliance program and you're really invested in a good compliance officer and its staff, it becomes a strategic asset and a collaborative experience with all the departments.
We talk about big C and little C compliance. Big C is actually having a compliance program that meets the seven elements of a compliance program by the OIG. And then little C compliance is, there's compliance in every aspect of what we do. There's payroll compliance, there's human resource compliance, there's wage and hour, there's harassment and workplace violence. There are all kinds of different compliance areas within an organization.
Once you have a good compliance program in place, they can partner with each one of these departments to ensure that the whole entire company is partnered in compliance, and not just one little oversight area. So I really do think that investing in it will allow, I had a conversation with a couple of potential clients the other day, and we talked about how we as compliance don't run human resources, we don't run quality, we don't run those, but we work in tandem with them. We're a partner to them, and we carry the water in each one of these different departments to help the company become a better, more successful, protected organization.
Interviewer (35:47)
So if a CEO is hearing all of this and thinking, we're already investing, but I'm not sure if it's enough, how should they think about that?
Ross Ronan (35:59)
This kind of goes back to the conversation we had about these being benchmarks, these being starting points. When you look at the volume of compliance issues that you have, whether they're billing or coding issues, hotline complaints, physician arrangements, there can be all kinds of different issues out there. But it's about the volume of issues coming into the compliance program that determines what that investment should be.
I'm a firm believer in not throwing people at problems and not throwing processes at problems. So use the tools you possibly can, whether it's a third party helpline or auditors. Use those tools to augment your business. I don't think it's going to break the bank, and it's also going to make you more efficient.
Like I said before, one of the biggest investments a company can make is in the right compliance executive. If you don't have the right compliance executive, then you really haven't invested in your compliance program, because not everybody can do it. You need to have the right head on your shoulders, the right business acumen. You need to understand the business as a compliance executive, and that's probably one of the biggest investments that needs to happen right off the bat.
Interviewer (37:18)
Last question. What does a strong compliance investment actually look like in practice? Not necessarily the dollar amount, but what it actually buys you.
Ross Ronan (37:29)
This dovetails into the last question, or at least the last statement of it. A good, well-rounded, strong compliance investment starts off with your compliance leader.
I see a lot of organizations wanting to put that with the CFO or the COO or the general counsel, and then just invest in little things surrounding that. To me, that's not a scalable tool. The scalable department has to be something where you've invested in your compliance executive first, someone who can, A, be a strategic partner, B, run the compliance program, and C, understand the business. Once you've invested in that person, then the rest becomes easy.
From there you can augment their services with different third party consultants or companies, have another compliance regulatory specialist to help do the actual work, the administrative work when it comes to investigations and things of that nature. In a good company, you can invest in that and grow from that standpoint.
When you start bottom up, telling somebody else to do compliance and then giving them the resources to do it, I've never seen that truly become a scalable, full-service compliance program. You end up spending more money later than you would have upfront if you'd just done it right.
Also Available On:
“One of the biggest investments that a company can make is in the right compliance executive. ”
