The Investment Deep Dive, Part 3: How Do You Scale Compliance As You Grow?
Watch Now
Listen Now
-
In the final part of The Compliance Advantage three-part series on compliance investment, host Ross Ronan turns benchmarking data into a growth plan. The question most healthcare leaders ask is simple: how much should we spend on compliance as we scale? Ross makes the case that a program built right scales with the business, so growth does not mean writing a much bigger check every year. The expensive path is the reactive one, where a company stands up a program only after it has already paid back fines and refunds. Ross walks through what changes during a transaction, why the year before a sale is the moment to test everything and close gaps, and how knowing your numbers, your payer mix, your Medicare exposure, and what your peers spend, turns a budget conversation with the board into a strategic one. He closes on culture: compliance sticks when doing the right thing is a shared habit across leadership and staff, not a job handed to one officer. For PE-backed healthcare operators and the investors behind them, this episode reframes compliance spend as an enterprise value decision, not a cost to minimize.
-
How much should a healthcare organization spend on compliance as it grows?
A program built right scales with the business, so spending does not have to climb sharply as revenue grows. The benchmark surveys give a starting point, and the bigger drivers of how much to invest are the volume of compliance issues and the share of revenue tied to federal payers, not headcount alone. Once the budget is set, growth usually means modest additions, not a brand new program.
When should a company invest in compliance during a transaction?
Right away if diligence surfaced gaps and money is sitting in escrow post-acquisition. And if a sale is coming, the year or so before going to market is the time to test everything, run risk assessments, and close gaps. Doing it early means the work looks real, not staged for the sale, which is what helps multiples hold.
What is the first step for a leader who wants to get ahead of compliance investment?
Know your numbers. Understand what the benchmark surveys say and know your business, especially the share of revenue coming from Medicare and Medicaid. A leader weighing a $200,000 program against $5 million of federal revenue at risk is looking at the decision the right way.
Why is reactive compliance more expensive than preventative compliance?
A reactive program is cheap upfront but costs more in the end, because something eventually happens and nothing was prevented. Hope is not a tactic. Preventative compliance, picking up rocks and fixing what is underneath, costs more upfront but saves hundreds of thousands later.
What role does culture play in making compliance investment stick?
Compliance sticks when doing the right thing is a shared habit, not a job handed to one officer. The compliance officer is the facilitator of the program, not the only person responsible for it. When leadership, management, and staff act with integrity even when no one is watching, the program becomes preventative instead of reactive.
-
Interviewer (00:00)
Welcome back to the final part of our series on compliance investment. In parts one and two, we covered the data and what made it real. Let's talk about what to do with it. Ross, for organizations that are growing or scaling, how does compliance investment fit into that growth strategy story?
Ross Ronan (00:26)
When companies are growing, they get to this threshold point, and we talked about this in the first series about what that benchmark should be for the investment. That is easy right off the bat when you hit some of these revenue thresholds and percentages of payers. You get up to the 30, 40, 50% Medicare, Medicaid payer mix, and you need to really start thinking about what that means from a compliance standpoint, as well as your revenue and employees and what that investment looks like.
But once you've invested in a compliance program, that really should scale with the business. If it's done correctly and you have the right leaders in place and the right resources, then you don't have to add a bunch of money to your compliance program as you grow. Eventually you will, but it doesn't have to be huge amounts of dollars unless you're talking about billions of dollars of growth. So the right compliance program scales with the business.
Far too often we see companies who established compliance programs because something happened. That's generally not a bad way to do it, it's out of necessity, and I see it a lot, unfortunately. But after you've paid back half a million dollars or a million dollars in fines and penalties and you had to refund the money, then you decide that $250,000 spent on a compliance program could have saved you a million dollars, and it's a little bit too late.
I feel like a lot of people want that wake-up call first before they can take the commitment to say, I need to protect this revenue that we've made. So I would highly recommend, if you are in this position of growth, that you get ahead of it. Honestly, the bigger you get, the more eyes are on you. The more utilization of codes and CPT codes and reimbursement, and all the payers are using AI to determine what the skewing and utilization data is. So the larger you get, the more money you're getting from the federal government, the more you're going to be on the radar. And you should have a compliance program before you get there, because you don't want to be doing the wrong things when someone comes knocking and wants to do an investigation.
Compliance investment during a transaction
Interviewer (02:50)
What about organizations in the middle of a transaction? How does compliance investment play into mergers and acquisitions?
Ross Ronan (02:59)
When you say middle of a transaction, that's an interesting point. There are a couple of different ways we could take that.
One: you have a company that is just immediately post-acquisition, and diligence has shown there are some gaps in the compliance program, or there are some exposures, and money is sitting in escrow. That's the time when a company needs to start establishing their compliance program and mitigating the things that were found during diligence that created gaps. Especially if somebody else has invested in that company or in you, now is the time to put that program in place and put that investment in place. It shouldn't wait until later. There are a lot of expectations post-acquisition that people need to adhere to.
Then we have the companies in the middle of a transition, or let's just say they were invested in three or four years ago, and now it's time for them to go to market again, have another turn, because private equity needs to take their money out. They have to in certain periods of time. It's part of their investment portfolio. So now it comes to where they're getting close to the sell side and they want to go to market again. If they haven't put in a compliance program post-acquisition, which they should have, but if they didn't, let's say about a year or so prior to going to market or going for a sale, that's when you should really start putting your compliance program in place and testing everything that's happening. Because someone's going to test it. We're going to test it when someone's going to buy you. So we come in and look for those gaps, and we look for audits and error rates and exposures.
During that time period where you're in the middle of a transaction, or in the middle of an investment time period for a private equity group, it's a great time to, if you haven't already done it, beef up your compliance program, do your risk assessments, figure out where your exposures are, start picking up rocks and looking underneath them, fixing them. Prevention, detection, mitigation. Make sure everything is clean and ready to go months and years before you get to this sale point. Because someone will pick it up and say, you just did this three months ago, or you just did this in anticipation of the sale. Instead, you show up with a compliance program and now you look really good and your multiples are going to hold.
The first step for a leader who wants to get ahead of it
Interviewer (05:35)
For a leader who's listening and thinking, maybe I need to get ahead of this, what is a good first step?
Ross Ronan (05:44)
If you're a CEO, or even a compliance leader, and you really need to get ahead of what that investment looks like, know your numbers. Really understand what the benchmark surveys say so you can have conversations with people, whether it's CEOs talking to boards, or a COO talking to a CEO, or even the compliance officer talking to the CEO trying to make a case for their budget. Know your numbers, and know your business too.
I think it's ironic that there are a lot of places out there who either feel like they don't need a compliance program and they're billing 40, 50, 60% Medicare, Medicaid, and they're like, we're just not big enough to do that. Let's say they're $50 million in revenue. Well, if 30% of your revenue is coming from the federal government, that's $15 million of revenue that someone will have to lose if they do something wrong or they get excluded from the Medicare program. Even 30% is not a lot of percentage. We have some clients at 30, 50, 60, 70, 80% Medicare, and that's what they do. That's a huge portion of even $50 million, and that's a huge portion you're going to lose.
So knowing the numbers of what your company does is really important, and knowing what your exposure is. I had a client one time who said, hey, we just don't have a lot of Medicare reimbursement. I can't remember what their annual revenue was, but we did the calculation, and yes, it was really small, 10% of their business was from Medicare. But when we really put the numbers to it, it was like $5 million. And I said to them, I appreciate that, but you're willing to forgo a $150,000 or $200,000 spend to protect $5 million? Who would forgo spending $200,000 to protect $5 million, even if it's a small drop in the bucket of your $50, $60, $70 million business?
So you really have to know your numbers, and you have to know what your peers are spending on compliance, so you can say, this is where the sweet spot is, and I don't want to be an outlier.
Interviewer (08:00)
You kind of touched on this in our last question, but once a leader does know their number, what are the next conversations they should be having?
Ross Ronan (08:09)
It's really having that risk exposure conversation. It's easy to pull down the numbers. It's hard to actually make them apply to what it really means in a logistical situation. And it's very hard to determine an ROI on compliance. It's hard to put a number on it. How do you prove a negative? We prevented multiple things from happening. How do you prove that?
There are ways you can show the benefits. We've won this many UPICs, or we've won this many RACs, or we were prepared because we did these audits and someone came in and found nothing when they did an audit. Or we opened up a new business line and compliance was right beside you so we could make sure we were doing it the right way. Those are good ROIs you can prove. But really knowing those numbers, and then putting them to play and putting them into effect, is important to understand what those risks are and make sure you're not just throwing money at something you don't need to, or avoiding spending where you should be.
Compliance investment as ongoing, not a one-time fix
Interviewer (09:21)
You touched on building buy-in for a compliance program. How would you help leaders think about compliance investment as ongoing and not just a one-time fix?
Ross Ronan (09:36)
This is the whole set-it-and-forget-it idea when you put it in the budget. It's not a one-time fix where you're hiring someone to do a job and then they go away. It needs to last, it needs to stay. It's the same way as hiring human resources. You don't just hire a person to come in and hire people. Someone's got to manage the whole process to ensure you have the right workforce in place. Same thing with compliance. It has to be a living, breathing thing that actually does things.
If you're just paying the basic minimum in a compliance program, and I see this a lot, people say, I want the basic minimum in case something happens so they can react to it. Well, reactionary compliance is costly. Preventative compliance is a lot less costly, because you are avoiding issues from happening in the future. A reactive compliance program may be cheap upfront, but it's going to cost you in the end, because something is going to happen. You haven't prevented things from happening, you're just waiting for them to happen, and then you want to mitigate them as best you can.
That's hope as a tactic. Hoping something doesn't happen, or hoping something doesn't come through. And hope is not a tactic. A tactic is, I want to pick up rocks, I want to understand what's underneath them, I want to prevent them from happening, I want to know what everybody knows, and I want to make sure we're doing it right. That'll save you hundreds of thousands of dollars in the future with a little bit of expense upfront, even though you're spending more on your compliance program than you would with a basic minimum. You are preventing things from happening.
The role culture plays in making the investment stick
Interviewer (11:17)
In order for compliance to be a living, breathing thing within an organization, culture is a big part of that. Talk to us about what role culture plays in making a compliance investment stick.
Ross Ronan (11:37)
We talk about culture of compliance, and I don't necessarily love those words, because I think they've been overused and probably a little abused by compliance officers in the past when they want something.
The way I look at compliance culture is, there's no expectation that the compliance department or compliance leader manages every aspect of compliance within an organization and the buck stops there. There's an expectation that the individual reports to the highest levels of an organization so that if something does go wrong, it can be found out and mitigated in a larger way. But when the CEO comes to you and says, I need you to keep me out of jail, the answer's no. We need to keep each other out of jail. We need to be doing the right thing. It's not me needing to keep you out of jail. It is, we all collectively need to be doing the right thing. And that's really that culture we're talking about.
When the leaders, executive leadership, middle management, and even the workforce that are working every day, when they're acting with integrity and compliance when people aren't looking, that's a culture. When they just do it for show, when they do it because they think someone's watching, that's not a culture. Once you've built that compliance habit, that compliance mentality of I am going to do the right thing, once that's embedded, then you don't have to worry so much about who's running it and what's happening. And it really does make things more preventative than reactive.
With the new CRUSH initiatives, they're moving from pay and chase to verify before you even pay. The government's looking at that, and it's the same kind of concept here, where a culture is going to verify things before they do them, as opposed to, I'm going to ask for forgiveness and permission. That's a big cultural issue. It does start at the top, it starts with the actions of the leadership, it starts with the actions of the board. But it also starts with the expectation of the people underneath them, to say, if you have a problem, come get me. If you have a problem, let's talk through it.
That's really how it changes, and it really does change when you stop putting the pressure and the direct onus on the compliance department and the compliance officer as being the person who is compliance. It's everybody. The compliance officer is just the facilitator of the program.
The Compliance Investment Profile
Interviewer (14:48)
You've coined this Compliance Investment Profile. Talk to us about what it is and how someone can get one.
Ross Ronan (14:59)
We developed this through our AI tools, and it takes a lot of the HCCA survey results and benchmarking data out there, where we can actually put a company's information into it and figure out where it sits and what those exposures are.
It doesn't have protected health information in it. It's just revenue and employees and company size, pretty much the stuff you can get on the internet anyway through ZoomInfo. But we do ask you those questions to understand where your range is. It's an easy tool to identify where you might have that exposure, where you need to invest in the compliance program, and where you think your starting point should be.
As we're building it out, we'll build it out even more. We're using it internally today, but if anybody wants information on it, please message me and I'm happy to provide that information to you. We're also considering putting it on our website for people to use on their own to see if it's something they need. And we're building it out to potentially have recommendations: is it time to insource, is it time to outsource? What do we need for a compliance program that makes more sense based on the size we are and our percentage of payer mix? So it's a really good tool we use internally so we can give our potential clients what they need from a determination standpoint, and we look forward to sharing it with people.
Closing
Interviewer (17:11)
That wraps up our three-part series on compliance investment. If any of this resonated, reach out to us. We'll put together a Compliance Investment Profile for your organization so you can see exactly where you stand. No cost, no strings, just data you can actually use.
Ross Ronan (17:34)
We really enjoy talking about compliance investment. If you have any questions, like the interviewer said, please message me. We're here to help. It's not about necessarily what we do. It's about having compliance be an investment in every organization so that they stay protected, and they really do protect their investment financially, reputationally, and career-wise. So I love talking about it. Ask me, message me for any questions.
Interviewer (18:01)
Thanks for listening to The Compliance Advantage, and we will see you next time.
Also Available On:
“The right compliance program scales with the business.
”
