Audting and monitoring should be:

1. An ongoing process;
2. Thorough with regular reporting on it to senior officials, including the board;
3. Regular, periodic audits by qualified people focusing on programs with substantive exposure to government enforcement actions; and
4. Ensuring compliance with specific federal, state, and internal rules and policies.

Ongoing monitoring is the program managers’ responsibility. They are the ones most familiar with their own operations and should be charged with identifying risk areas of their responsibility; developing appropriate internal controls, policies, and procedures; and monitoring them to verify they are being followed. Whereas monitoring should be done by program managers, the ongoing auditing of those operations needs to be performed by parties independent of those operations. This is to ensure objectivity in performing the audit reviews. The objectives of these reviews are also different from monitoring. Whereas monitoring is to ensure that policies and procedures are in place and are being followed, auditing is to determine whether the monitoring program is operating as it should and that policies, procedures, and controls adopted are adequate and their effectiveness is validated in reducing errors and risks.

The compliance officer should not be directly involved in ongoing monitoring other than to identify potential areas of risk or concern and to track that appropriate follow-up was made in response to weaknesses or problems; however, the compliance officer should be involved in the ongoing auditing activities. This does not mean being the only one doing the auditing work. That can be done by any party competent to conduct independent review of the program managers’ monitoring programs. This may include the compliance officer, internal or external auditors, consultants, or any combination thereof. The