A hallmark of an effective compliance program is the existence of a well-functioning process for the investigation of allegations of misconduct. Is your compliance investigation process well-functioning? The four signs I look for are (1) a comprehensive written protocol; (2) consistency of handling and discipline; (3) after-action learning takes place; and (4) reporters are directly acknowledged.

1/The written protocol

It surprises me how many commercial stage life science companies don’t have a written investigations protocol. You need one!

Your written protocol should cover:

  • Who handles intake of reports
  • What type of reports must be elevated to the investigation function
  • What are the criteria for when conduct becomes an investigation
  • Who is informed about an investigation – likely this will be tiered based on the significance of the conduct or people involved
  • Who conducts the investigation, determines if done under privilege
  • Expected timelines for completion of investigations
  • Documentation required and where stored, typically investigation plan, interview memos, final report
  • A process for closing investigations, including how and who determines discipline, who receives notice, plan for after-action learning

2/Consistency of process and discipline

You have an investigation protocol, but what happens in practice? Bottom line is shortcuts to the normal process are a problem, especially if based on a person’s level in the company, whether they are a critical employee, a high performer or if the findings could hurt the company.

In fact, in these circumstances it is often more important to have more process. Shortcuts resonate through your organization, undermine trust in your compliance systems and the investigation process.

On discipline, many companies have written guidance on what type of discipline is required by specific deviations of policy. This is a good practice and worth the investment of time.

3/Effective After-Action Planning

A process failure I often see is a lack of follow-up when the investigation is done. Lessons learned need to be communicated to the right people and an action plan developed and executed. Failure to do this is a missed opportunity. A formal part of your investigation process should be communicating after-action learnings and tracking an action plan to make sure learnings are implemented.

4/Reporters are acknowledged

I’ve had the misfortune of handling numerous government investigations and whistleblower cases and in most the whistleblower made efforts to reach out to compliance. What happened? Most often they didn’t feel heard. Do you have a system for acknowledging reports? Is there follow-up directly with the reporter? Do you close out with the reporter?

#EffectiveCompliance

#EffectiveInvestigations

#HealthcareCompliance

Dan Curto

For more than 20 years Dan Curto has been focused on helping life sciences companies solve legal, compliance and regulatory challenges. Dan was a member of the international law firm of McDermott, Will & Emery from 1998 to 2012. As a partner at…

For more than 20 years Dan Curto has been focused on helping life sciences companies solve legal, compliance and regulatory challenges. Dan was a member of the international law firm of McDermott, Will & Emery from 1998 to 2012. As a partner at McDermott, his practice focused on guiding life sciences companies through government investigations, litigation, and compliance remediation. Since 2012, Dan has held various leadership positions at Sanofi, Biogen and BeiGene, including lead global commercial roles, heading a global investigation function that oversaw all internal and external compliance and government investigations and serving as head of global litigation and enterprise risk management. Dan opened Curto Pharma Law and Compliance in 2021 to provide counsel and compliance on demand support to Life Sciences companies.