As the year comes to an end, Compliance Officers across the health care industry are finalizing their 2027 Work Plans. A well-constructed Work Plan is more than an administrative exercise. It provides a roadmap that directs limited compliance resources toward the greatest areas of risk, demonstrates to regulators and enforcement agencies that the organization takes its obligations seriously, and gives leadership and the board a clear picture of how the compliance program functions.
Below, we outline core items every Compliance Officer should consider, followed by questions that help compliance teams to assess whether their compliance program is effective.
The Foundation
1. The Department of Health and Human Services Office of Inspector General Work Plan
The Department of Health and Human Services (HHS) Office of Inspector General (OIG) maintains a Work Plan of the audits, evaluations, and reviews it has underway or plans to pursue. These items show where federal oversight is focused. When your service lines, billing practices, or arrangements overlap with OIG priorities, those areas warrant heightened internal review. Aligning your Work Plan with HHS-OIG's Work Plan allows you to identify and correct issues on your own terms, before a government audit or investigation surfaces them, and demonstrates that your program is responsive to known enforcement priorities.
2. Results of Your 2026 Audits
Last year's audit findings are among the most valuable data a Compliance Officer has. Follow up on findings that revealed errors, documentation gaps, process issues, or control weaknesses to confirm that the organization implemented corrective actions and that those actions are being held. Areas that tested well may justify less attention, freeing resources for higher-risk areas. Failing to revisit prior findings is particularly risky: an organization that identified a problem but never verified its resolution may struggle to explain that gap to a regulator.
3. Risks Identified in Your 2026 Risk Assessment
A risk assessment has value only if it drives action. Translate each risk your 2026 assessment identified into a Work Plan item, whether through auditing and monitoring, policy updates, targeted training, or process changes. Tying the Work Plan to the risk assessment also documents why you selected each compliance priority, which helps when you explain the program to leadership, the board, or outside reviewers.
4. Complaints, Concerns, and Notices
Complaints, concerns, and notices from staff, vendors, and others often provide the earliest warning of a compliance or communication problem. Patterns in hotline reports, recurring questions from a department, or notices from payors and vendors can reveal issues that formal audits have not yet captured. Reviewing these inputs during Work Plan development keeps the program responsive to what is happening in the organization and shows employees that raising concerns leads to meaningful follow-up.
Questions to Ask for an Effective Compliance Program
Organizations with established programs should look beyond the basics and ask whether their compliance efforts work in practice. The following questions can help.
1. When did you last review all physician and referral source agreements?
Financial relationships with physicians and other referral sources are a spotlight area of risk under federal fraud and abuse laws, including the Anti-Kickback Statute and the Physician Self-Referral law (commonly known as the Stark Law). A comprehensive, periodic review confirms that each arrangement is in writing, current, consistent with fair market value, and performed as written. Problems in this area can carry significant financial exposure, making proactive review especially worthwhile.
2. How effective has your training been on priority compliance concerns?
Completion rates alone do not show whether training works. Compliance Officers should consider whether employees understand and apply what they learned, particularly on the organization's highest-priority issues. Post-training assessments, follow-up audits of targeted processes, and trends in related questions or errors can measure effectiveness. Role- and risk-specific training generally means more than generic annual modules, and evidence that training changes behavior strengthens the program's credibility.
3. How effective have your remediation and corrective action efforts proven to be?
Identifying a problem is only the first step. The true test of a compliance program is whether corrective actions resolve the underlying issue and prevent recurrence. Compliance Officers should revisit past corrective action plans to confirm the organization completed them, measure whether the issue has reappeared, and document the results. Repeated findings in the same area may signal that the organization never fully addressed the root causes. A record of effective remediation is one of the strongest indicators of a functioning program.
4. How is the relationship between Compliance and Human Resources, Legal, and Operations?
Compliance cannot operate in isolation. Effective programs depend on collaboration with Human Resources (for screening, discipline, and investigations), Legal (for privilege, regulatory interpretation, and disclosure decisions), and Operations (for implementing controls in day-to-day workflows). Friction or poor communication among these functions can delay investigations, lead to inconsistent discipline, or allow issues to fall through the cracks. Evaluating these relationships and clarifying roles and escalation paths can significantly improve the program's ability to respond quickly and consistently. Engaging these teams in Work Plan development further strengthens collaboration and communication.
5. How often, and how effectively, are policies and procedures reviewed?
Policies that are outdated, inconsistent with current law, and disconnected from how staff actually work can create risk rather than reduce it. Regulatory requirements and payor rules change frequently, and operations evolve too. A regular, documented review cycle keeps policies accurate, accessible, and understood. Equally important, confirm that staff follow the policies as written, since a gap between written policy and actual practice is difficult to defend.
6. How do frontline staff view the commitment to a culture of compliance?
Culture often determines whether staff report and correct problems early. If frontline employees believe leadership values compliance, feel safe raising concerns, and see leadership address those concerns, the program is far more likely to detect issues before they escalate. Conversely, fear of retaliation or a perception that compliance is a mere formality can suppress reporting. Surveys, focus groups, and informal conversations can reveal how staff perceive the program, and the results can guide efforts to strengthen leadership messaging and trust. If Compliance fails to communicate its value, staff may turn to outside counsel, which, as in some major cases, can lead to qui tam actions.
7. How often have high-risk vendors been reviewed for compliance?
Vendors and contractors increasingly perform functions that carry compliance risk, from billing and coding to data management and patient-facing services, and the organization may remain ultimately responsible for their conduct. Compliance Officers should identify high-risk vendors, confirm that appropriate contractual protections and screening are in place, and periodically review vendor performance and compliance. Regular oversight keeps third-party problems from becoming the organization's problems.
Putting It Into Practice
A thoughtful Work Plan draws on both the foundational inputs and these deeper questions. Together, they help Compliance Officers focus resources where they matter most, demonstrate program effectiveness, and identify and address issues proactively. Documenting why you selected each Work Plan item and tracking progress throughout the year further strengthens the program and creates a clear record of the organization's good-faith compliance efforts.
Shumaker's Health Law Service Line regularly assists health care organizations with compliance program design, risk assessments, physician arrangement reviews, and corrective action planning.
If your organization is developing its 2027 Work Plan, please contact Grant Dearborn, Kate Crawford, or any other member of the Health Law Service Line.