Compliance Services Office (CSO) Program Framework
BU’s Commitment to Ethics and Compliance
Boston University is committed to the highest ethical and professional standards of conduct. Members of the University community should conduct their activities as required by law and University policies. Each department is responsible for monitoring applicable laws, developing and maintaining appropriate procedures, and communicating those policies and procedures to the community.
The CSO Program Framework
Boston University is committed to meeting the legal obligations that govern its many activities. Those obligations often are complex and require coordination among several departments across the University. The Six-part Compliance Framework below identifies the critical components of any effort to achieve compliance. The BU community will be able to meet its compliance obligations more efficiently and effectively if we share a common framework for communicating about and tackling compliance.
Step 1: Clarify Obligations
Understanding what is required — and what isn’t — is the necessary first step in meeting our legal obligations.
The first step in meeting our legal obligations is to clarify what is — and what isn’t — required.
The most common sources of compliance obligations are:
- Federal laws, regulations and agency guidance;
- State and local laws, regulations and agency guidance;
- Requirements of accrediting bodies or other organizations, such as an athletic conferences; and
- University policies.
Generally speaking legal obligations require us to do something or prohibit us from doing something. For example, Title IX and related regulations and guidance prohibit us from discriminating on the basis of sex or gender. But in the modern era many laws go well beyond “do’s” and “don’ts” and require us to engage in specific types of compliance activities, including:
- Having a written policy;
- Naming a responsible officer;
- Including specific language in certain types of contracts;
- Keeping records of incidents;
- Obtaining a license or permit before engaging in certain regulated activities;
- Providing notice to consumers (students) or employees;
- Certifying that the University has met particular requirements;
- Conducting regular risk assessments;
- Providing training to employees; or
- Making a self-disclosure to the relevant agency in the event of an incident.
The best way to ensure that you and your departments are meeting these obligations is to identify the requirements clearly. The Higher Education Compliance Alliance details most of the federal requirements in higher education by subject area. We would be happy to work with you to clarify related state, local or other obligations.
An important part of clarifying your obligations is identifying the areas that require individuals or departments outside of your own to meet obligations. For example, many grants or other government documents require the University to certify that it complies with a whole host of laws and regulations, some of which will be outside your area. Many reports required by federal, state or local agencies require information that comes from departments outside of your own. Who do you rely on to meet obligations you are responsible for? Compliance Services can help you identify those circumstances and help clarify responsibilities.
Step 2. Establish Priorities
Assessing and monitoring the consequences of any compliance shortcomings (including how laws are enforced in higher education) can help ensure that you spend limited time and resources most effectively.
Given the limited time and resources available for compliance efforts, it’s important to establish priorities and make a plan to meet your obligations. As you establish priorities you should consider the possible consequences of any failure to meet legal obligations. For example:
- Could failing to meet this obligation significantly affect the University’s reputation?
- Could failing to meet this obligation harm the University’s relationship with an important agency or research sponsor?
- Does the agency responsible for the requirement fine or penalize those who do not comply? How aggressively?
- Does the statute or regulations provide whistleblower protection, making it easy (and financially lucrative) for individuals to report alleged wrongdoing?
- Is this an area where class actions or lawsuits are common?
Compliance Services can help you with this risk assessment. We can monitor enforcement activities and notify you when other colleges and universities are sued or pay fines or penalties in connection with compliance issues.
We suggest that you look back at the list of your departments’ obligations, either the federal list we provided to you or an expanded list with requirements state, local or other organizations. Which two or three do you worry about most?
As we’ll discuss next time, developing and publicizing clear policies and procedures will make it easier – and therefore more likely – that individuals will do what’s necessary to meet these obligations.
Step 3: Develop Procedures
Developing and publicizing clear policies and procedures makes it easier – and therefore more likely – for members of our community to do the right thing.
Clear policies and procedures makes it easier – and therefore more likely – that individuals will do what’s necessary to meet legal obligations. Although we’re fortunate to have many long-time employees who may understand what’s necessary to meet some obligations, that knowledge often is lost as employees retire or take on new or different responsibilities. For significant legal obligations, the best approach is to write and share clear instructions that specify what we will do and who will do it. That’s particularly true for the many significant legal obligations that require action by individuals in different departments throughout the University.
Writing procedures does not have to be complicated or time-consuming. Keep in mind the following guidelines:
- Briefly describe whatever background is necessary; consider the new employee who will read the document.
- Describe the scope of the procedure so that it is clear when it does and does not apply.
- Use common, easy to understand words and sentences; avoid legalese and “corporate speak”.
- Identify by job title(s) the group(s) or individual(s) responsible for each action; passive voice signals a gap.
- Ask someone with limited knowledge to review the procedure and address any ambiguities or concerns.
Usually these written instructions will be internal to a department or shared among a few departments and need not take the form of a University Policy. However, if a law requires a policy or the nature of the obligation requires University-wide action, consider whether a University Policy is necessary.
Compliance Services can help you draft policies or procedures for meeting legal obligations. Consider the two or three obligations that are of most concern to you. Would new or improved procedures help your departments and the other departments you work with meet those legal obligations?
As we’ll discuss next time, procedures may be sufficient if a few individuals are primarily responsible for meeting straightforward legal obligations. However, if legal obligations require a larger group or segments of our entire community to understand what’s necessary, we should consider developing concise, practical training materials.
Step 4: Provide Training
Offering concise, practical training materials helps members of our community understand what they’re required to do and how to do it.
Policies and procedures will help ensure compliance if a few individuals are primarily responsible for meeting straightforward legal obligations. However, if legal obligations require a larger group or segments of our entire community to understand what’s necessary, we should consider developing concise, practical training materials. Training helps members of our community understand what they’re required to do and how to do it.
Training can take a variety of forms, including:
- Discussing requirements with your staff on a regular basis at office or staff meetings;
- In person training for a group of individuals with similar responsibilities; or
- Online training delivered to individuals with particular roles and responsibilities.
There are several options for developing and delivering training. For example, online training may be available at little or no cost through higher ed organizations such as the Collaborative Institutional Training Initiative. If you would like to develop your own training materials, peer institutions often make their training materials available online, which can provide an excellent starting point.
Compliance Services can help you identify, develop and deliver training. Consider the two or three obligations that are of most concern to you. Would new or improved training help your departments and the other departments you work with meet those legal obligations?
As members of our community understand obligations more clearly, it’s fair to expect that individuals will raise questions or concerns. Although it may seem counterintuitive, it is important to welcome reports of concerns or complaints about alleged wrongdoing and to investigate any complaints promptly and responsibly.
Step 5: Report and Investigate Concerns
Encouraging members of our community to report violations of laws or policies and diligently investigating reports made in good faith fosters our ethical culture, one of our most critical core values.
Policies, procedures and training give members of our community the critical tools to understand what they’re required to do and how to do it. However, even the best compliance programs aren’t perfect and problems may arise. It is far better to understand any shortcomings from an internal report made directly to the University than to hear about the compliance issue from a regulator or enforcement agency. Although it may seem counterintuitive, it is important to welcome reports of concerns or complaints about alleged wrongdoing and to investigate any complaints promptly and responsibly.
The University is committed to complying with laws and regulations and maintaining the highest standards of ethical conduct. As part of that commitment, the University encourages all members of our community to report any concerns about failure to follow laws and policies. Members of our community should be encouraged to report those concerns to supervisors, unit or department heads, deans, or senior leaders responsible for particular areas. In addition, members of our community may contact the following offices with specific concerns:
| Equal Opportunity Office | Harassment or discrimination |
| Human Resources | Employment issues |
| Internal Audit & Advisory Services | Financial, compliance or ethical issues |
| Office of the General Counsel | Legal or ethical issues |
| Office of the Provost | Academic affairs or student issues |
| Office of Research Compliance | Research activities |
| Office of the Treasurer | Financial issues |
| Compliance Services | Any compliance or ethical issue |
Individuals also may contact the individuals responsible for specific areas of compliance, which are identified in the Compliance Matrix, and may contact the Ombuds if they want to discuss issues confidentially. In addition, the University established an independent hotline, administered by EthicsPoint, for anonymous and confidential reporting of activities that may involve improper conduct or violations of Boston University policies. You should encourage those within your departments to report any compliance concerns to you, or through any of these other mechanisms as appropriate.
If you receive a complaint or question about compliance obligations you should contact Compliance Services or the Office of the General Counsel. We can investigate, or help you investigate, and help ensure that any appropriate follow up occurs.
Step 6: Monitor and Correct Course
Identifying and resolving small problems as they arise reduces the risk that significant problems will occur.
Once you have appropriate procedures and training in place for your most significant compliance obligations, it is important to assess whether they’re effective. As we discussed last time, investigating complaints and taking appropriate action to follow up is one way to assess whether your compliance efforts are working. But it’s important to identify other mechanisms for feedback. Do members of your department understand what they’re supposed to do and are they doing it? Identifying a few key risk indicators and monitoring them periodically can help identify and resolve small problems, which reduces the risk that significant problems will occur.
Compliance Services can help you figure out how to monitor your compliance efforts and see if they’re accomplishing what you intend. This type of monitoring can provide critical feedback that you can use to clarify policies, re-focus your training efforts, or take other steps to meet your compliance obligations. It may also help you recognize instances of non-compliance before the turn into larger or more significant problems.
Frequently Asked Questions
Q. What is compliance?
As a large research and teaching institution, Boston University is subject to many federal, state and local laws and regulations, as well as standards set by outside organizations such as accrediting bodies and athletics associations. Compliance refers generally to the University’s efforts to meet these obligations.
Q. Who is responsible for compliance?
The area and operational owners identified on the University’s Compliance Matrix are primarily responsible for those areas. However, it is everyone’s responsibility to act ethically, and to understand and meet the University’s legal obligations.
Q. What is the role of the Compliance Services Office?
Mission Statement: The Compliance Services Office coordinates the University’s efforts to meet compliance obligations efficiently and effectively and fosters ethical behavior and a culture of integrity through reinforcement of Boston University’s Code of Ethical Conduct and Conflict of Interest Policy.
Compliance Services is available to assist all members of the University community in clarifying obligations, developing and updating policies and procedures, developing and providing training, monitoring and assessing compliance efforts, and taking corrective action as necessary to address concerns. It also monitors legislative developments and provides updates on new requirements. See the About Us section of this page to learn more about the office activities and staff.
Q. What if I want to report a concern about Compliance?
You should not hesitate to discus any concerns about compliance with laws or University policies to your supervisor, unit or department head, dean or the senior leader responsible for your area. You can also report concerns to a number of other Boston University offices or through our confidential, anonymous Ethics and Compliance Hotline.
You can also contact our office as a starting place. Our general email is comply@bu.edu.
Compliance Services Assistance
You and your organizations already have many of the elements of the Compliance Framework in place. Compliance Services is available to help you identify how your current practices fit the Framework and identify any gaps in your BU offices, departments, schools, and programs. We look forward to working with you to help ensure that we meet the University’s legal obligations efficiently and effectively.