Effectively Manage Shared Responsibility

A common challenge for compliance officers in healthcare organizations is collaborating with operational leaders to identify and mitigate risks. Often, operational leaders are unaware of their roles and responsibilities in their organizations’ compliance programs. The Three Lines Model can help. 

Implementing the Three Lines Model can help you show that identifying and mitigating risks are shared responsibilities – not Compliance’s alone. Using this model can help elevate Compliance as a strategic business partner and enable you to effectively demonstrate how Compliance delivers value to the organization. 

What is the Three Lines Model?  

A concept from the Institute of Internal Auditors (IIA), the Three Lines Model helps explain how key organizational roles work together to facilitate strong governance and risk management. It’s a tool you can use to explain to operational leaders how to identify and mitigate risk. 

The model illustrates the organization’s three lines of responsibility, which include:

1. First line: Operational areas
2. Second line: Compliance, or possibly General Counsel, Risk, and Quality
3. Third line: Independent oversight – usually internal auditor or possibly objective consultants

The first line – the operational areas – are responsible for identifying and mitigating risks in their respective department. They’re accountable for the identification of risks and internal controls, as well as partnering with Compliance on monitoring and complying with laws and regulations.  In leading practice organizations, operational areas use the OIG’s seven-elements framework to identify a compliance liaison between the operational area and Compliance, create departmental procedures, provide departmental risk specific training, and conduct ongoing compliance monitoring of compliance risks. 

Compliance is the second line. Compliance’s Departments’ role is to facilitate and help operational leaders with training, creating policies and procedures, auditing, and monitoring. General Counsel, Risk, and Quality can also serve as second-line partners. 

The third line – independent oversight – can be an internal audit, or an organization can hire independent auditors. Auditors assesses what the organization is doing and whether it’s being done as required, based on policy, procedure, laws, regulations, and other requirements. 

To optimize operational effectiveness, it’s imperative for front-line personnel to understand what’s expected of them and to have a collaborative working relationship among these critical functions. It’s particularly helpful for healthcare systems that operate under a decentralized organizational structure – as the vast majority do.  

Everybody must help, healthcare compliance activities are not solely Compliance responsibilities 

The model helps illustrate that compliance activities are not solely Compliance responsibilities; everybody has to help. It’s detrimental to an organization if Compliance is doing too much of the heavy lifting.  

Including the model on a PowerPoint slide, for example, allows you to walk into any operational area and say, 

“I’d like to participate in your departmental meetings. Can we talk about some of the things you do to identify compliance risks in your department, and some of the things that you do to mitigate them?”  

Often, operational leaders are already doing the first-line compliance activities. Sharing the model serves as a concrete example of how and why to do it. 

Using the model is also a coaching opportunity for explaining differences between financial, enterprise, operational, and compliance risks. Part of compliance officers’ job is explaining the various risk categories, and the model gives a framework for these discussions.  

Meld the model with additional best practices to show Compliance’s impact  

The model works best when melded with the OIG’s seven elements for compliance program effectiveness, which spell out the government’s guidance on roles and responsibilities around compliance. The seven elements complement the Three Lines Model as you work to explain and clarify roles.  

Another way to integrate the Three Lines Model is by establishing operational compliance committees. Made up of director-level individuals from operational areas, an operational compliance committee provides a venue for discussing compliance issues across the organization. It’s a working group, with individuals serving as liaisons between their respective departments and Compliance.   

All of these best practices emphasize how partnership is at the heart of delivering an effective compliance program. And it starts showing why a collaborative approach best supports the business.      

The Three Lines Model, melded with the OIG’s seven elements and operational compliance committees, drives home the importance of sharing responsibilities across the organization. Implementing these best practices can help elevate Compliance as a strategic business partner and enable you to effectively demonstrate how you add value to the organization. 

Editor Update April 2025

As the healthcare compliance landscape continues to evolve, the Three Lines Model remains a vital framework for aligning operational responsibilities and enhancing governance. Recent insights emphasize the importance of integrating this model with the OIG’s seven elements to foster a proactive compliance culture. For a deeper understanding of how to effectively implement the Three Lines Model in your organization, refer to our comprehensive white paper: DOUBLING YOUR IMPACT: DEMONSTRATING COMPLIANCE’S VALUE AND SHAPING CULTURE.

Download the Three Lines Model (PDF)

Ken Zeko, JD, CHC Principal Advisor at Hall Render Advisory Services

An Attorney Consultant with more than 25 years of regulatory compliance experience, Ken Zeko leads Hall Render Advisory Services’ Compliance Program and Coding Compliance service lines. Ken’s national practice consists of serving as an outsourced compliance advisor and assisting clients with compliance program assessments, risk assessments, investigations, coding compliance engagements, self-disclosures, physician arrangements reviews, Independent Review Organization (IRO) engagements and Corporate Integrity Agreement- related (CIA) engagements.

Ken is Certified in Healthcare Compliance and is an active member of the Health Care Compliance Association (HCCA). He chairs the HCCA’s Southwest Regional Conference Planning Committee and serves as faculty for the HCCA Compliance Academies. Additionally, he has chaired a site-based decision-making committee at a Dallas elementary school for more than 10 years.

Take Free RL3M Assessment (Regulatory Lifecycle Management Maturity Model)

RL3M Assessment

Download our Latest Whitepaper

Sign-up for our Weekly Newsletter

Qualified compliance professionals do the heavy lifting for you, simplifying regulatory change management  

Trending Posts:

• One Compliance Pro’s Regulatory Change Management Process   
• Five ways to show how healthcare Compliance delivers value
• Revenue Cycle Management Compliance: Ensuring…
• 12 key metrics for compliance officers looking to…
• Transforming Compliance to a Department of Yes 
• Three Strategies to Align Compliance with Revenue Cycle 
• Mitigating Conflicts of Interest that Drive Profit…
• Navigating Compliance Responsibility: A Foundation…
• New Regulation– Now What? Step-by-Step Guide to…
• Four Ways to Integrate Compliance with…

The post How the Three Lines Model Strengthens Healthcare Compliance first appeared on YouCompli.

Are you spending your time on the right things?

You know the seven elements for compliance program effectiveness. They are a north star for healthcare compliance officers, and they’re at the heart of the adage “you can’t manage what you can’t measure.”

Healthcare compliance officers often rely on the seven elements as key performance indicators to measure whether their organization’s compliance goals are achieved. Yet another set of measurements – culturally impactful metrics – are equally important. These metrics guide compliance officers in leading through influence and serving as strategic business partners to the larger organization.

Both measurements are critical to ensuring that healthcare compliance officers are best positioned to help their organizations reduce risk and manage regulatory change.

Element-based KPIs

Broadly, key performance indicators (KPIs) help leaders track organization impact, financial performance, and overall business health. Within the compliance function, element-based KPIs are an effective gauge of whether compliance activities are achieving results.

For example, one common organization-wide goal is requiring 100% of new employees to complete a Code of Conduct acknowledgment. Another is an oversight goal requiring 100% of board compliance committee meetings to achieve a quorum. You might look at number of compliance audits completed or billing error rates.

All of these are meaningful measurements for compliance officers to use in helping their organizations reduce risk and manage regulatory change.

Culturally impactful metrics

What element-based KPIs don’t capture is the need for compliance officers to build relationships. A good compliance program requires collaborating with departments organization-wide. But collaboration isn’t possible if compliance officers aren’t at the right table.

Culturally impactful metrics emphasize getting compliance officers in the right rooms – ahead of regulatory change or organizational growth. These metrics underscore the importance of compliance professionals genuinely knowing the business of the organization and how it generates revenue.

Cultivating this knowledge involves developing relationships with business leaders and key operational stakeholders. With this knowledge base and established relationships, compliance professionals are prepared to lead through influence.

Examples of culturally impactful metrics include the number of:

1. Compliance roadshow sessions completed
2. Meetings between the compliance officer and board members, and between the compliance officer and CEO
3. Surveys conducted to assess employees’ knowledge of compliance issues
4. Walkthroughs conducted by the compliance officer or compliance staff
5. Individual calls or questions sent to members of the compliance department
6. Operational meetings/huddles attended by the compliance officer or compliance staff
7. Operational compliance plan documents in existence
8. Speaking engagements the compliance team participates in or articles they write
9. Operational department training hosted for specific compliance issues, such as a Stark Law/Anti-Kickback Statute session for medical directors
10. Compliance Week activities conducted
11. Clinical roundings attended by compliance officer
12. Surveys conducted to assess the organization’s culture

Winning hearts and minds

Being prepared for a regulatory or strategic change starts with compliance officers being visible across the organization. This ensures that compliance officers realize where the impact needs to be and can effectively partner with the affected operational areas to make reasonable changes and mitigate risk.

It might seem daunting to start measuring these activities throughout your year. One simple place to start is to look at where you’re spending your time now. How many hours do you spend with people outside of the compliance department? What could you simplify in your processes to give you more time to work on relationships?

With solid relationships already established, you can use your skills to sell ideas and concepts that help drive better health and business outcomes for the organization.

Download 12 Culturally Impactful Metrics (PDF)

How effective regulatory change management practices help healthcare organizations mitigate risk

Download “Empowering Compliance Officers to Drive Better Health and Business Outcomes” from YouCompli. The report includes the findings of our inaugural survey on how healthcare Compliance functions support the overall well-being of their organizations.

Throughout the paper, industry leaders deliver fresh insights on how strong regulatory change management drives risk mitigation in a healthcare organization. They discuss the value of establishing processes for regulatory change management. And they share four must-have skills for influence in a healthcare compliance role.

Contributing experts include:

• Shawn DeGroot, President, Compliance Vitals
• Charles Mazer, Director of Corporate Compliance NewYork-Presbyterian
• Ken Zeko, Principal Advisor, Hall Render Advisory Services

Never Miss an Article from Ken Zeko!

Subscribe to our newsletter today if you haven’t already!

The post 12 key metrics for compliance officers looking to move their culture forward first appeared on YouCompli.