Practice Makes Perfect

How to Organize a Compliance Fire Drill

NOTE: This article originally appeared in the June 2009 issue of Flawless Compliance, under the "Hello Rubber, Meet the Road" section. The link to the actual issue is at the bottom of this article.

How well can your compliance team respond to a real emergency like a lawsuit? If you’ve never tested your team’s ability to respond, then it’s probably ineffective.

I was talking with my niece when she was training to be a fire-person, and she explained that a fire is not really an emergency for the fire department. It may be an emergency for you, but the fire department is prepared for it. In the same way, your compliance team should be prepared for anything, and the only way to do that is practice.

With other compliance concerns like safety and financial controls, external audits are routine. However assessing your real capability against a lawsuit can be tricky. That is unless your company gets sued on a regular basis.

To correct for this I suggest doing fire drills, in the same way your fire department conducts drills in preparation for a real fire. Every quarter or so, you should hold a mock lawsuit to see how your team will respond. Try to make it as real as possible, and instruct everybody to take it very seriously (as if it were really happening). You will probably need to get executive buy-in for this, but it is well worth it.

Just like a fire drill, your compliance team should be unaware that it’s coming (however make sure to coordinate with executive management, of course). Take some time to really think through the scenario, so the team can have something tangible to work with. For instance, test your government contact compliance team by creating a scenario where the Department of Justice (DOJ) is investigating the commercial practices of your training and education line of business. Go through all the motions, including the creation of a mock letter from the DOJ stating its intent.

Test your team by tracking speed and accuracy of response. Were they able to assemble and provide an initial response in a timely manner? How quickly were they able to come up with a plan of action? How effective is it? How quickly and efficiently can they get through the necessary information systems? If information technology group coordination was required, how smoothly did that go? What about backup records and evidence of claims?

Issue a mock litigation hold, and assess the capability of your information systems to alter their retention processes. A litigation hold should immediately override any retention policy in place. Are your systems capable of handling this?

All of these things are important to assess the effectiveness of your compliance team. Do not be surprised if you find major holes the first few times you go through this. It’s quite natural to have large inefficiencies in your organization and processes that are not uncovered until you actually go through the motions. That’s why you don’t want to wait until a real lawsuit to test them out!

In my experience, it takes anywhere from three to six times to get the majority of the kinks worked out. Of course you will never be in a position where all the kinks are worked out, but with some practice you can knock out the major ones.

One final thought, don’t ever get over-confident. You should continually test your system for effectiveness, as it will deteriorate over time if left alone. How would you feel if you found out your fire department stopped doing fire drills!

Organizing one of these is simple, so talk to your management today about a mock lawsuit. I’m sure your compliance team will be thrilled by the surprise party!