Valiants Verify Compliance Program Judith W. Spain, J.D., CCEP ® Chief Ethics and Compliance Officer General Counsel (Effective March 2016) 1

Overview I.Compliance Background II.Valiants Verify Compliance Program III.Elements of an Effective Compliance Program IV.Next Steps 2

I.Compliance Background 3

Compliance is Not New ●Laws and regulations are the same; always had to comply ●Historically, compliance has been decentralized (silos) ●Compliance program provides assurance to the Trustees and College management regarding institutional compliance ●Assists both Trustees and College management to fulfill their fiduciary responsibilities 4

Compliance in Higher Education ●Create a culture in which compliance is second nature ●“Create awareness by people that they need to be in compliance and the expectation is that they will be in compliance.” ● u-boards-role-regulatory-erahttp://agb.org/trusteeship/2013/7/welcome-compliance- u-boards-role-regulatory-era 5

II.Valiants Verify Compliance Program 6

Valiants Verify is… ●An initiative that provides an infrastructure to facilitate on-going assurances that the College has methodologies in place to comply with laws, regulations, and policies. 7

Valiants Verify is NOT… ●An enforcement mechanism ●A “Big Brother” mode of “mind control” 8

Valiants Verify is… ●A commitment to: ●“Since Manhattanville’s inception in 1841, its founders have bequeathed the mission, vision and heritage of social responsibility: the symbiotic relationship of academic excellence and social and ethical responsibility to its faculty and students.” 9

Purpose of Valiants Verify ●Identify compliance risks that impact the College. ●Understand the potential exposures of the compliance risks and ensure measures are in place to proactively mitigate those exposures. ●Foster a culture of ethics and compliance that is central to all of the institution’s operations and activities. ●Provide a resource to those charged with day-to-day compliance activities. 10

III.Elements of an Effective Compliance Program 11

To have an effective compliance program, an organization must establish and maintain an organizational culture that “encourages ethical conduct and a commitment to compliance with the law.” U.S. Federal Sentencing Guidelines §8B2.1(a)(2) 12

Elements of an Effective Compliance Program: ●High level personnel who exercise effective oversight and have direct reporting authority to the governing body; ●Periodic and systematic compliance risk assessments; ●Written policies and procedures; ●Training and education; 13

Elements of an Effective Compliance Program, cont’d ●Lines of communication; ●Well-publicized disciplinary guidelines; ●Internal compliance monitoring; and ●Response to detected offenses 14

Effective Compliance Program Step 1 High level personnel who exercise effective oversight and have direct reporting authority to the governing body 15

Program Structure ●Compliance Partners ●Chief Ethics and Compliance Officer ●President’s Cabinet ●President ●Board of Trustees Audit and Compliance Committee 16

Compliance Partners ●Responsible for day-to-day compliance activities (not necessarily the area VP ); ●Develop and execute quality effective training programs to mitigate compliance risks; ●Complete compliance risk self-assessment surveys; and ●Assist CECO in identifying level of probability and potential impact of occurrence of non-compliance. 17

CECO ●Manage a compliance risk assessment; o Rank compliance risks on probability and potential impact of occurrence; ●Develop an annual plan of risk areas to be addressed; ●Submit the compliance monitoring plan to the President’s Cabinet and President for review; and ●Work with the Compliance Partners to develop policies and trainings, as necessary. 18

President’s Cabinet  Assist the CECO in monitoring the College’s compliance with legal and regulatory requirements;  Review the College’s compliance risk assessments, identify areas of highest compliance risk, and propose activities and programs to effectively manage those risks;  Seek any information it requires from College employees or external parties; and Recommend appropriate actions to the President. 19

President  Provide tone at the top for implementation of the Valiants Verify initiative;  Review recommended actions provided by the President’s Cabinet;  Exercise effective and ongoing oversight of the compliance program;  Approve the compliance risk mitigation plan; and  Inform the Board and Board Audit and Compliance Committee of any significant compliance issues. 20

Board of Trustee Audit and Compliance Committee ●Ensure the proper tone for compliance and ethics is established and reinforced; ●Be knowledgeable about the Valiants Verify program; ●Exercise effective and ongoing oversight of the compliance program; and ●Inform the Board of any significant compliance issues. 21

Effective Compliance Program Step 2 Periodic and systematic compliance risk assessments 22

Purpose of Compliance Risk Assessment To maximize the use of the College’s limited resources by directing them to the most significant compliance issues. 23

Risk Assessment Process Step 1: Compliance Risk Identification ●What are the possible compliance risks Manhattanville College faces? ● What issues keep us up at night? ● Create a compliance risk registry ● Utilizing existing risk registries with customization for state compliance risks, e.g., Higher Education Compliance Matrix 24

Risk Assessment Process Step 2: Compliance Partner Identification ●Who is responsible for the day-to-day compliance activities for identified risk? o Examples of compliance risks o Truth in Lending Act o OSHA o Consumer Credit Protection Act o Examples of Compliance Partners o Voter Registration – Dean of Students o Title IX – VP, Student Affairs o Clery Act - Director, Department of Campus Safety o Financial Aid – Director, Financial Aid 25

Risk Assessment Process Step 3: Self-Assessment Survey ●Using Blackboard, self-assessment surveys are available to identified Compliance Partners ●Compliance Partners provide information regarding existing and needed methodologies for compliance o Policies, procedures, trainings, staffing, etc. ● Compliance Partners return surveys to CECO 26

Risk Assessment Process Step 4: Perform Risk Assessment ●CECO reviews the self-assessment surveys ●Compliance Partners and CECO together rank the likelihood of the compliance risk event happening and the potential impact of the event 27

Risk Assessment Process Step 5: Develop a Monitoring Plan ●Developed by the CECO to identify the high probability and high impact compliance risks o What steps must be taken to mitigate the compliance risks? o What policies and/or trainings need to be developed? ●President’s Cabinet reviews and makes recommendations to President ●President reviews and approves/rejects 28

Risk Assessment Process Step 6: Implement the Monitoring Plan ●The CECO works with the Compliance Partners to implement the approved compliance risk monitoring plan 29

Effective Compliance Program Step 3 Written policies and procedures Identify needed policies by Compliance Partners, CECO, or other stakeholders Develop policy drafting process to ensure transparency and stakeholder input Develop centralized location to store policies 30

Effective Compliance Program Step 4 Training and Education Identify needed training/education by Compliance Partners, CECO, policy implementers, or other stakeholders Identify responsible party to ensure training/education occurs Develop and provide appropriate training/education to specific stakeholders Document training/education 31

Effective Compliance Program Step 5 Lines of Communication Identify all possible communication methods to disseminate information about the compliance initiative and policies 32

Effective Compliance Program Step 6 Well publicized disciplinary guidelines Identify disciplinary guidelines Examples – Employee Handbook, Faculty Handbook, Faculty By-Laws, Student Handbook, etc. Review guidelines for consistency of discipline 33

Effective Compliance Program Step 7 Internal compliance monitoring and responses to detected offenses Identify laws, regulations, policies, and departments/units that require additional monitoring Develop systematic plan to ensure continued monitoring for non-compliance 34

V.Next Steps 35

TENTATIVE Timeline Identification of Compliance Partners October - December 2015 Compliance awareness survey January - February 2016 Training sessions with Compliance Partners March 2016 Self-assessment survey completion March - April

TENTATIVE Timeline Compile self-assessment survey data May - June 2016 Develop compliance risk mitigation plan July – August 2016 Implementation of compliance risk mitigation plan Fall

Associations with Reference Materials ● NACUA: ● Society for Corporate Compliance and Ethics: ● Association of Corporate Counsel: ● ECOA: ● NACUBO: ● Higher Education Compliance Alliance: 38