As you prepare to schedule your 2026 compliance risk assessment, here are several important considerations that can help you strategically prioritize and organize your work for the upcoming year.
First, consider which risk areas your internal auditors, as applicable, may already be scheduling for 2026 as part of their internal audit process. This may have already been presented to the audit committee. Often, several compliance risk areas are already selected and incorporated into the internal audit plan. Aligning your compliance risk assessment with these existing efforts can help avoid duplication, reduce assessment fatigue across the organization, and strengthen collaboration between compliance, internal audit, and operational leaders.
Additionally, consider sending a prequestionnaire to members of the compliance committee, senior leaders, and/or board or other directors. This allows you to gather early input on:
- Compliance risk areas of concern to leadership
- Areas perceived as emerging or increasing risks
- Areas believed to be well-controlled and stable
- Organizing themes that might influence your annual planning (e.g., strategic goals, new service lines, operational changes, major regulatory updates)
This information helps ensure the assessment is aligned with organizational realities and leadership expectations while also encouraging engagement from key stakeholders.
Consider the following compliance risk areas and determine which would make the most sense to assess this year to establish if adequate controls are in place to mitigate the risks. Return to
- HIPAA Privacy areas
- HIPAA Security areas
- Billing and coding errors (Medicare/Medicaid)
- False Claims Act exposure
- Stark Law and Anti-Kickback Statute violations
- Poor clinical documentation
- Controlled substances and medication management
- Patient safety and quality reporting errors
- Vendor and third-party relationships
- Credentialing and privileging failures
- Research compliance violations
- Patient rights and informed consent issues
- Emergency Medical Treatment and Labor Act
- Revenue cycle compliance
- Telehealth compliance risks
- Audits and survey readiness
- Financial conflicts of interest
- Medical devices and equipment compliance
- AI use in clinical or administrative processes
- Post-acute and care-continuum compliance (home health, hospice, skilled nursing facility)
- Marketing and communications compliance
- Board and governance oversight practices
A thorough and well-structured 2026 compliance risk assessment positions your organization to proactively identify vulnerabilities, strengthen internal controls, and ensure ongoing regulatory compliance. By coordinating with internal audit, gathering stakeholder insights early, and thoughtfully selecting risk areas based on both organizational maturity and emerging regulatory trends, you create a more efficient, focused, and value-driven assessment process.