Areas with higher penalties for non-compliance, that have prior findings of deficiencies or where new products or processes are being introduced should receive more attention. Unacceptable exceptions should be reported promptly to appropriate management and, if appropriate, the board of directors. Compliance officers should monitor corrective action plans, and retest to ensure deficiencies are corrected in a timely manner.
As with any risk management function, the management compliance committee and appropriate committee of the board should at least annually review and approve the compliance risk assessment, the scope of the annual plan, and adherence to the compliance plan.