Compliance Theater: Nine Rituals That Produce Paper Instead of Proof

A vendor compliance program reports its year. Attestations: 100% returned. Questionnaires: complete for every tier-one vendor. Certificates of insurance: all current. Audits: conducted on schedule. Corrective actions: closed within target. Every number is green and every number is true.

Then a subcontractor nobody could have named loses a laptop, and the investigation asks which of those controls would have caught it. The answer is none of them, and it was never going to be any of them, because not one of those activities compared a requirement against a piece of evidence.

That is compliance theater. The term borrows from security theater, and it means the same thing: activity that produces the appearance of control without producing the thing control is for.

It is a capacity problem wearing a process costume

The uncharitable read is that people are box-ticking. That is almost never what is happening.

When Ponemon surveyed 554 IT and security professionals at healthcare organizations in 2019, the average provider carried 1,320 vendors under contract and 27% assessed all of them even once a year. Take one vendor, one obligation, and do it properly: find the clause, determine what evidence satisfies it, request that evidence, read what comes back, compare it to the clause, record the conclusion. Call it forty minutes. Multiply by a dozen recurring obligations and 1,320 relationships and you have asked for about ten thousand hours a year, which is five or six people doing nothing else.

Almost nobody has five people assigned to nothing but this, and the same study shows where the hours actually go: 3.21 dedicated staff and more than 500 hours a month on vendor assessments, rising to 5,040 hours a month once you count everyone pulled in. The effort exists. It is being spent on getting documents to arrive rather than on checking what they say.

So the work gets reshaped until it fits, and the way it fits is by substituting an artifact for a verification. An attestation instead of a document check. A questionnaire instead of a clause comparison. A sample of five instead of a population. Each substitution is locally reasonable and defensible in the moment, and the accumulation is a program that cannot fail because it has stopped measuring anything that could.

Theater is what competence produces when the hours go to logistics rather than to verification. That is why calling it laziness misses, and why it does not respond to being told to try harder.

Nine rituals

The attestation nobody verifies. A vendor signs a statement that it screens its staff, trains its people and safeguards your data. The statement is filed. The underlying screening result, training record and policy are never requested. You have documented that the vendor is willing to make a claim.

The questionnaire nobody reads. Two hundred questions go out, two hundred answers come back, and the responses are stored rather than evaluated. The tell is that nobody can name a vendor whose answers triggered a follow-up.

The certificate that proves nothing. A certificate of insurance arrives and the expiration date is checked. The current ACORD 25 form is candid about what it is worth, in its own capitals: "LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS." The number on the certificate is not necessarily the coverage remaining, and nobody compares either figure against the limits in that vendor's specific clause, which is where the failures live.

The green dashboard driven by a date field. Status reads compliant because a renewal date is in the future. Coverage could have dropped by half at that renewal and the tile would not change color.

The sample too small to say anything. Eight vendors audited out of six hundred. The problem is the eight, not the 1.3%, because precision comes from the count and not the fraction. Eight clean results still leave about a one-in-six chance of missing a failure rate as high as one vendor in five, and they cannot bound the true rate below roughly 31%. Eight was chosen because eight is what the calendar allowed.

The corrective action that closes on schedule. A CAP opens with a thirty-day remediation date and closes on day thirty. Whether the underlying condition changed is a separate question the closure does not record.

The subcontractor assurance. Your agreement requires your vendor to flow terms down to anyone it hires. Your evidence that it happened is the clause requiring it, plus the vendor confirming it handled that. The executed downstream agreements are never collected.

The BAA counted at signature. A countersigned business associate agreement goes in the file. Whether it contains the provisions 45 CFR 164.504(e) requires is not checked, because the metric is existence rather than contents.

The policy written to be shown. A document that exists so it can be produced on request, describing a process nobody follows, reviewed annually by changing the date in the footer.

One test

For any control in your program, ask what it would have caught.

Verification produces a comparison between a requirement and a piece of evidence, and a comparison can come out negative. Theater produces a record that an activity occurred, and it comes out positive nearly every time, because participation rather than correctness is what it measures.

Which gives you a diagnostic that takes about a minute per control: how often has this returned a negative result? If a check has run across hundreds of vendors for several years and never once failed anybody, it is not a check. Put a number on that. Run six hundred vendors past an annual check for two years and find nothing, and you are implicitly claiming a true failure rate under about 0.25%. No vendor population that includes the careless, the acquired and the quietly reorganized produces that. A program generating no findings is reporting on its instruments rather than on its vendors.

Why it is worse than doing nothing

An unverified obligation is an open question, and open questions make people uncomfortable enough to occasionally look.

A green status closes the question. It converts an unknown into a stated fact, and it removes the discomfort that would have prompted somebody to check. The organization now believes something it has not established, has documentation supporting that belief, and has retired the instinct that would have caught the gap. That is a worse position than having nothing, because nothing at least feels like nothing.

It is also worse in an audit, though not for the reason most teams expect. The problem is not that the evidence is thin. It is that a program which has recorded conclusions without the reasoning behind them cannot reconstruct how it reached them, so a document request becomes a series of interviews with whoever held the job at the time.

What the regulator now says out loud

HHS OIG published compliance program guidance for Medicare Advantage on 3 February 2026, the first for that industry since 1999. Section II.E covers oversight of third parties, and in the middle of a passage on educating vendors who are new to healthcare it concedes the point in one line:

"Attestations may be a way to help mitigate risk, but they should be accompanied by additional compliance-related steps."

The guidance is voluntary and creates no new duty, which is what makes the sentence worth reading. It is the enforcement agency describing adequate practice with nothing to gain, and it says the attestation is a floor.

For Medicare Advantage plans specifically, the regulation is stricter still on cadence. 42 CFR 422.504(i)(4)(iii) requires that every delegation contract specify that performance is monitored on an ongoing basis. Not annually. Annual is a convention there rather than a requirement, and the 27% above suggests it is where manual processes land rather than where the rule points.

What replaces it

The substitutions all went the same direction, so undoing them goes the same direction too: back to the clause.

Start from what each agreement obliges, extracted with the clause and page it came from, rather than from a template that asks every vendor the same questions. Collect the artifact rather than the assertion, from the party who holds it. Compare the artifact to the requirement that specific agreement set, and record both sides of the comparison. Run the recurring ones on the cadence the risk has rather than the cadence a calendar allows. And keep the reasoning attached, so a conclusion can be examined later instead of taken on faith.

That is more work than theater, which is why it did not happen while reading was expensive. It is what Harper does, and the economics are the reason it is now possible: the same obligation recurs across dozens of agreements, so it is read once, stored canonically, and referenced everywhere it appears. Volume stops being the constraint that forced the substitutions in the first place.

Audit your own program in twenty minutes

Pick five controls you report on.

1. For each, write down what it compares: which requirement, against which piece of evidence.
2. If it does not compare a requirement to evidence, it is theater. Mark it.
3. For those that survive, find the last time each one produced a negative result. Note the date.
4. Divide your audited vendor count by your total vendor count. Write the percentage next to the word "coverage."
5. Take the ritual that most recently reported 100% and ask what it would have caught.

Step 3 is the sharpest of these. A control with no failures in two years across a large vendor population is not a passing grade, it is a number too clean to have come from the world, and a program made mostly of those is not measuring your vendors.