Programs
A program for each way value reaches HCPs and officials.
Each one works from the same people and payments.
01HCP engagements
Pay an HCP for work you need, at a rate you can defend.
The rule
Industry codes ask for a documented need, a written agreement and fair market value.
CMS Open Payments, published data
Dr. Laura Brenner
Vascular surgery · Chicago
$26,800 from 3 companies, 2021 to 2025
Program year 2025
- Northfield MedicalConsulting fee
$4,100$4,100 - Arden VascularTravel and lodging
$1,800$1,800 - Halden DevicesFood and beverage
$400$400
Your engagements with this HCP
- Advisory board12-Mar-26
- Training faculty03-Sep-26
In Cortex
A business owner requests the HCP and records the need.
Cortex checks the fee against your rate card and sends anything above it for approval.
The agreement, the work and the payment stay together, so an auditor can follow them.
02Events and travel
Plan the congress, the dinner and the flights within your limits for each attendee's country.
The rule
Industry codes allow modest hospitality tied to a real program, and some countries require approval before the event.
Advisory board, Lisbon
12-Nov-264 HCPs from 4 countries
Your cap for France: €1,000
€880 over cap- Travel
€380€380 - Hotel
- 2 nights at
€680€680 €1,360€1,360 - Meals
€140€140 - Total
€1,880€1,880
In Cortex
The event owner sets up the meeting, its agenda and its budget.
Attendees, flights and hotels arrive from your event and travel systems.
Cortex totals what each HCP receives and flags anyone over your limit before the event.
03Transactions
Review expenses, invoices, grants and commissions from whichever system records them.
The rule
The US Department of Justice asks whether you test your controls with your own data.
Review: dinner, Trattoria Sole, Milan
€480 for 3 attendees
Dinner per person above the country limit
€160 per person against a limit of €120 for Italy
Were HCPs present?
Was a business purpose recorded?
Is the cost per person within the limit?
In Cortex
Cortex reads transactions from your expense, ERP and travel systems.
Your red flags catch the ones that need a look, and each arrives with its receipt and attendees.
AI drafts the review checklist, and your reviewer confirms each answer.
04Channel partners
Know who sells on your behalf, and what they earn for it.
The rule
The US Foreign Corrupt Practices Act covers improper payments a distributor or agent makes on your behalf.
Screening: Meridian Medical Supplies Ltda.
Distributor, São Paulo
- OFAC sanctions list
- EU consolidated sanctions list
- UK sanctions list
- UN Security Council list
- World Bank debarred firms
- HHS-OIG exclusions
In Cortex
A business owner requests the partner and answers the intake questions.
Cortex screens the company and its owners against sanctions and exclusion lists, and again when the lists change.
Cortex checks discounts and commissions paid to the partner against its red flags.
05Hotline and incidents
Take a report from intake to corrective action with the deadlines in view.
The rule
The EU Whistleblowing Directive sets 7 days to acknowledge a report and 3 months to give feedback.
Case 2026-0418, conflict of interest
- Report received
- 16-Oct-26
- Acknowledge by
- 23-Oct-26
- Feedback due
- 16-Jan-27
Acknowledge within 7 days
Case history
- 16-Oct-26Report received through the web form
- 17-Oct-26Triage: conflict of interest, medium severity
- 19-Oct-26Assigned to an investigator in Compliance EMEA
In Cortex
Reports arrive from your hotline provider, a web form or a manager.
The case opens with the people and payments it names, and their history.
Cortex tracks the acknowledgement and feedback deadlines through to corrective action.
06Policies and training
Know who attested to which policy version, and who still owes training.
The rule
The US Department of Justice asks whether employees can find the policies that apply to them and whether you track who read them.
Anti-corruption policy, version 4.2
Due 30-Oct-26
Brazil
In Cortex
Your policy owner drafts the policy, and approvers sign off each version.
Cortex sends it and its training to the people it applies to, with a due date.
Late attestations go to the person's manager.
07Risk assessment
Score risk by market and activity from what your programs record.
The rule
The US Department of Justice expects a risk assessment you update with your own operating data.
Risk by market
Brazil · Channel partners
High
2 screening matches are open, and 1 distributor is overdue for screening.
In Cortex
Your team lists risks by market and activity, with the controls that address them.
Findings, screening matches, open cases and late attestations move the scores.
The risk owner sees which records moved a score.