These folks or groups are responsible for overseeing the program, ensuring it is actually applied effectively, and serving as a source for compliance-associated questions and issues.  To meet this requirement, covered entities and company associates must build policies and procedures