The U.S. Department of Justice (DOJ) Criminal Division recently released a guidance document entitled “The Evaluation of Corporate Compliance Programs,” an updated version of the guidance the DOJ’s Fraud Section had released in February 2017. The 2019 guidance “seeks to better harmonize the guidance with other Department guidance and standards while providing additional context to the multifactor analysis of a company’s compliance program,” and was compiled with the input from various DOJ components, including the Office of the Assistant General, Fraud Section, and the Money Laundering and Asset Recovery Section.
The guidance will assist prosecutors in making decisions about whether and to what extent a company’s compliance program was effective for the purpose of determining (1) whether there be a resolution or prosecution of the company; (2) whether a monetary penalty be imposed; and (3) whether compliance obligations should be imposed on the company.
DOJ recognizes that a “rigid formula” is not used to assess the effectiveness of corporate compliance programs and an individualized determination is made in each case because a corporate compliance program must be evaluated in the specific context of a criminal investigation. Therefore, the new guidance is structured around three “fundamental questions” a prosecutor should ask to evaluate compliance programs:
•1. Is the corporation’s compliance program well designed?
•2. Is the program being implemented effectively?
•3. Does the compliance program work in practice?
First question: Is the corporation’s compliance program well designed? The guidance discusses various “hallmarks” of effective compliance programs relating to risk assessment, company policies and procedures, appropriately tailored training and communications, the existence of an efficient and trusted confidential reporting structure and investigation process, the application of risk- based due diligence to its third-party management, and comprehensive due diligence of any acquisition targets.
Second question: Is the program being implemented effectively? As noted in the guidance, even a well-designed compliance program may be unsuccessful if implemented ineffectively. Therefore, prosecutors are instructed to investigate whether a compliance program is a “paper program” or one “implemented, reviewed, and revised…in an effective manner.” Prosecutors should evaluate the commitment by senior and middle management to compliance and whether the employees responsible for compliance have adequate experience, seniority, resources, and autonomy. Prosecutors should also assess whether the company has clear disciplinary procedures in place and whether the company enforces them consistently across the organization.
Third question: Does the compliance program work in practice? The guidance points out that evaluating whether a compliance program was working effectively is “one of the most difficult questions prosecutors must answer.” To do so, prosecutors should consider, “whether and how the misconduct was detected, what investigation resources were in place to investigate suspected misconduct, and the nature and thoroughness of the company’s remedial efforts.” Prosecutors should also consider whether the program “evolved over time to address existing and changing compliance risks.”
The guidance has emphasized DOJ’s increased focus on evaluating compliance programs and their effectiveness. The updated guidance is an important resource for companies to use in order to build, implement, and adapt over time, an effective compliance program that comports with the fundamental factors outlined in the guidance document.
