Does Your Organization Pass Muster? Check out the New Corporate Compliance Guidance from the DOJ

The U.S. Department of Justice (DOJ) recently issued a document entitled “Evaluation of Corporate Compliance Programs,” providing guidance to federal prosecutors on how to evaluate a corporation’s compliance program “for purposes of determining the appropriate (1) form of any resolution or prosecution; (2) monetary penalty, if any; and (3) compliance obligations contained in any corporate criminal resolution (e.g., monitorship or reporting obligations).” Essentially, the strength of a compliance program may serve to decrease or increase potential sanctions and disciplinary measures sought by the DOJ should your organization ever be prosecuted for a violation of law.

The guidance lists three main questions for prosecutors to ask when evaluating a case: (1) is there a well-designed compliance program; (2) is the compliance program effectively implemented; and (3) did the compliance program work in practice.

• Well-designed – the DOJ looks at risk assessment, policies and procedures, training and communications, confidential structure and reporting process, third party management, and mergers and acquisition.
• Implementation – the DOJ discusses commitment by senior and middle management to the compliance program, the autonomy and resources of management to carry out the program, and corresponding incentives and disciplinary measures.
• Effectiveness – the DOJ evaluates continuous improvement, testing, and review; the organization’s investigation of the misconduct; and its analysis and remediation of any underlying misconduct.

The guidance reiterates that the “critical factors in evaluating any program are whether the program is adequately designed for maximum effectiveness in preventing and detecting wrongdoing by employees and whether corporate management is enforcing the program or is tacitly encouraging or pressuring employees to engage in misconduct.” The DOJ noted that “the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense.” Rather, despite a violation occurring, an organization may be rewarded for its efforts to promote improvement and sustainability based on its efforts to be compliant. Employers should review their compliance practices and procedures in connection with this new guidance to minimize potential exposure.