Domestic and international rules, regulations, policies, standards, and guidelines that may provide oversight of and influence on a compliance program can vary depending on an organization’s business and operations. A variety of government oversight agencies, regulatory rules, and guidelines exist. This chapter covers a few that could be involved in the oversight of an organization’s business, depending on the industry segment of the organization. This chapter is not all-inclusive, and other agencies, laws, or systems may provide oversight of your organization and business, such as:
-
Federal Trade Commission (FTC)
-
ISO 19600 Compliance Management Systems
-
UK Bribery Act
-
New York Stock Exchange (NYSE)
-
Health Insurance Portability and Accountability Act (HIPAA)
-
Gramm-Leach-Bliley Act (GLBA)
-
Computer Fraud and Abuse Act (CFAA)
-
Family Educational Rights and Privacy Act (FERPA)
-
Genetic Information Nondiscrimination Act of 2008 (GINA)
-
State-level agencies
More information on these areas can be found in the glossary.
US Federal Guidelines
For the new compliance professional, it is important to recognize core resources that can be used to establish your compliance program in the United States. The following resources are referenced by the DOJ when investigating alleged corporate wrongdoing:
-
Federal Sentencing Guidelines, “Chapter Eight: Sentencing of Organizations.”[1] See Chapter 1 of this book for more information.
-
Justice Manual, “Principles of Federal Prosecution of Business Organizations,” section 9-28.000. The emphasis in section 9-28.010 is the “focus on wrongdoing by individuals from the very beginning of any investigation of corporate misconduct.”[2] The overall thought is that this will incentivize reporting individuals with knowledge to identify individuals culpable in wrongdoing, regardless of their level in the organization.[3]
From an organizational perspective, when the DOJ reviews corporate wrongdoing, it generally considers the public benefit, public harm, and how a corporate indictment would impact the organization’s culture. Each of these aspects may result in a different enforcement action after the DOJ considers all aspects of the investigation.[4]
In certain instances, corporate criminal cases may be resolved by means other than indictment. For instance, non-prosecution and deferred prosecution agreements may be “an important middle ground between declining prosecution and obtaining the conviction of a corporation.”[5][6] Additionally, civil and regulatory alternatives may be appropriate in certain cases.[7] A compliance professional would want to be aware of the directional possibilities of prosecution should the organization come under DOJ scrutiny.