Jeffrey M. Kaplan (jkaplan@kaplanwalker.com) is a Partner with Kaplan & Walker LLP in Princeton, New Jersey, USA.
On April 30, 2019, Assistant Attorney General Brian Benczkowski announced the publication of an updated version of the Evaluation of Corporate Compliance Programs (the new guidance), superseding an evaluation criteria document published in 2017 by the Department of Justice (DOJ). Although the new guidance[1] does not materially alter the DOJ’s criteria for evaluating compliance program efficacy, its issuance is an important development that compliance and ethics (C&E) professionals should be aware of. The new guidance constitutes the most comprehensive set of standards ever promulgated by DOJ in this area. As such, it should also be used by companies for C&E internal and external self-assessments.
The new guidance is structured around three “fundamental questions,” the first being, “Is the corporation’s compliance program well designed?” For evaluating this issue, prosecutors are provided with various considerations regarding C&E risk assessment, policies and procedures, training and communications, confidential reporting structure and investigation process, third party management, and mergers and acquisitions.
The second fundamental question is, “Is the corporation’s compliance program being implemented effectively?” For making this determination, prosecutors are provided with considerations regarding C&E commitment by senior and middle management (including conduct at the top), program autonomy and resources, and incentives and disciplinary measures.
The third fundamental question is, “Does the corporation’s compliance program work in practice?” Considerations here concern continuous improvement, periodic testing and review, investigation of misconduct, and analysis and remediation of any underlying misconduct.
Although not every item will be relevant to every case, the document is very well thought out and should be helpful in assessing every program. It is clearly state of the art.
Among its many virtues, the comprehensive new guidance places a deservedly strong emphasis on risk assessment, draws needed attention to the case for greater integration of C&E with other internal controls, and emphasizes the importance of having adequately supported and compensated C&E personnel.
Finally, I do not think that every company needs to conduct regular full external assessments using these criteria. But given the importance the DOJ places on independence in compliance matters (in this guidance and elsewhere), it may make sense to have a third-party expert review both the methodology and results of the internal self-assessment.