Ron Miller (ronnie.miller@btlaw.com) is Of Counsel, Government Services & Finance in the Washington, DC, offices of Barnes & Thornburg LLP.
Corporate compliance programs serve an important purpose in establishing safeguards to protect the corporation and instill a culture of ethical and legal behavior throughout the organization. In the worst case, corporate compliance programs may be evaluated by U.S. Department of Justice (DOJ) attorneys to determine mitigating factors in corporate wrongdoing.
In April 2019, DOJ issued updated guidance for prosecutors[1] to help in evaluating the role of corporate compliance programs and whether those programs should influence prosecution of any offenses. In particular, the guidance focused on three primary questions. First, whether the compliance program was well-designed; second, whether the program was being applied earnestly and in good faith; and third, whether the program worked in practice.
A well-designed program
Prosecutors are encouraged to evaluate compliance programs on a variety of factors, including how well the company has identified its risk profile, how well the compliance program addresses those risks, and whether the program would be expected to detect the sort of misconduct expected to occur in the company’s business operations.
Assessment of risk involves analyzing business operations on a number of parameters. The location of the business, the type of business in which the company is engaged, the competitive pressures on the company in the marketplace, the regulatory framework involved in the company operations, and the type of transactions in which the company is engaged are all significant factors. Corporate compliance programs should engage in “risk-tailoring,” which applies metrics to risk management activities and then tailors the allocation of resources to high-risk and low-risk areas. Finally, risk assessment should be appropriately updated and revised as circumstances change, and particularly as lessons are learned through compliance activities.
Well-designed programs also memorialize best practices in policies and procedures. This should include a corporate code of conduct that establishes a culture of compliance. The manner in which the company designs and implements policies, the comprehensiveness of the policies, employee access to policies, determining who in the organization has responsibility for integrating policies and procedures into corporate operations, and assessing whether key employees have been appropriately trained on their role are all factors that are important for prosecutors assessing a compliance program.
Additionally, prosecutors should evaluate the extent to which training of employees and communication has been designed to effectively communicate policies and procedures based on the audience, subject matter, and sophistication of both what is communicated and the intended audience. In this evaluation, training that employees in key control positions have received, particularly in the context of risk-based training, and the form and content—of both resources readily available and ongoing training—are critical. Training and reference resources should be evaluated for effectiveness using tools such as pre- and post-testing, as well as other metrics that show data over time.
Another parameter that can help define a well-designed compliance program is the existence of a confidential reporting mechanism and an investigative process. Prosecutors are encouraged to consider whether the company has a confidential reporting system, whether it is used, how the company assesses the seriousness of reported issues, whether investigations are properly scoped, whether investigations are conducted by qualified and empowered staff, the promptness of investigation completions, and if follow-up ensures accountability and feedback for the compliance program.
Finally, well-designed compliance programs should include assessment of third-party suppliers, partners, consultants, and distributors, as well as targets of mergers or acquisition. In these circumstances, the compliance program should provide for due diligence and monitoring in fashions akin to the company’s own compliance program. This includes confirming the existence of control mechanisms, particularly with respect to payments, contractual relationships, and metrics in areas designed to detect misconduct and address risks particular to that industry.
Effectively implemented compliance programs
Prosecutors may consider whether a compliance program has been legitimately implemented, which includes assessing whether sufficient resources have been allocated for auditing, review, and documentation of the compliance program’s effectiveness. Factors that will be considered include the corporate culture, the actions and culture of middle and senior management, and the independence and resources provided to the corporate compliance program.
Management sets the tone for the rest of the company in most instances, and senior managers who support a culture of compliance and ethics, evidenced by their behavior with subordinates, are good indications of an effective compliance program. Additionally, senior management support of the compliance program is shown by having compliance professionals at appropriate seniority levels in the company, having necessary autonomy to go directly to the board of directors, and having the requisite experience and qualifications to perform essential compliance tasks. Finally, company support of compliance in areas such as human resource processes, bonuses, awards, disciplinary activities, and consistency within the organization are critical to an effectively implemented compliance program.
Practical effectiveness of a compliance program
While an instance of misconduct does not diminish the overall role of the compliance program, prosecutors should make some evaluation of how the misconduct was identified, the resources allocated to the efforts to investigate and identify the misconduct, and remedial actions that may have been taken as a result of the discovery of misconduct. Effective compliance programs must continually evolve based on feedback received and metrics that measure the effectiveness of compliance activities. Feedback mechanisms may include policy and process reviews, internal control testing, and other review and tracking methods that record data about compliance activities.
An effective compliance program has an investigative process that is funded and available to respond promptly to issues raised and positioned to assist management with maintaining accountability throughout the organization. The evolution and vibrancy of a compliance program can be evidenced by periodic policy reviews, updated risk assessments, evaluation of relationship-driven issues—particularly with third parties—and through financial and compensation systems.
Conclusion
DOJ’s updated April guidance gives prosecutors wide latitude in their evaluation of compliance programs and the manner in which they consider whether programs are well-designed, legitimately implemented, and work in practice. Companies should proactively consider these assessment criteria in advance of any prosecutorial review and conduct their own internal assessment of the published guidance and criteria. Additionally, senior management fostering a culture of compliance and ethical behavior that is evidenced not just in word, but in deed, is a key factor for success in these types of circumstances.