The Department of Justice’s June 2020 update to its Evaluation of Corporate Compliance Programs emphasizes the importance of training.[1] Below is the main section, but training is mentioned in other parts of the document. “There is in compliance often a hesitation to move away from in-depth, substantive training,” said Kirsten Liston, a principal at Rethink Compliance, who has six principles for great training.[2] “DOJ has given you a get-out-of-jail-free card. They are saying, ‘We will accept shorter training if it gets the job done, and it’s your responsibility to prove it.’” Some exhaustive training is mandatory, however, such as Medicare Advantage fraud, waste and abuse education. Contact Liston at kirsten@rethinkcompliance.com.
C. Training and Communications
Another hallmark of a well-designed compliance program is appropriately tailored training and communications.
Prosecutors should assess the steps taken by the company to ensure that policies and procedures have been integrated into the organization, including through periodic training and certification for all directors; officers; relevant employees; and, where appropriate, agents and business partners. Prosecutors should also assess whether the company has relayed information in a manner tailored to the audience’s size, sophistication or subject matter expertise. Some companies, for instance, give employees practical advice or case studies to address real-life scenarios, and/or guidance on how to obtain ethics advice on a case-by-case basis as needs arise. Other companies have invested in shorter, more targeted training sessions to enable employees to timely identify and raise issues to appropriate compliance, internal audit or other risk management functions. Prosecutors should also assess whether the training adequately covers prior compliance incidents and how the company measures the effectiveness of its training curriculum. Prosecutors, in short, should examine whether the compliance program is being disseminated to, and understood by, employees in practice in order to decide whether the compliance program is “truly effective.” Justice Manual § 9-28.800.
-
Risk-Based Training – What training have employees in relevant control functions received? Has the company provided tailored training for high-risk and control employees, including training that addresses risks in the area where the misconduct occurred? Have supervisory employees received different or supplementary training? What analysis has the company undertaken to determine who should be trained and on what subjects?
-
Form/Content/Effectiveness of Training – Has the training been offered in the form and language appropriate for the audience? Is the training provided online or in person (or both), and what is the company’s rationale for its choice? Has the training addressed lessons learned from prior compliance incidents? Whether online or in person, is there a process by which employees can ask questions arising out of the trainings? How has the company measured the effectiveness of the training? Have employees been tested on what they have learned? How has the company addressed employees who fail all or a portion of the testing? Has the company evaluated the extent to which the training has an impact on employee behavior or operations?
-
Communications About Misconduct – What has senior management done to let employees know the company’s position concerning misconduct? What communications have there been generally when an employee is terminated or otherwise disciplined for failure to comply with the company’s policies, procedures and controls (e.g., anonymized descriptions of the type of misconduct that leads to discipline)?
-
Availability of Guidance – What resources have been available to employees to provide guidance relating to compliance policies? How has the company assessed whether its employees know when to seek advice and whether they would be willing to do so?
