By Theodore Banks and Gretchen Winter[1]
The concept of “discipline” is an important part of a compliance program, but it arises in two slightly different situations. First is the notion, under the U.S. Sentencing Guidelines Manual (USSG), that a compliance program should include incentives for employees to follow the program, along with punishment or discipline for failing to do so. Second is the concept that a company should have a rational program of employee discipline for various policy violations. But more than just being seen as an attribute of compliance, consistent discipline is also an attribute of good management practices in general.
Sentencing Guidelines
Chapter eight of the USSG deals with sentencing of organizations. The chapter covers various considerations that go into determining a sentence when an organization is convicted of a federal crime.[2] In most cases, an organization’s punishment is in the form of a fine, which is determined by a number of factors, including the nature of the offense, a prior history of violations, and the extent to which the organization cooperated with the government. The punishment may also take the form of restitution, disgorgement, debarment from federal contracts, and a period of probation.[3]
The guidelines also include the important concept of the “effective” compliance program. US law generally imposes liability on an employer for actions of an employee, even if the actions were not authorized or directed. But how can an organization credibly assert that the actions of an employee, which may have benefitted the organization, were not authorized? The guidelines provide the answer: If an organization can show that it used due diligence to prevent and detect criminal conduct, it may qualify for a reduction in any fine that might be imposed for violation of a federal criminal law. Due diligence is established by following certain basic principles of compliance that the guidelines outline, which essentially provide a credible basis for the assertion that the organization had no intent to violate the law. In essence, the guidelines provide the basis for the organization to say, “Look at all we did to try to prevent any sort of violation by our employees. What more could we have done?”
The guidelines outline the basic attributes of a compliance program designed to promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. This article will focus on one of those attributed, the concept of discipline or punishment. Specifically, the guidelines provide:
(6) The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to perform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.[4]
The concept of considering discipline of individuals was specified in the Sentencing Reform Act, which allows a court to take into consideration, when sentencing an organization, any measures taken by the organization to discipline responsible employees.[5]
The guidelines note that while adequate discipline of individuals responsible for an offense is a necessary component of enforcement, the form of discipline that will be appropriate will be case specific.[6] So, while the guidelines do not specify what kind of discipline should be imposed for violations, the organization will be expected to demonstrate that it has an appropriate disciplinary program or policy, and that it is fairly applied. Just having a policy on paper, which is ignored in reality, will not be sufficient.
Courts have recognized that employees may be under pressure, for example, to increase profits and “do whatever it takes” to meet quarterly or annual goals. A corporate policy that dryly recites the requirement that employees must obey various laws often gets overlooked, particularly when all or part of a salary is tied to meeting goals.[7] Thus, an effective compliance program must have sufficient “teeth” to punish employees for violating the law or company policies. A policy of punishment for violations should be designed to make it clear to employees that there will be consequences for illegal actions, and the pressure to make profits will not excuse the conduct.
If a violation is detected, the guidelines also require that:
(7) After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance and ethics program.[8]
So, one factor in determining if a compliance program is “effective” as the guidelines define the term, and therefore worthy of justifying a sentencing reduction, is the response of the organization in the face of a criminal violation. One aspect of the organization’s response is the discipline of employees who may have been involved.
In the guidance issued by the Department of Justice on prosecuting corporations, it noted that it would consider the “the corporation’s remedial actions, including, but not limited to, any efforts to implement an adequate and effective corporate compliance program or to improve an existing one, to replace responsible management, to discipline or terminate wrongdoers, or to pay restitution.”[9] The existence of employee discipline for the violations is an important factor in negotiating with a prosecutor in an attempt to avoid an indictment or civil action. If a company failed to punish a wrongdoer, it will be hard to convince a prosecutor that the company was serious about its commitment to abide by the law.
Due Process and Employee Buy-In
Although there is a common tendency to think about “legal” rights in an investigation and discipline context,[10] while a company may be taking action in response to suspected illegal activity, an employee really does not have the same rights as he or she would in a law enforcement investigation. However, that is not to say that it is wise for an organization to do whatever it pleases in this area. Its goals in establishing an employee discipline program are not just to communicate to employees that there will be punishment for violation of laws or company rules, but also that the process will be fairly applied. This is part of creating a “culture of compliance” that is an important part of every compliance program. Most employees fundamentally understand that there should be consequences for wrongdoing. Communicating those consequences makes it clear that the organization will stand behind its policies and its commitment to operate ethically and in accordance with the law.
Employment lawyers will often argue for keeping disciplinary activities confidential. They are correct—up to a point. Employees tend to hear about things informally, even if there is no official announcement. Thus, the concept of “confidentiality” with regard to discipline must be considered partial, at best. Employees will find out about punishment that has been meted out, sometimes with the inaccuracy that marks many rumors. But they will also find out about employees—especially senior-level employees—who violated a company rule or law and were not punished, or only received a slap on the wrist. In some cases, it may be the relative or friend of a senior executive who is allowed to get away with conduct that would not be tolerated in others. When employees hear about this, their view of the company is appropriately diminished. Why should they care about working hard or following the rules when all that really matters is whether you have a relationship with a boss?
One way to help establish the bona fides of a compliance discipline program is to make certain that employees are aware when other employees are disciplined for policy violations. This must be handled carefully. As noted, if the discipline does not rise to the level of publicly acknowledged criminal prosecution, then steps should be taken to make sure that the identity of the disciplined employee is concealed to protect his or her privacy (and avoid defamation charges against the company). It is particularly important to disclose when a senior manager has been disciplined. This sends an important message to employees at all levels that nobody is exempt from the rules. But many companies actually show excessive concern about privacy or embarrassment of employees who have engaged in misconduct, and the result is that employees either don’t know about the discipline, or if they knew that “something happened” but do not know that anyone was punished, they may think that the company prefers to sweep wrongdoing under the rug, and they will behave accordingly.[11]
The goal should be an investigation and discipline program that is transparent in its basic elements, yet private in its execution. Employees want some assurance that matters will be handled in a fair and impartial manner. Publicizing the rules in advance will help employee acceptance. But of course, this requires that the company be well-managed. The rules must be enforced consistently, and the employee must have confidence that they will be treated fairly.
To help ensure that the disciplinary actions of the enterprise are conducted properly, discipline should be one aspect of a periodic review by internal auditors. There should be a central record of punishments for compliance violations. The nature of the violation, the status of the employee, and the severity of the discipline (in light of mitigating or aggravating circumstances) should be reviewed to verify that the system is functioning properly.
Attributes of the Disciplinary Program
A decision about employee discipline will usually come about after an investigation of an alleged wrongdoing. Although beyond the scope of this chapter, it is important to note that the investigation process must be conducted by competent and fair individuals. They do not need to be lawyers, but they should be trained in the basic elements of conducting an investigation. The people who conduct an investigation should prepare a report of their investigation with the facts they have uncovered, but the investigators are not usually the ones who determine the punishment for the violation.
After there has been a determination of misconduct, whether or not it resulted in criminal liability, the decision about the extent of discipline will depend on a number of factors. Employees should be warned in advance that violation of laws and company rules will subject the employee to discipline, up to and including termination.
Punishment for a compliance infraction can take a variety of forms, including training, verbal warnings, written reprimands, job reassignment, suspension with pay, suspension without pay, and termination. The severity of the punishment would depend on a number of factors, including the type of violation and its effect on the organization, and the impact of the violation on other employees. For repeat offenders, the severity of the discipline can be increased on subsequent occurrences. The organization’s history of discipline for the violation may be a guide, except in instances where there is a history of not imposing punishment for an obvious violation. [12]
When imposing discipline for a compliance violation, the employer should act reasonably promptly.
These are some of the factors that can be considered:
| Attribute | Impact | Comment |
| The employee committed the infraction due to ignorance. | Mitigating | If the employee was ignorant of the impropriety of his or her actions, and the company had failed to inform the employee, this should be a mitigating factor unless the act was commonly known to be improper. |
| The employee committed the infraction willfully. | Aggravating | If the employee knew the conduct was wrong but went ahead regardless, this factor may be considered an aggravation. |
| The employee certified that he or she would follow the applicable company policy. | Aggravating | This indicates that the employee knew the conduct was wrong but went ahead anyhow. |
| The employee had a senior management position. | Aggravating | Managers have an obligation to lead by example, and, based on their position, can cause great harm to the organization. |
| The employee was directed to engage in the conduct by a manager. | Mitigating | The extent of the mitigation might also depend on the degree of the employee’s knowledge about the impropriety of the act and the threats (implicit or explicit) from the manager. |
| The employee obstructed the investigation. | Aggravating | |
| The employee retaliated against a whistleblower. | Aggravating | |
| The employee cooperated in the investigation. | Mitigating | |
| The employee was a mere bystander. | Mitigating | The employee’s minor role in the violation can be a mitigating consideration; instigation of the violation may be an aggravating factor. |
| The employee had not committed an infraction previously. | Mitigating | Repeat offenses would be an aggravating factor. |
| The manager consciously disregarded wrongdoing. | Aggravating | |
| The employee was motivated by personal gain. | Aggravating | The employee was willing to damage the organization for personal benefit. |
| The employee observed other employees engaging in the same conduct. | This is not a justification for the conduct, but it may go to the issue of corporate culture and whether there was an adequate education and business control system in place. | |
| The employee intentionally avoided training on the subject. | Aggravating | |
| The employee engaged in the action due to financial hardship. | --- | Not a justification, but a reminder to the organization that it should have systems in place to assist employees with personal problems (e.g., employee assistance programs for drug abuse) or financial problems (e.g., credit unions available to make hardship loans). |
| The violation was severe. | Aggravating | The aggravation (or mitigation) should be in proportion to the seriousness of the violation. |
| The violation caused material or personal damage/injury. | Aggravating | The aggravation (or mitigation) should be in proportion to the extent of the injury/damage. |
| The manager negligently failed to stop violation. | Aggravating |
A frequent question that is raised is, “When should an employee be terminated?” There is no one answer, of course, but several factors may indicate that a termination of employment is appropriate. These include:
-
The conduct in question violated criminal laws.
-
The conduct in question violated laws that exposed the company to significant civil liability.
-
The conduct in question injured or created the very real risk of injury to others.
-
The conduct in question violated clear company policies that had stated a zero-tolerance for violation.
-
The conduct was repetitive.
-
The conduct violated an order from or agreement with a government agency.
A number of federal and state statutes protect employees from discriminatory treatment in disciplinary actions based on belonging to a protected class. For example, the Americans with Disabilities Act[13] provides that no employer with 15 or more employees shall discriminate against a qualified individual with a disability with regard to employment decisions, such as hiring, advancement, discipline and discharge, compensation, and other terms, privileges, and conditions of employment. Other statutes designed to protect whistleblowers provide that an employee who uncovers wrongdoing by the employer must be offered a remedy if they faced discipline or termination in retaliation for revealing the wrongdoing.
Discipline Related to Compliance Administration
As noted at the outset, some types of disciplinary actions will be triggered by the failure of an employee to follow the procedures or administrative aspects of a compliance program. These activities might include punishment of an employee for failure to take required compliance training. Some companies may consider withholding of a paycheck until training is completed, but this may be problematic under the wage and hour laws for nonexempt (i.e., hourly) employees.
For exempt employees (i.e., nonhourly), failure to perform compliance obligations should have consequences. Ideally, during the employee’s first encounter with the company, he or she should be trained on the code of conduct, and be required to sign a certification that he or she will abide by the code. Until that segment of the onboarding process is complete, hiring should not be considered official for purposes of receiving pay or doing work.
Once that is complete, the employee should receive a series of communications regarding compliance training related to the job at hand. But even if paychecks cannot be stopped for failure to take training, consequences can be in the form of a reduced performance rating at the end of the year, which would lower any expected bonus. In most companies that have a management evaluation system, low ratings would also mean reduced opportunities for promotion.
Managers have a specific role in advancing a compliance program. This usually includes ensuring that all of the employees that report to them take the required training and that they present compliance materials in some form to their staff. Failure to perform these obligations (which would also be in their goals) would also be grounds for discipline.