The concept of “discipline” is an important part of a compliance program, but arises in two slightly different situations. First, is the notion, under the U.S. Sentencing Guidelines Manual (USSG), that a compliance program should include incentives for employees to follow the program, along with punishment or discipline for failing to follow the program. Second is the concept that a company should have a rational program of employee discipline for various policy violations. But more than just being seen as an attribute of compliance, consistent discipline is also an attribute of good management practices in general.
Sentencing Guidelines
Chapter Eight of the USSG deals with sentencing of organizations. The chapter covers various considerations that go into determining a sentence when an organization is convicted of a federal crime.[2] In most cases, an organization’s punishment is in the form of a fine, which is determined by a number of factors, including the nature of the offense, a prior history of violations, and the extent to which the organization cooperated with the government. The punishment may also take the form of restitution, disgorgement, debarment from federal contracts, and a period of probation.[3]
The Guidelines also include the important concept of the “effective” compliance program. U.S. law generally imposes liability on an employer for actions of an employee, even if the actions were not authorized or directed. But how can an organization credibly assert that the actions of an employee, which may have benefitted the organization, were not authorized? The Guidelines provide the answer: If an organization can show that it used due diligence to prevent and detect criminal conduct, it may qualify for a reduction in any fine that might be imposed for violation of a federal criminal law. Due diligence is established by following certain basic principles of compliance that the Guidelines outline, which essentially provide a credible basis for the assertion that the organization had no intent to violate the law. In essence, the Guidelines provide the basis for the organization to say “Look at all we did to try to prevent any sort of violation by our employees. What more could we have done?”
The Guidelines outline the basic attributes of a compliance program designed to promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. This article will focus on one of those attributed, the concept of discipline or punishment. Specifically, the guidelines provide:
(6) The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to perform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.[4]
The concept of considering discipline of individuals was specified in the Sentencing Reform Act, which allows a court to take into consideration, when sentencing an organization, any measures taken by the organization to discipline responsible employees.[5]
The Guidelines note that while adequate discipline of individuals responsible for an offense is a necessary component of enforcement, the form of discipline that will be appropriate will be case specific.[6] So, while the Guidelines do not specify what kind of discipline should be imposed for violations, the organization will be expected to demonstrate that it has an appropriate disciplinary program or policy, and that it is fairly applied. Just having a policy on paper, which is ignored in reality, will not be sufficient.
Courts have recognized that employees may be under pressure, for example, to increase profits and “do whatever it takes” to meet quarterly or annual goals. A corporate policy that dryly recites the requirement that employees must obey various laws often gets overlooked, particularly when all or part of a salary is tied to meeting goals.[7] Thus, an effective compliance program must have sufficient “teeth” to punish employees for violating the law or company policies. A policy of punishment for violations should be designed to make it clear to employees that there will be consequences for illegal actions, and the pressure to make profits will not excuse the conduct.
If a violation is detected, the Guidelines also require that:
(7) After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance and ethics program.[8]
So, one factor in determining if a compliance program is “effective” as the Guidelines define the term, and therefore worthy of justifying a sentencing reduction, is the response of the organization in the face of a criminal violation. One aspect of the organization’s response is the discipline of employees who may have been involved.
In the guidance issued by the Department of Justice on prosecuting corporations, it noted that it would consider the “corporation’s remedial actions, including any efforts to implement an effective corporate compliance program or to improve an existing one, to replace responsible management, to discipline or terminate wrongdoers, to pay restitution, and to cooperate with the relevant government agencies.”[9] Similarly, when the Department of Defense investigates whether to debar a company from doing business with the federal government, one of the factors it considers is “whether the company has investigated the incident that resulted in debarment and disciplined the employees involved.”[10] The existence of employee discipline for the violations is an important factor in negotiating with a prosecutor in an attempt to avoid an indictment or civil action. If a company failed to punish a wrongdoer, it will be hard to convince a prosecutor that the company was serious about its commitment to abide by the law.
Due Process and Employee Buy-In
Although there is a common tendency to think about “legal” rights in an investigation and discipline context, [11] while a company may be taking action in response to suspected illegal activity, an employee really does not have the same rights as he or she would in a law enforcement investigation. However, that is not to say that it is wise for an organization to do whatever it pleases in this area. Its goals in establishing an employee discipline program are not just to communicate to employees that there will be punishment for violation of laws or company rules, but also that the process will be fairly applied. This is part of creating a “culture of compliance” that is an important part of every compliance program. Most employees fundamentally understand that there should be consequences for wrongdoing. Communicating those consequences makes it clear that the organization will stand behind its policies and its commitment to operate ethically and in accordance with the law.
Employment lawyers will often argue for keeping disciplinary activities confidential. They are correct—up to a point. Employees tend to hear about things informally, even if there is no official announcement. Thus, the concept of “confidentiality” with regard to discipline must be considered partial, at best. Employees will find out about punishment that has been meted out, sometimes with the inaccuracy that marks many rumors. But they will also find out about employees—especially senior level employees—who violated a company rule or law and were not punished, or only received a “slap on the wrist.” In some cases it may be the relative—or a mistress—of a senior executive who is allowed to get away with conduct that would not be tolerated in others. When employees hear about this, their view of the company is appropriated diminished. Why should they care about working hard or following the rules when all that really matters is whether you have a relationship with a boss?
One way to help establish the bona fides of a compliance discipline program is to make certain that employees are aware when other employees are disciplined for policy violations. This must be handled carefully. As noted, if the discipline does not rise to the level of publicly acknowledged criminal prosecution, then steps should be taken to make sure that the identity of the disciplined employee is concealed to protect his or her privacy (and avoid defamation charges against the company). It is particularly important to disclose when a senior manager has been disciplined. This sends an important message to employees at all levels that nobody is exempt from the rules. But many companies actually show excessive concern about privacy or embarrassment of employees who have engaged in misconduct, and the result is that employees either don’t know about the discipline, or if they knew that “something happened” but do not know that anyone was punished, they may think that the company prefers to sweep wrongdoing under the rug, and they will behave accordingly.[12]
The goal should be an investigation and discipline program that is transparent in its basic elements, yet private in its execution. Employees want some assurance that matters will be handled in a fair and impartial manner. Publicizing the rules in advance will help employee acceptance. But of course this requires that the company be well-managed. The rules must be enforced consistently, and the employee must have confidence that they will be treated fairly.
To help ensure that the disciplinary actions of the enterprise are conducted properly, discipline should be one aspect of a periodic review by internal auditors. There should be a central record of punishments for compliance violations. The nature of the violation, the status of the employee, and the severity of the discipline (in light of mitigating or aggravating circumstances) should be reviewed to verify that the system is functioning properly.