The concept of “discipline” is an important part of a compliance program, and it arises in two slightly different situations. First is the notion, under the U.S. Sentencing Guidelines Manual (USSG), that a compliance program should include incentives for employees to follow the program, along with punishment or discipline for failing to do so. Second is the concept that a company should have a rational program of employee discipline for various policy violations. Note that consistent discipline is a key element of effective compliance programs as well as an attribute of good management practices in general.
Sentencing Guidelines
Chapter 8 of the USSG deals with sentencing of organizations. The chapter covers various considerations that go into determining a sentence when an organization is convicted of a federal crime.[2] In most cases, an organization’s punishment is in the form of a fine, which is determined by several factors, including the nature of the offense, a prior history of violations, and the extent to which the organization cooperated with the government. The punishment may also take the form of restitution, disgorgement, debarment from federal contracts, and a period of probation.[3]
The guidelines also include the important concept of the “effective” compliance program. US law generally imposes liability on an employer for actions of an employee, even if the actions were not authorized or directed. But how can an organization credibly assert that the actions of an employee, which may have benefitted the organization, were not authorized? The guidelines provide the answer: If an organization can show that it used due diligence to prevent and detect criminal conduct, it may qualify for a reduction in any fine that might be imposed for violation of a federal criminal law. Due diligence is established by following certain basic principles of compliance that the guidelines outline, which essentially provide a credible basis for the assertion that the organization had no intent to violate the law. In essence, the guidelines provide the basis for the organization to say, “Look at all we did to try to prevent any sort of violation by our employees. What more could we have done?”
The guidelines outline the basic attributes of a compliance program designed to promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. This article will focus on one of those attributes: the concept of discipline or punishment. Specifically, the guidelines provide:
(6) The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to perform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.[4]
The concept of considering discipline of individuals was specified in the Sentencing Reform Act, which allows a court to take into consideration, when sentencing an organization, any measures taken by the organization to discipline responsible employees.[5]
The guidelines note that while adequate discipline of individuals responsible for an offense is a necessary component of enforcement, the form of discipline that will be appropriate will be case specific.[6] So, while the guidelines do not specify what kind of discipline should be imposed for violations, the organization will be expected to demonstrate that it has an appropriate disciplinary program or policy, and that it is fairly applied. Just having a policy on paper, which is ignored in reality, will not be sufficient.
Courts have recognized that employees may be under pressure, for example, to increase profits and “do whatever it takes” to meet quarterly or annual goals. A corporate policy that dryly recites the requirement that employees must obey various laws often gets overlooked or ignored, particularly when all or part of an employee's salary is tied to meeting goals.[7] Thus, an effective compliance program must have sufficient “teeth” that are actually used to punish employees for violating the law or company policies. A policy of punishment for violations should be designed to make it clear to employees that there will be consequences for illegal actions, and the pressure to make profits will not excuse the conduct.
If a violation is detected, the guidelines also require that:
(7) After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance and ethics program.[8]
So, one factor in determining if a compliance program is “effective,” as the guidelines define the term, and therefore worthy of justifying a sentencing reduction, is the response of the organization in the face of a criminal violation. One aspect of the organization’s response is the discipline of employees who may have been involved.
The guidance issued by the Department of Justice on prosecuting corporations notes that it would consider “the corporation’s remedial actions, including, but not limited to, any efforts to implement an adequate and effective corporate compliance program or to improve an existing one, to replace responsible management, to discipline or terminate wrongdoers, or to pay restitution.”[9] The importance of discipline for violations is emphasized in the DOJ’s Evaluation of Corporate Compliance Programs.[10] The DOJ includes “Communications about Misconduct” as one of the attributes of appropriate training and communication of a compliance program:
What has senior management done to let employees know the company’s position concerning misconduct? What communications have there been generally when an employee is terminated or otherwise disciplined for failure to comply with the company’s policies, procedures, and controls (e.g., anonymized descriptions of the type of misconduct that leads to discipline)?
The DOJ Guidance would also consider the “Human Resources Process” around employee discipline:
Who participates in making disciplinary decisions, including for the type of misconduct at issue? Is the same process followed for each instance of misconduct, and if not, why? Are the actual reasons for discipline communicated to employees? If not, why not? Are there legal or investigation-related reasons for restricting information, or have pre-textual reasons been provided to protect the company from whistleblowing or outside scrutiny?
Consistency of incentives and the disciplinary process is also important:
Have disciplinary actions and incentives been fairly and consistently applied across the organization? Does the compliance function monitor its investigations and resulting discipline to ensure consistency? Are there similar instances of misconduct that were treated disparately, and if so, why? Incentive System – Has the company considered the implications of its incentives and rewards on compliance? How does the company incentivize compliance and ethical behavior? Have there been specific examples of actions taken (e.g., promotions or awards denied) as a result of compliance and ethics considerations? Who determines the compensation, including bonuses, as well as discipline and promotion of compliance personnel?
The DOJ guidance quotes the Justice Manual, which advises prosecutors to look at discipline as part of an effective compliance program by considering “any remedial actions taken by the corporation, including, for example, disciplinary action against past violators uncovered by the prior compliance program.”[11] The Justice Manual also advises consideration of “appropriate discipline of employees, including those identified by the company as responsible for the misconduct, either through direct participation or failure in oversight, as well as those with supervisory authority over the area in which the criminal conduct occurred” and “any additional steps that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risks.”[12]
The DOJ guidance also notes that accountability is an important part of management responsibility for compliance:
What disciplinary actions did the company take in response to the misconduct and were they timely? Were managers held accountable for misconduct that occurred under their supervision? Did the company consider disciplinary actions for failures in supervision? What is the company’s record (e.g., number and types of disciplinary actions) on employee discipline relating to the types of conduct at issue? Has the company ever terminated or otherwise disciplined anyone (reduced or eliminated bonuses, issued a warning letter, etc.) for the type of misconduct at issue?[13]
The existence of employee discipline for the violations is an important factor in negotiating with a prosecutor in an attempt to avoid an indictment or civil action. If a company failed to punish a wrongdoer, it will be hard to convince a prosecutor that the company was serious about its commitment to abide by the law.