Every compliance program begins with a code of conduct. The code of conduct expresses a company’s fundamental values and its commitment to living by them. Although a code of conduct is usually a very high-level document, it expresses values in very specific areas of interest to a company, from which more detailed policies and procedures follow. Those values may vary from industry to industry because the business activities of an industry may necessitate more emphasis on particular values. Those values may also vary because corporate leadership may have different priorities as well.
Through the U.S. Sentencing Guidelines and public guidance, the U.S. Department of Justice (DOJ) has expressed its view about important elements of a compliance program. The DOJ expects a compliance program to be “well-designed . . . adequately resourced . . . [and] work in practice.”[1] Recent guidance has directed companies to ensure their compensation schemes reward compliance functions and successes and impose significant financial penalties on those who engage in misconduct.[2]
A code can exceed “minimum requirements”
DOJ’s expectations and a company’s individual values are not mutually exclusive. For a compliance program to be well designed, it must address the most serious risks a company faces that are, in part, a product of its industry. Financial institutions need strong accounting controls to protect against sanctions violations and money laundering. Manufacturing companies need strong health, safety, and environmental programs to keep workers from being exposed to hazardous materials and dangerous workplaces and prevent pollution.
A compliance program may also be used to address other risks that reflect corporate priorities that are not necessarily the most severe but that senior leadership believes are nevertheless significant. For example, while compliance with anti-discrimination laws and regulations is a minimum requirement, a company may establish standards of conduct and processes to exceed the minimum requirements. Similarly, a company may also seek to meet higher environmental standards than law or regulation requires. The code of conduct can express these values and, at the same time, stand as a commitment to address DOJ’s concerns.
