The United States Department of Justice (DOJ) released an update to its guidance document, Evaluation of Corporate Compliance Programs,[1] which is based on insights from its own ongoing experience and input from the compliance and business communities. The update was released in June and has been making the rounds as compliance professionals seek to understand the changes made. The guidance document has been an invaluable resource for compliance professionals, as it provides an easy-to-follow outline for what DOJ expects from an effective compliance program. Any updates or changes to the document are therefore closely followed.
In this article, we will focus on a few key changes and insights in the guidance related to third-party management and touch on some related general compliance topics.
Third-party management
The biggest change to this passage in the guidance document is the replacement of “due diligence” with “management.” This change reflects the DOJ view that due diligence is not good enough and that a compliance program should have an ongoing process for evaluating third-party relationships instead of relying on a snapshot.
The emphasis on ongoing monitoring and evaluation is reflected throughout the document. Specifically, in the passages on third-party management, the guidance asks:
How has the company considered and analyzed the compensation and incentive structures for third parties against compliance risks? How does the company monitor its third parties? Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? How does the company train its [third-party] relationship managers about compliance risks and how to manage them? How does the company incentivize compliance and ethical behavior by third parties? Does the company engage in risk management of third parties throughout the lifespan of the relationship, or primarily during the onboarding process?
The last sentence is an update from the previous version and underscores the DOJ perspective that monitoring should be ongoing.
Another addition to third-party management pops up in the passages about reporting mechanisms. Here, the updated version includes the added part, italicized here:
“Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism and, if not, why not? How is the reporting mechanism publicized to the company’s employees and other third parties?”
This addition addresses the fact that many companies may not be marketing the reporting mechanism to their vendors in a meaningful way, and that needs to change.
