Great Expectations

Assessing the Effectiveness of a Corporate Compliance Program

The existence and effectiveness of a corporation’s compliance program and the extent of the company’s efforts to improve it are among the factors identified in DOJ’s corporate charging guidelines that federal prosecutors consider in investigating, charging and prosecuting corporate wrongdoing.

The topics and questions below are key areas DOJ has used to evaluate the effectiveness of a company’s compliance program. There is no one-size-fits-all program, and effectiveness will be evaluated based on the risk profile of the company.

• Analysis and remediation of the underlying misconduct, including efforts to identify the root cause of compliance failures, whether there were prior opportunities to detect the misconduct in question and why such opportunities were missed.
• Tone at the top, commitment and oversight by senior management and directors within the company.
• Autonomy and resources of the compliance function, including whether the compliance function is accorded a sufficiently high level of stature within the company, control personnel have the appropriate experience and qualifications, compliance has high-level reporting lines, reports of violations or weaknesses have been taken seriously, the compliance function is fully resourced and, if aspects of compliance are outsourced, how that outsourcing is overseen and quality control ensured.
• Compliance policies and procedures, including whether policies are tailored to the business, prohibit misconduct, empower and train gatekeepers, and are clearly communicated.
• Operational integration, including responsibility for roll-out, internal controls and payment/approval systems, and vendor selection/oversight.
• Compliance risk assessment approach, including the methodologies used for risk assessment and the ways in which a company uses information and advanced metrics.
• Training, communications, guidance and resources, including the degree to which training is risk-based and effective, how senior management has responded to failures and lessons learned, addressing termination of employees where violations occur and ensuring guidance is available at a practical level.
• Internal reporting of potential violation, company investigation and response, including whether the company has ensured that any investigations have been properly scoped and are independent, objective, appropriately conducted and documented, and whether they are used to identify system vulnerabilities and accountability lapses, including among managers and senior executives.
• Accountability, incentives and disciplinary measures, including whether managers have been held accountable for misconduct that occurred under their supervision.
• Periodic testing and improvement efforts, including internal audit culture, testing and updating.
• Management of third parties, including risk assessments, risk-adjusted controls, oversight and discipline.
• Mergers and acquisitions process, including whether misconduct or risks were identified during transaction due diligence; how the compliance function has been integrated into the merger, acquisition, and integration process; and how the company has dealt with any misconduct or risk identified during the transaction due diligence process.

Practical Implications for Companies and Compliance Officers

Ethics and compliance officers should immediately take note of the new DOJ guidance, as it appears to confirm the Fraud Section’s continued interest in and commitment to pursuing organizations and individuals for alleged failures to establish, monitor and properly implement effective compliance programs (for operations, third-party oversight and M&A transactions alike). A company’s investment of time and resources in corporate compliance is not only necessary to avoid potential embarrassment and penalties. It also serves as an insurance policy to protect the organization and its employees against potential allegations of criminal intent or willful ignorance.

Companies and their compliance officers may wish to align (or design) their compliance policies and procedures so that in the event of a potential government investigation, prosecutors can easily identify how the company and its employees have satisfied DOJ’s corporate compliance standards

The recently unveiled guidance follows a stream of recent federal law enforcement pronouncements focused on corporate compliance and individual accountability including DOJ’s September 9, 2015 Yates Memorandum, the Department’s April 5, 2016 pilot program for self-reporting Foreign Corrupt Practices Act violations and the summer of 2015 revision of the FCPA Guide. Thus, this guidance represents an important addition to the list of any compliance officer’s handy reference files.