II. Is the corporation’s compliance program well designed?

The “critical factors in evaluating any program are whether the program is adequately designed for maximum effectiveness in preventing and detecting wrongdoing by employees and whether corporate management is enforcing the program or is tacitly encouraging or pressuring employees to engage in misconduct.”⁴ Factors prosecutors should consider include:

1. Risk assessments – Prosecutors should consider whether the program is appropriately designed to detect misconduct most likely to occur in a particular corporation’s line of business. Prosecutors may credit the quality and effectiveness of a risk-based compliance program that devotes appropriate attention and resources to high-risk transactions, even if it fails to prevent misconduct in a low-risk area.
2. Policies and procedures – As a threshold matter, prosecutors should look to see that a corporation has a code of conduct that sets out the company’s commitment to full compliance with federal laws and is applicable to all employees. Prosecutors should also look at the design, comprehensiveness, and accessibility of policies and procedures meant to prevent misconduct.
3. Training and communication – Prosecutors should asses how the company ensures the policies and procedures are incorporated into the organization through periodic training and certification by relevant employees, directors, and officers.
4. Confidential reporting structure and investigation process – Prosecutors should assess whether the company has a complaint-handling process that creates a workplace atmosphere without fear of retaliation. Prosecutors should also assess the company’s process for conducting investigations of such complaints, ensuring the appropriate personnel are involved, investigations are completed timely, and the appropriate follow-up and discipline are considered.
5. Third-party management – Prosecutors should assess the company’s understanding of the qualifications and associations of third-party partners, including third-party partners’ reputations and relationships with foreign officials.
6. Mergers and acquisitions – Prosecutors should assess whether a company gives appropriate scrutiny to its acquisition targets, is able to effectively enforce its internal controls on targets, and is able to remediate any misconduct.

III. Is the corporation’s compliance program being implemented effectively?

Prosecutors should ensure that a compliance program is not just a “paper” program. In addition, prosecutors should determine whether a corporation has the appropriate staff “to audit, document, analyze, and utilize the results of the corporation’s compliance efforts.”⁵ Factors prosecutors should consider include:

1. Commitment by senior and middle management – Prosecutors should determine to what extent senior and middle management have clearly articulated the company’s ethical standards and demonstrated, by example, adherence to these standards.
2. Autonomy and resources – Prosecutors should evaluate how the compliance program is structured. Additionally, prosecutors should determine whether a company has the appropriate personnel and resources, including whether there is sufficient seniority in the organization; sufficient resources to effectively complete audits, documentation, and analysis of the compliance program; and sufficient autonomy from management, including direct access to the board of directors or board’s audit committee.
3. Incentives and disciplinary measures – Prosecutors should determine whether the company has clear disciplinary procedures in place, enforces them consistently, and ensures procedures match the violations.

IV. Does the corporation’s compliance program work in practice?

Determining whether a company’s compliance program was working effectively at the time of any offense is an extremely difficult task for prosecutors. It is important to note that the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense. Thus, prosecutors should consider the following:

1. whether and how the misconduct was detected;
2. what investigation resources were in place to investigate suspected misconduct; and
3. the nature and thoroughness of the company’s remedial efforts.

In determining whether a company’s compliance program is working effectively at the time of a charging decision or resolution, prosecutors should consider:

1. whether the program evolved over time to address existing and changing compliance risks; and
2. whether the company undertook an adequate and honest root-cause analysis to understand both what contributed to the misconduct and the degree of remediation needed to prevent similar events in the future.

V. Implications

Corporations are encouraged to use this newly issued guidance as a tool in evaluating the effectiveness of their own compliance programs, and, where appropriate, enhance these programs in line with the guidance to further mitigate the risk of criminal penalties in the event misconduct does occur.

To view the full text of the guidance document, visit https://www.justice.gov.

1. Justice Manual 9-28.300.
2. Justice Manual 9-28.300 (citing Justice Manual 9-28.800 and Justice Manual 9-28.1000).
3. The guidance notes that the sample questions and topics are not a checklist or formula, and in some cases may not even be relevant.
4. Justice Manual 9-28.800.
5. Id.

 
Client Alert 2019-121