New DOJ guidance on corporate compliance programs focuses on results

The Criminal Division of the DOJ published expanded guidance on April 30 discussing the factors prosecutors should use to determine whether a company under investigation for misconduct will be regarded as having an effective compliance program. The April guidance builds on and amplifies the DOJ’s February 2017 list of questions and criteria for corporate compliance programs. 

The new April guidance makes crystal clear that “[p]rosecutors are instructed to probe specifically whether a compliance program is a paper program or one implemented, reviewed, and revised, as appropriate, in an effective manner.(emphasis added)”  And, the new guidance instructs prosecutors to “assess whether the company has established policies and procedures that incorporate the culture of compliance into its day-to-day operations. “ In other words, does the program actually work and is it operationalized throughout the organization? It’s not enough to have a Code of Conduct, training, hotline and policies. Prosecutors must ask whether these elements influence employee behavior and prevent misconduct.

The April guidance starts with three fundamental questions about all programs:

1.  Is the corporation’s compliance program well designed?

2. Is the program being applied earnestly and in good faith… is the program being implemented effectively?

3.  Does the corporation’s compliance program work in practice?

As noted, the new guidance emphasizes impact as the key criteria determining program effectiveness.  For example, with respect to training, it instructs prosecutors to examine whether a program is “disseminated to, and understood by, employees in practice (emphasis added) in order to decide whether the compliance program is truly effective.” The guidance gets granular by further instructing prosecutors to assess “whether the company has relayed information in a manner tailored to the audience’s size, sophistication, or subject matter expertise” when evaluating training.

It also makes clear that prosecutors must evaluate if a company

has engaged in meaningful efforts to review its compliance program and ensure that it is not stale. Some companies survey employees to gauge the compliance culture and evaluate the strength of controls, and/or conduct periodic audits to ensure that controls are functioning well.

Specifically, evaluating ethical culture as part of program improvement is no longer optional. Prosecutors are instructed to ask:   

How often and how does the company measure its culture of compliance? Does the company seek input from all levels of employees to determine whether they perceive senior and middle management’s commitment to compliance? What steps has the company taken in response to its measurement of the compliance culture?

The April guidance’s emphasis on results, outputs and operationalizing compliance programs is consistent with our research. Our annual program effectiveness reports evaluate E&C programs based on how they impact their organizations’ operations — and not whether they satisfy a checklist of criteria. The continuing sexual harassment and corporate misconduct scandals illustrate the limitations of paper programs that lack traction when it comes to preventing or dealing with misconduct. 

Too many programs still have policies laden with jargon and complexity that the average employee, particularly those for whom English is a secondary language, has difficulty understanding much less following. 

_____

Susan Divers, pictured above, is a senior advisor with LRN Corporation and has more than 30 years experience in the ethics and compliance area, including serving as the Chief Ethics and Compliance Officer of a Fortune 500 corporation. She can be contacted here. 

LRN’s 2019 Program Effectiveness Report can be viewed here.