How Would Your Compliance Program Stack Up?

If you find your company in the unenviable cross-hairs of the Department of Justice (DOJ), there are factors that can help or hinder you as prosecutors consider your case.  A manual by the DOJ describes specific factors that prosecutors should consider when investigating a corporation, determining whether to bring charges, and negotiating plea or other agreements. These factors include “the adequacy and effectiveness of the corporation’s compliance program at the time of the offense, as well as at the time of a charging decision” and the corporation’s remedial efforts “to implement an adequate and effective corporate compliance program or to improve an existing one.”  So, will your compliance program be a help or hindrance for your company? 

On June 1, the DOJ released new guidance on considerations surrounding the efficacy of the compliance program and what questions prosecutors should ask. Compared to the previous guidance from April 2019, there is not completely different information, but important nuances and themes.  

At a recent FCPA conference, Brian Rabbit of the DOJ described the new guidance as additions and made tweaks following input from companies and outside counsel. For instance, lessons learned were added under risk assessment, as a reminder to take information already available from your program that occurred throughout the year, as well as issues that may have arisen for competitors. Also, there the new guidance significantly focuses on ensuring the compliance program is supported and adequately resourced.  

This can be a challenge, particularly now, to continue to maintain adequate resources as budgets are cut. Given the continuing issues with third parties -- including court cases and settlements -- the guidance focuses on the ongoing nature of the third-party due diligence, needing to occur not only at onboarding but throughout the relationship at intervals reflecting the fluidity of the relationship. Likewise, there is a focus on due diligence on M&A transactions – specifically, that the due diligence should be pre- and post- acquisition, and ensuring integration occurs. Also, in understanding any program is only as good as the people who live with it, there is more emphasis on the training of employees, their engagement in the training, and how it impacts their behavior. 

Below are the areas prosecutors will be considering and questions they will be asking.  Answer these questions for yourself before they do:

• Proof that Compliance Program is Not Stagnant: Building, Learning and Supported
  • “Lessons learned” Section Added Under Risk Assessment
    • Prosecutor considerations:
      • Periodic reviews with adjustments based upon findings
      • Were changes considered, if not implemented
      • Findings from companies in similar industries
  • Question not only implementation effectiveness, but is it resourced adequately and empowered?
    • Amount of resources and how are they trained?
    • Are top and middle management committed?
    • How did you decide to structure your program?  Have the reasons changed?
    • Data analytics – are you using them to do more with less? 
    • Is there consistency in investigation and the result? 
• Third Party Risk
  • Not a one-shot consideration
    • Does assessment and management occur at onboarding or, rather, over the lifespan of the relationship?
    • Is the continuing business rational understood and risks understood?
• M&A Activity – Not Just a Process but Understanding Pre-Acquisition Diligence and Post Acquisition Integration
  • Is there a process for timely and orderly integration?
  • Was pre-acquisition due diligence performed?
• Preparing the Company’s Most Valuable Resource – the Employees
  • Are the policies and procedures not only accessible, but do you access the tracking? 
  • Suggestions of shorter, targeted training sessions and can the employees ask questions?
  • Impact on Employees
    • What does the Company do if employees fail all/part of testing?
    • How does the training impact behavior by employees?
  • Test the hotline

Knowing and understanding the most current DOJ expectations can go a long way in protecting your company financially and reputationally, should an investigation occur.