The Department of Justice's new guidance regarding the appointment of corporate monitors could significantly change the dynamics for companies dealing with the important element of corporate compliance. Although the new guidance is couched as simply supplementing prior DOJ guidance in the “Morford Memo,” it could be a difference maker—it requires prosecutors to carefully weigh the monetary costs, as well as the burdens to a company's operations, in deciding whether a monitor is required as a condition of a negotiated settlement with DOJ and, if necessary, to tailor the scope of the monitorship as narrowly as possible. The policy shift therefore creates opportunities for institutions to potentially avoid the imposition of a monitor if they redouble compliance efforts before winding up in DOJ's cross-hairs. This article explores key takeaways to consider as a result of the DOJ's new approach.

Cost-Benefit Analysis in the New Guidance

The new guidance was unveiled last month by Brian Benczkowski, the assistant attorney general in charge of DOJ's criminal division who supplemented the Morford Memo. This latest guidance explicitly states that the only time a monitor should be imposed is where there is a demonstrated need for a monitor, and where there is a clear benefit that will outweigh the projected costs and burdens of the monitorship. Although the Morford memo recommended that prosecutors consider the potential benefits versus the cost and burden of imposing a monitor, the new guidance articulates more detailed factors that should be considered when making that cost-benefit analysis. Specifically, the new guidance states that in evaluating the potential benefits of a monitor, prosecutors should consider:

• whether the underlying misconduct involved the manipulation of corporate books and records or the exploitation of an inadequate compliance program or internal control systems;
• whether the misconduct at issue was pervasive across the business organization or approved or facilitated by senior management;
• whether the corporation has made significant investments in, and improvements to, its corporate compliance program and internal control systems; and
• whether remedial improvements to the compliance program and internal controls have been tested to demonstrate that they would prevent or detect similar misconduct in the future.

In addition, whenever the misconduct at issue occurred under different corporate leadership or within a compliance environment that no longer exists within the company, the new guidance directs prosecutors to weigh the following factors before requiring the imposition of a monitor:

• whether the changes in corporate culture and/or leadership are adequate to safeguard against recurrence of misconduct; and
• whether adequate remedial measures were taken to address problem behavior by employees, management, or third party agents, including the termination of business relationships and practices that contributed to the misconduct.

Finally, with regard to the cost side of the equation, the new guidance states that prosecutors should not only consider the projected monetary costs, but should also make sure that the proposed scope of the monitorship “is appropriately tailored to avoid unnecessary burdens to the business's operations.”

Take-Aways From the New Guidance

The new guidance makes it clear that remediation and compliance remain extremely important for the DOJ, but that the DOJ will seriously weigh the potential cost and burden to an institution's operations in deciding whether a monitor is necessary. As a result, the new guidance creates opportunities for institutions who find themselves sitting across the table from DOJ attorneys to make meaningful arguments against the imposition of a monitor. However, even before that stage, the new guidance shows how important it is for institutions to establish and maintain a robust compliance program that strives to prevent misconduct in the first place, and if misconduct is discovered, to double down on efforts to improve compliance in the relevant business unit, industry sector, or across reporting lines within the institution.

The new guidance creates the opportunity to avoid the imposition of a monitor for those institutions that take compliance seriously and proactively act to improve it. Accordingly, any institution that is evaluating its compliance program and/or conducting an internal investigation of potential wrongdoing should engage in a rigorous analysis of its operations to assess potential compliance risks in order to prevent misconduct or detect the areas in which the potential misconduct occurred. This analysis involves the following:

• Performing a risk assessment to identify legal, financial, operational and brand impacts. An assessment also serves as a vehicle to help allocate resources to mitigate these risks. Institutions should focus the scope of its assessment on identifying existing or potential risks of legal or policy non-compliance because these can often lead to debarment or other adverse business consequences.
• Documenting procedures for responding to and preventing misconduct. Institutions should formalize the processes for how it prevents and responds to compliance matters, and these processes should be reviewed frequently to ensure they remain relevant to the institution's current operating model and strategic priorities.
• Embedding compliance in business operations. Using technology and enhanced internal oversight can help manage risk and integrate compliance within overall business processes. The act of integrating compliance within business processes and initiatives is only one step; being able to test and monitor what's working or not working is equally important. Insights gained through testing and monitoring can help identify compliance gaps and ways in which the compliance framework should be supplemented or adjusted.
• Anticipating emerging compliance matters. Staying ahead of potential legal and regulatory changes enables institutions to educate and incentivize collaboration among its employees to comply with regulatory requirements.
• Educating and communicating compliance expectations to internal and external stakeholders. Consistent training and communication helps articulate compliance expectations, creates transparency, and establishes clear ownership of risks by individuals or business units.
• Understanding third party dependencies. Identifying and monitoring third party agents who are critical to the institution, coupled with insights gained from risk assessment, helps establish a proactive approach to monitoring the activities of third parties who act on behalf of the institution in order to get ahead of potential missteps.
• Establishing and preserving a strong ethical culture at the top. Executives and other senior leaders set the example for all employees as to how to conduct business appropriately. The institution's leaders are responsible for reinforcing the principles of always acting with integrity and speaking up in the face of compliance lapses or risks. Top management also has to take responsibility for preventing retaliation against employees who report compliance issues, and taking appropriate corrective actions if misconduct occurs.

The approach for tackling these activities is not “one size fits all,” and an institution's focus should be on its greatest risks and impacts to its strategy. It is imperative that an institution ensures that its compliance efforts are sustainable and agile enough to respond to changing commercial and operational priorities, as well as the corresponding risks and evolving regulatory landscape.

If serious wrong-doing is suspected or discovered, companies should consider hiring independent compliance counsel in order to re-work and improve compliance and controls, either in conjunction with a voluntary disclosure to the DOJ, or in the event of a DOJ investigation in the absence of self-disclosure. The new guidance shows that the DOJ values and will reward proactive compliance improvements.

Finally, institutions continue to face an increasingly complex operating environment, and a robust compliance program helps it proactively respond to new risks and misconduct. DOJ's new guidance underscores the importance of implementing and maintaining a compliance program that prevents misconduct and corporate recidivism. To not commit resources to this endeavor risks not only prosecution by the DOJ, but the imposition of a potentially costly monitor that is tasked with evaluating the institution's conformity to legal and regulatory requirements over the course of multiple years.

Amy Walsh is a partner in the white-collar investigations and compliance group at Orrick, Herrington & Sutcliffe. She served as a court-appointed monitor for a settlement between JP Morgan Chase and the U.S. Department of Justice. Sarah Foley is a compliance specialist at Orrick who evaluates, develops and implements compliance programs for multinational corporations and financial institutions.)