Last week, the U.S. Department of Justice (DOJ) updated the guidance that federal prosecutors use to evaluate corporate compliance programs. Update is too strong. Consolidated is a better word. Version 2.0 (should probably be 1.1, but 2.0 sounds better).

Basically, the DOJ took the guidance they issued in 2017 (mostly recycled from long-standing deferred (DPA) and nonprosecution agreements (NPA) and supplemented it with even longer-standing guidance set forth in the U.S. DOJ's Justice Manual (formerly and more affectionately known as the U.S. Attorneys' Manual (USAM)), the U.S. Sentencing Guidelines (USSG) and various DOJ policies, such as the FCPA Corporate Enforcement Policy, that have been recently codified into the Justice Manual. It was the regulatory equivalent of Apple releasing a new iPhone with the only new feature being an updated operating system that you could download for free before the update. Yawn.

The Justice Manual is the bible for federal prosecutors. It is well-organized, comprehensive and provides guidance for prosecutors on various issues ranging from when prosecutors may bring charges (and what charges to bring) to approvals needed to execute a search warrant on a lawyer's office. It is what Attorney General William Barr used when he said there was no case to be made coming out of the Mueller report (because charges are not filed based on newspaper articles or a report—they have to be readily provable to a jury with admissible evidence). For prosecutors with tremendous discretion, it is a good road map to formulate decisions and exercise judgement (strike hard blows, but not foul ones, as in Berger v. United States, 295 U.S. 78,88 (1935)). A lot of good stuff in there that keep the wheels of justice moving.

Since the 1997 version of USAM, the Justice Manual contained corporate charging guidance (which now includes three questions to evaluate corporate compliance programs). This language ensured that federal prosecutors adequately considered corporate issues and the 1992 Federal Sentencing Guidelines Manual (Chapter 8 of the USSG). This makes sense because many federal prosecutors (including, at one time, one of your authors) are luddites and the Justice Manual made charging decisions easier for them by putting all the information they need in one place. Charging wire fraud? The Justice Manual has you covered. Drafting a search warrant? Check. It is all there. Much like the Resource Guide to the U.S. Foreign Corrupt Practices Act (FCPA) cobbled together prior cases and FCPA information, the “new” DOJ compliance guidance consolidated its 2017 guidance with the Justice Manual and various other guidance.

As an aside, back in 2005, Russell Mokhiber at Corporate Crime Reporter was one of the first one to really collect DPAs and NPAs (Crime Without Conviction: The Rise of Deferred and Non Prosecution Agreements). (Uber reporter Corporate Counsel Sue Reisinger was also one of the pioneers in this area). Baker McKenzie lawyer Larry Finder and one of your authors took it to the next level by collecting the universe of agreements and pointing out that compliance programs are routinely a part of the agreements as an addendum (https://www.nytimes.com/2008/01/10/world/americas/10iht-10justice.9119765.html). The New York Times covered these efforts here: https://www.nytimes.com/2009/02/07/business/07prosecutions.html?mtrref=www.google.com and https://www.nytimes.com/2008/01/10/washington/10justice.html?mtrref=www.google.com. At the time, media and Congress were interested in DPAs, including whether the remediation in some of the agreements was sufficiently tied to the criminal conduct and, separately, examining the relationship between DOJ prosecutors and corporate monitors who received millions of dollars, including how monitors were chosen. Separate guidance to DOJ prosecutors came out on both of those issues. Years later, law firms and law schools routinely update statistics on DPAs/NPAs. No one had collected DPAs/NPAs in a systematic way before Russell (he aided what Finder and one of your authors did immensely—he even interviewed us a couple of times!). When the DOJ sought to outline what good looks like for compliance with the first iteration of the fraud section's guidance for evaluating corporate compliance programs in 2017, it makes sense that it used what worked in the DPAs/NPAs. Incorporating the Justice Manual in version 2.0 released last week makes perfect sense. Maybe in some small way, we have Russell to thank for the DOJ guidance.

In the spirit of consolidation and celebration of 2.0, we have outlined the differences between the DOJ's 2017 and “new” 2019 guidance (with citations) in a handy chart. We've also updated how this guidance maps to various corporate compliance frameworks. Readers can use the information in these links to map their entire compliance program against the applicable regulatory frameworks. It's a good starting point. But it won't help you answer the three questions the ”new” DOJ guidance pulled from the Justice Manual:

• “Is the corporation's compliance program well-designed?”
• “Is the program being applied earnestly and in good faith?” In other words, is the program being implemented effectively?
• “Does the corporation's compliance program work” in practice?

See JM 9-28.800 Principles of Federal Prosecution of Business Organizations, Justice Manual.

For those, you have to take a deeper look into your compliance program to see if what you put on paper is working. This involves figuring out the business and whether the program is embedded and part of the business' DNA. And it looks different for every company. You wouldn't want the government to tell you how to do that. But you can bet that prosecutors will want to know the answer to those three questions.

Ryan McConnell and Stephanie Bustamante are lawyers at R. McConnell Group—a compliance and investigations boutique law firm in Houston, Texas with Fortune 500 clients across the globe. McConnell is a former assistant U.S. Attorney in Houston who has taught criminal procedure and corporate compliance at the University of Houston Law Center. Bustamante's work at the firm focuses on risk and compliance issues in addition to assisting clients with responding to compliance failures. Send column ideas to [email protected].