Hui Chen, compliance consultant, and Carrie Penman, chief compliance officer of NAVEX Global.

The most significant change to the U.S. Department of Justice's new corporate compliance guidance is that it now applies to the entire criminal division and not just the fraud section, according to Hui Chen, the compliance attorney who authored the original guide two years ago for the section.

“That means its set of questions is recognized as a useful tool that's relevant to all DOJ divisions that prosecute corporate cases,” Chen told Corporate Counsel in a recent interview, after the DOJ released an updated version of her guide last week.

Chen was hired as the DOJ's first and only contract compliance counsel in September 2015 to offer guidance to corporations and fraud prosecutors on how to evaluate a compliance program. She left the job in June 2017. A former federal prosecutor, she also has strong experience in-house, including as the former head of compliance for Standard Chartered Bank, assistant general counsel at Pfizer Inc. and a senior attorney at Microsoft Corp.

The questions she referred to as a useful tool are generally considered key to evaluating any compliance program. The questions are:

• “Is the corporation's compliance program well-designed?”
• “Is the program being applied earnestly and in good faith?”
• “Does the corporation's compliance program work” in practice?

“I would encourage companies not to obsess about these questions,” Chen said. “If they obsess half as much about their compliance programs, they would never have to worry about answering these questions.”

Chen said she has “seen companies that devoted literally no resources to a compliance program, and what little they did devote was spent on trying to answer these questions. If that's your approach, you already failed.”

She suggested using the questions as a reference knowing that it is one way a program can be evaluated. “Ask these questions of yourself, and don't wait for an investigator to ask,” she said.

Chen explained, “Companies need to figure out their answers, why they chose those answers, and if they are comfortable with that. That's my message ever since we released the first version and it hasn't changed.”

She called the new guidance “much as before but with a lot more packaging.” Her sentiments echoed parts of a May 6 column by Houston attorneys Ryan McConnell and Stephanie Bustamante, of the R. McConnell Group, which called it “Version 2.0 [that] should probably be 1.1.”

Chen added the guidance can provide structure for an investigation and it's “not superfluous. Don't lose sight that at the core of it, it is trying to figure out did your program work and will your program work going forward. That's all it is.”

The effectiveness of a compliance program, she added, informs the DOJ's charging decisions as well as whether or not to impose an independent monitor.

Another compliance veteran, Carrie Penman, the chief compliance officer and senior vice president of NAVEX Global Inc., said she saw the new guidance as an evolution from Chen's original document. “But I don't think it takes us in any type of different direction,” she agreed.

Penman said she sensed a stronger emphasis on a corporation's detection of potential issues. “There is a focus on the organization's ability to detect misconduct, and on building that into its risk assessment,” she said.

Penman also found that the new guidance uses the word “culture” much more prominently. “You can have all the rules and policies in the world,” Penman explained, “but if you don't have a culture that stresses following the rules” then the program is meaningless.

Besides considering the three questions about compliance programs, Penman suggested that a company heavily document its compliance efforts.

“It's likely if there's been an offense, you won't sit down with DOJ for several years, even five or six years,” she said. “How can you prove to DOJ that you had an effective program six years ago?”

Penman said her own answer was to “literally pack a box at the end of each year that had the documentation of compliance policies, procedures, programs, training—a virtual time capsule of our program.”

Chen and Penman are teaming up for a webinar “Decoding the DOJ's Guidelines” on May 15.