An employee anonymously reports that your company has been paying bribes to win business in a former Soviet republic. Or maybe the employee reports that the company has been defrauding a customer for years. In either situation, what will you do?

Of course you will take the report seriously and investigate it thoroughly. You will preserve documents and data, conduct interviews and, at an appropriate time, report to the board and executive management. You might decide to self-report to government regulators, and to cooperate fully with the government's investigation.

You might also ask yourself: “How can I use this crisis to make the company stronger?” A compliance crisis—even one that poses no existential threat to the company—can be used as a catalyst to strengthen your compliance program, clarify your corporate structure and reporting lines, and improve your standard operating procedures. It also might require difficult decisions regarding employees who were involved in or had knowledge of the misconduct.

Meaningful changes could mitigate another costly crisis. They could help the company reach a favorable resolution with government regulators. And they could assist the company in defending consumer class actions, products liability cases or other litigation in which plaintiffs are eager to portray the company as something other than a good corporate citizen.

When responding to a compliance crisis, ask the tough questions:

Does Our Compliance Program Stack Up?

When serious misconduct occurs, your company must carry out a thorough, top-to-bottom evaluation of your compliance program. The U.S. Attorneys' Manual, for example, instructs prosecutors to consider “the existence and effectiveness of the corporation's pre-existing compliance program” and the corporation's remedial efforts “to implement an effective corporate compliance program or to improve an existing one” when determining whether to prosecute the company or to seek an alternative remedy, such as a deferred prosecution agreement.

Before the crisis arose, your compliance program might have checked all the boxes. Perhaps you could safely say that your program contained the elements of an “adequate” compliance program. For instance, you had written policies and procedures, a designated compliance officer, training and risk assessments and so on. But maybe compliance was not truly embedded in your company's culture. Securing the budget and high-level commitment to integrate compliance into all of the company's business functions might have been difficult.

A compliance crisis presents an opportunity. You now have the board's and executive management's attention. Use it to build the compliance program your company needs.

Did Structural Issues Contribute to the Misconduct?

While you and your outside counsel take a deep dive into the facts of your crisis, you also need to pay close attention to what allowed the misconduct to happen in the first place. When deciding whether a company should receive credit for remediation efforts in Foreign Corrupt Practices Act matters, the DOJ's FCPA Corporate Enforcement Policy takes into account whether the company demonstrates a “thorough analysis of causes of underlying conduct and, where appropriate, remediation to address the root causes.”

Companies often need to revamp reporting relationships and internal operating procedures to prevent future misconduct. Additional checks and balances might be built into standard operating procedures to detect and prevent misconduct. A change in corporate structure could improve accountability. Re-tooling the sales organization's compensation structure could eliminate incentives to over promise/misrepresent the capabilities of the company's products.  And if the company's products pose potential safety risks, the company could benefit from a stand-alone group focused on the safety of the company's products from initial development through field investigations of product failures. Look at the root cause of the misconduct from all angles, and do not overlook the big picture.

Should We Clean House by Dismissing 'Bad Actors'?

The decision to “clean house” is often a difficult one. On one hand, the DOJ and other regulators will consider a company's remedial actions, including disciplinary actions against wrongdoers, when deciding what action to take. As explained in the U.S. Attorneys' Manual, “effective internal discipline can be a powerful deterrent against improper behavior by a corporation's employees.” On the other hand, the company has a business to run, and succession planning in the face of misconduct presents immense challenges, particularly when wrongdoers are senior-level employees.

If the company is considering disciplinary actions, it must address several investigation-related concerns. First, the company should refrain from dismissing wrongdoers without informing investigating authorities in advance. The company also should avoid overly broad confidentiality language in employee termination agreements that could be construed as an attempt to obstruct justice. Finally, the company needs to identify standards to apply when taking investigation-related disciplinary action. The standards might be spelled out in an employment contract, or be part of the company's ethics policy. The ethics policy, for example, might require compliance with all laws, including anti-bribery statutes, and prohibit misrepresentations of the company's products. It might also require employees to report violations of the ethics policy.  Whatever the standards, they must be clearly articulated and consistently applied when making difficult disciplinary decisions.

Despite almost daily news of headline-grabbing compliance tempests, companies too often find themselves plugging holes in the dam when faced with their own compliance issues. A compliance crisis provides an opportunity to clean house, to strengthen the company's compliance program and to take concrete steps to avoid future crises. Simply put, “Never let a good crisis go to waste.”

David N. Kelley is the co-leader of Dechert's trials, investigations and securities group. Erik W. Snapp is a partner in that practice group. Amanda Rios is an associate in the group. Kelley and Rios are both based in New York. Snapp is based in Chicago.