The U.S. Department of Justice recently released a comprehensive guidance document entitled “Evaluation of Corporate Compliance Programs.” The guidance document will assist federal prosecutors to make decisions about whether and to what extent a company's compliance program was effective for the purposes of determining (1), whether criminal charges should be filed against the company; (2), whether and in what amount a fine should be levied against the company; and (3), whether a monitor, or some other compliance obligation, should be imposed on the company. The guidance document offers valuable insight for compliance professionals and reinforces the fact that prosecutors will assign significant weight to compliance programs when determining whether to charge, fine, or impose monitorships on companies that have engaged in wrongdoing.

While noting that DOJ does not use a “rigid formula” to assess the effectiveness of a company's compliance program, the guidance document lays out three “fundamental questions” that a prosecutor should answer:

First: Is the Compliance Program Well-Designed?

Prosecutors should first make a threshold determination about whether a company's compliance program is appropriately designed to detect the types of misconduct that are most likely to occur in the company's line of business. Prosecutors should also examine a company's policies and procedures to ensure that they address key compliance risks and that they are effectively communicated to employees through regular trainings. In addition, prosecutors are instructed to determine whether a company has an “efficient and trusted” system for the confidential reporting of potential violations, as well as for investigating such reports. Finally, prosecutors should determine whether a compliance program includes procedures for performing meaningful due diligence on its third-party business partners and/or acquisition targets.

Second: Is the Compliance Program Implemented Effectively?

Even a well-designed compliance program can be unsuccessful if it is implemented incorrectly. Thus, prosecutors are instructed to determine whether a company's compliance program is “implemented, reviewed, and revised … in an effective manner.” In order to do so, prosecutors should first determine whether management has clearly articulated the company's ethical standards, demonstrated adherence to these standards, and encouraged employees to follow them. Prosecutors should also evaluate whether the employees who are responsible for compliance have sufficient experience, seniority, resources, and autonomy. Finally, prosecutors should assess what happens after compliance issues are detected—that is, whether the company has disciplinary procedures in place, whether these procedures are consistently and effectively enforced, and whether the company's compliance program is adapted or revised, as necessary.

Third: Does the Compliance Program Work In Practice?

One of the most difficult things for a prosecutor to do after misconduct has occurred is to try to determine whether a compliance program was working effectively, especially if the misconduct was not immediately detected. The guidance document notes that “the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense.” In order to assess whether a compliance program was effective at the time that misconduct occurred, prosecutors should consider, “whether and how the misconduct was detected, what investigation resources were in place to investigate suspected misconduct, and the nature and thoroughness of the company's remedial efforts.” Prosecutors should also consider whether and how a company's compliance program “evolved over time to address existing and changing compliance risks.” Prosecutors are also instructed to consider any remedial actions taken by a company in the wake of the discovery of misconduct, including disciplinary actions against violators.

Compliance professionals and company management would be wise to pay attention to DOJ's new guidance. The guidance document is easily the most detailed articulation of how DOJ will analyze corporate compliance programs when determining whether criminal charges, fines, or monitorships are warranted. And it is a reminder to companies of the ever-increasing emphasis that DOJ places on compliance. As Assistant Attorney General Brian Benczkowski noted in a speech announcing the issuance of the guidance document: “The importance of corporate compliance cannot be overstated.”

Notably, the guidance document is instructive not only for those companies that find themselves in DOJ's crosshairs, but also for those companies who are not currently under investigation but are looking to build an effective compliance program that will be viewed favorably in the event of a future investigation. Companies should make every effort to design compliance programs that comport with the factors laid out in the guidance document, and they must recognize that compliance programs should be adapted over time in order to respond to changes in a company's business.

Mary P. Hansen, co-chair of the Drinker Biddle's white collar defense and corporate investigations practice, represents clients in connection with investigations and litigation. She also assists clients with internal investigations and compliance and prevention strategies. Peter W. Baldwin, a former federal prosecutor, defends clients facing white-collar criminal and internal investigations, securities enforcement actions, cybersecurity issues, and other complex civil and criminal litigation matters.