The Department of Justice (DOJ) recently updated the Evaluation of Corporate Compliance Programs (ECCP) to direct prosecutors who are considering charges or resolutions to assess how a company addresses, among other topics, disruptive technologies and AI, self-disclosure initiatives, and the compliance function’s access to corporate data. This enhanced guidance follows a pattern for ECCP amendments and reveals a trend toward an expectation of more proactive compliance efforts as a predicate for credit from prosecutors. Compliance stakeholders, therefore, can use this update as a blueprint for high-value program enhancements.

Since 2017, the ECCP has been prosecutors’ formal tool to judge compliance program adequacy. Largely presented as questions rather than prescriptions, the original ECCP provided “some important topics and sample questions that the [DOJ] … has frequently found relevant in evaluating a corporate compliance program.” In 2019, the DOJ reorganized the ECCP into three topics—program design, implementation, and efficacy—and better aligned the questions with policies and priorities. In 2020, the DOJ substantively expanded the ECCP to address the compliance function’s data use, role in M&A, and resourcing. In March 2023, the DOJ made two significant changes to address the data preservation and corporate compensation programs.

AI and Disruptive Technologies

Beginning in early 2024, the DOJ previewed anticipated ECCP changes addressing AI (defined in OBM Memo M-24-10) and new technologies. It announced the Justice AI Initiative to accelerate DOJ’s understanding and use of AI and noted the “promise” and “peril” of AI and its anticipated robust enforcement and accompanying stiffer penalties for offenses involving AI. The ECCP update, developed in consultation with compliance executives with AI expertise, examines how a company addresses these technologies in its compliance life cycle. Prosecutors will ask questions such as:

• How do the business and compliance function use technology?
• Is “management of risks related to use of AI and other new technologies integrated into” risk assessments?
• What actions is the company taking to “curb[] any potential negative or unintended consequences” and to “mitigat[e] the potential for deliberate or reckless misuse of technologies”?
• What “controls [are] in place to monitor and ensure [technologies’] trustworthiness, reliability, and use”?
  

DOJ expects a company to thoroughly inventory its use of technology—being mindful of the broad definition of AI—across the entirety of the enterprise so that the organization knows everywhere it uses AI and how it uses AI. In addition, the business should assess its exposure to the malign use of AI against it. With this context, a company is expected to assess risks associated with internal use and external misuse of technology. (A company needing guidance on an AI-focused risk assessment can look to the NIST’s AI Risk Management Framework.) The next step is the adoption of appropriate controls to mitigate these risks and proactively monitor the use of these technologies. Finally, the ECCP suggests the compliance function consider leveraging AI and other new technologies as part of its compliance work and self-assessment.

Developments in Voluntary Self-Disclosure (VSD) Initiatives

The DOJ seized upon this ECCP update to further publicize significant new policies encouraging the reporting of misconduct. 

Speak Up Programs

The ECCP’s section on whistleblower programs and protections now aligns with the Corporate Whistleblower Awards Pilot Program (CWA), announced in August 2024, and other recent VSD initiatives. Under the CWA, the DOJ provides financial rewards to non-culpable whistleblowers who report misconduct to the government. Similarly, the DOJ’s other VSD programs aim to entice self-reporting in exchange for more lenient treatment. The CWA and VSD initiatives expect robust speak up mechanisms and anti-retaliation regimes. In this regard, prosecutors will ask whether a “company encourage[s] and incentivize[s] reporting” or “chill[s] such reporting,” how a company evaluates employee comfort with reporting, and how comprehensive a company’s whistleblower and anti-retaliation training is.

The ECCP places a premium on proactive efforts to support speaking up and no longer appears to offer full credit for a purely reactive program. The ECCP now looks at what a company does to affirmatively encourage and incentivize reporting. This, coupled with the CWA, appears to be the strongest suggestion to date that the DOJ is amenable to a company providing financial rewards to its own whistleblowers who report substantiated claims. Regardless, a company cannot merely rely on reporting metrics to determine efficacy of a speak up program and must instead find other means to assess whether employees are comfortable raising concerns. Finally, this version of the ECCP includes the most directive guidance on training. No longer will the DOJ look only at a company’s training on speak up policies and mechanisms and the applicable anti-retaliation laws, prosecutors will examine whether the company trains its employees about external reporting mechanisms, like the CWA.

Mergers & Acquisitions Safe Harbor Policy

The M&A Safe Harbor Policy announced in October 2023, provides that the DOJ presumptively will decline to charge an acquiring company that voluntarily discloses and remediates, in a timely manner, misconduct discovered during pre- or post-acquisition diligence. This policy embodies the DOJ’s goal of encouraging effective diligence and integration. Relatedly, the ECCP now directs prosecutors to ask what role “compliance and risk management functions play[ed] … in designing and executing the integration strategy” and whether the integration strategy is reasonably designed “to ensure appropriate compliance oversight of the new business.”

To meet DOJ expectations, a company that engages in M&A activity should fully integrate the risk and compliance functions in its M&A processes to help with early identification, assessment, and remediation of compliance matters. Further, the company should invest in timely remediation to preserve options if misconduct is identified at an acquired company. The compliance function needs to be fully engaged to meet the M&A Safe Harbor Policy’s strict deadlines on reporting and remediation to qualify for a declination.

Compliance Access to Data

The DOJ has been increasingly focused on leveraging data in the compliance function to detect and prevent misconduct—the word “data” appears 12 times in the 2023 ECCP and more than 20 times in the 2024 ECCP. The 2024 ECCP makes clear that the DOJ will no longer ask if compliance has access to corporate data; it will ask what data compliance has access to. Accordingly, compliance should inventory available data sources across the enterprise and its access to them. The amended ECCP directs prosecutors to measure a company’s commitment to such data usage. Prosecutors will now ask questions such as:

• Do “compliance personnel have knowledge of and means to access all relevant data sources … to create efficiencies … and measure the effectiveness of … compliance programs”?
• How do “the assets, resources, and technology available to compliance and risk management compare to those available elsewhere in the company”?
  

The ECCP also clarifies that access to data alone is not sufficient; what compliance does with the data and what skilled resources are enlisted to assist with those tasks also matter. As a result, compliance needs access to staffing and other resources to permit effective use of data to assess both compliance with company policies and efficacy of the compliance program itself.

The updated ECCP reflects both the DOJ’s priorities and expanding expectations regarding compliance programs. Although the ECCP update covers additional topics, those addressed here offer opportunities for a strong return on the investment of compliance budget and effort.

David E. Carney and Edward J. Heath are partners with Robinson+Cole and focus their practices on government enforcement, internal investigations, and corporate compliance programs.