In April 2019, the DOJ's Criminal Division released its updated guidance document, Evaluation of Corporate Compliance Programs, intended to assist prosecutors in exercising their discretion to investigate, bring charges or negotiate plea deals or other agreements with employers. The updated guidance supplements the DOJ's original guidance issued in February 2017 and does not affect the DOJ's standards or policies but sets forth the DOJ's current approach in evaluating corporate compliance programs. The information contained in the updated guidance should be used as a roadmap for companies to better develop their compliance programs to withstand the DOJ's scrutiny.

When evaluating whether to investigate, bring corporate criminal charges or negotiate pleas or corporate agreements, the DOJ considers specific factors, including whether a corporation's compliance program was "adequate and effective" at the time of the criminal offense and at time of the charging decision and, if it was inadequate or ineffective, the corporation's remedial efforts to implement or improve a corporate compliance program to make it adequate and effective.[i] The updated guidance provides examples and considerations for prosecutors in determining whether a compliance program is adequate and effective.

According to the DOJ, prosecutors should consider three fundamental questions:

1. Is the corporation's compliance program well designed?
2. Is the program being applied earnestly and in good faith? In other words, is the program being implemented effectively?
3. Does the corporation's compliance program work in practice?[ii]

This article addresses several, but not all, of the factors presented in the updated guidance to be considered by prosecutors in responding to the fundamental questions. Companies are instructed to consult with competent counsel to evaluate the adequacy and effectiveness of their compliance programs.

Written Policy

To determine whether the compliance program is well designed, the updated guidance instructs prosecutors to first look to the corporation's policies and procedures. Companies should have policies and procedures that clearly express the company's conduct expectations and disciplinary consequences for noncompliance. Conduct expectations should address and seek to reduce the type of misconduct most likely to occur in the company's (and any relevant third party's) specific business. The policy should set forth, at a minimum, the company's commitment to comply with relevant laws. Prosecutors are instructed to assess the effectiveness of a compliance program by determining whether a company has disciplinary procedures in place and is enforcing discipline consistently and commensurate with the violation.

The policy should also contain a confidential reporting procedure and investigation process. Complaint procedures should encourage participation, provide an appropriate process for submitting complaints and ensure that a complainant will not be retaliated against. Likewise, the company should document, investigate and respond to all complaints, through properly trained and empowered personnel, and issue discipline, as necessary. An effective investigation should be adequately scoped, independent and objective.

Communication and Training

Having a well-drafted policy is only the first step. The policy and procedures should be disseminated to all employees and relevant third parties. The updated guidance instructs prosecutors to assess the steps taken by the company to ensure the policies and procedures are "integrated into the organization," through proper dissemination of the policies and effective training.[iii] Companies should distribute their policies and procedures in a manner tailored to be received and understood by all intended recipients. This may require that the company publish its policy in multiple languages and in multiple forms.

Additionally, training should be comprehensive and appropriate for the audience. For example, training provided to senior management may differ from the training provided to nonmanagerial employees.

Effective Implementation

Equally important to having a well-designed compliance program is effective implementation of the compliance program. Prosecutors are instructed to assess whether the compliance program is just a "paper program" or one that is "implemented, reviewed, and revised, as appropriate, in an effective manner."[iv] Effective implementation requires fair and consistent administration of the compliance program. This means holding all employees accountable and ensuring that midlevel and senior management lead by example. These managers are expected to be knowledgeable about the compliance program and reinforce and encourage compliance through communication and modeled behavior. Prosecutors are instructed to consider whether companies incentivize compliance by recognizing compliant employees with promotions, bonuses and other rewards.

The final analysis is whether the compliance program is actually working in practice. If a compliance program identified the criminal misconduct and allowed for timely remediation and self-reporting, prosecutors are instructed to view this as a strong indicator that the program was working effectively. Even in cases where the compliance program did not identify the criminal misconduct, the program may still be working effectively. Prosecutors are expected to make case-by-case determinations. Some things a company can do to establish the effectiveness of its program are collect, track, analyze and use the information obtained through its reporting and investigation mechanisms to evolve its program to better address risks and remedy systemic vulnerabilities. Where improvements to the compliance program are made after undetected criminal misconduct and the company demonstrates that similar future misconduct would be prevented or detected, the DOJ is less likely to determine that future monitoring is necessary.

Conclusion

In short, a company's adequate and effective compliance program is integral to avoiding or minimizing the possibility of criminal investigations, charges and monetary penalties against a company for its employees' criminal misconduct. Companies should have well-designed, properly implemented and effective compliance programs in place. While these programs should be reviewed and revised periodically to ensure they appropriately address corporate risks, now is a good time for companies to reevaluate their policies in light of the DOJ's updated guidance.

Dana Chang Dikas, an attorney in the Fisher Phillips Dallas office, focuses her practice on representing management in all types of employment-related matters. She can be reached at [email protected]