The Volkov Law Group has scheduled a free webinar on DOJ’s New Compliance Program Guidance for May 9, 2019, at 12 noon EST. Sign up HERE.

While I hate to start out a posting with such “mumbo jumbo” terms, I had to come up with short hand descriptions of some otherwise fairly complex and robust topics under the new DOJ Guidance.  In evaluating whether a corporate compliance program is being implemented effectively, DOJ has focused on three broad, but critical topics: (1) Commitment by Senior and Middle Management; (2) Autonomy and Resources; and (3) Incentives and Discipline.

In these areas, DOJ is pushing the envelope and demanding greater compliance excellence.  It is no accident that DOJ is raising the bar on compliance programs – DOJ has seen first hand how companies fail to dedicate adequate resources, train their middle managers and ignore the occurrence of misconduct.  The new expectations are specifically tailored to these observations and perhaps DOJ’s frustration in the enforcement arena.

The primary principle applied by DOJ is to focus on how a company operationalizes its “well-designed” compliance program.  To define this term DOJ notes its focus on whether the compliance program is a “paper” program or one “implemented, reviewed, and revised, as appropriate, in an effective manner.  Further, DOJ will examine “whether the corporation has provided for a staff sufficient to audit, document, analyze and utilize the results of the corporation’s compliance efforts,” and “whether the corporation’s employees are adequately informed about the compliance program and are convinced of the corporation’s commitment to it.”

Commitment by Senior and Middle Management

Under this factor, DOJ has boldly stated that “it is important for a company to create and foster a culture of ethics and compliance with the law.”  To this end, DOJ specifically states “[t]he effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the top.”

To underscore this point, DOJ will examine whether senior management has “clearly articulated the company’s ethical standards, conveyed and disseminated them in clear and unambiguous terms, and demonstrated rigorous adherence by example.”  In no uncertain terms, DOJ has mandated that senior management has to not only use words but must take specific actions to demonstrate their commitment to an ethical culture. In addition, DOJ stated that it will examine how “middle management, in turn, have reinforced those standards and encouraged employees to abide by them.

When examining conduct at the top, DOJ will focus on the “words and actions” of senior leaders, and specifically, concrete actions they have taken to demonstrate leadership in the compliance program.  With respect to middle management, DOJ will determine if managers tolerated greater compliance risks in pursuit of new business or greater revenues, and whether they encouraged employees to act unethically to achieve business objective or impeded compliance personnel from carrying out their responsibilities.  DOJ’s new focus is on shared commitment by senior and middle management stakeholders (e.g. business and operational managers, human resources, finance, procurement, legal) to ensure compliance and remediation of any deficiencies.

Finally, the DOJ Guidance reiterates the importance of compliance expertise on the board of directors and focuses on whether the board and/or external auditors have held private or executive sessions with compliance and control functions.  In this area, DOJ intends to review the information that the board of directors and senior management examine in their oversight of the compliance program.

Autonomy and Resources

DOJ’s Guidance correctly focuses on the compliance staff’s authority and stature in the organization, as well as the structure of the compliance program.  DOJ reiterated its focus on the sufficiency of personnel and resources dedicated to the compliance program, including the seniority of the compliance staff in the organization; sufficient staff  to audit, document and analyze the compliance program functions, and autonomy from management, such as direct access to the board or the board’s audit committee.  DOJ noted that the structure, autonomy and sufficiency of staff and resources will vary depending on the size of the organization.

In recognition of the key role that internal audit plays in a compliance program, DOJ will now evaluate whether the “internal audit functions are conducted at a level sufficient to ensure their independence and accuracy,” as an indicator of whether compliance personnel are in fact empowered and positioned to “effectively detect and prevent misconduct.”

DOJ also will determine whether the compliance staff has sufficient resources and “the quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk, the authority and independence of the compliance function and the availability of compliance expertise to the board.”  To emphasize this latter point, DOJ will examine whether the directors establish an information and reporting system to provide management and the board with timely and accurate information.

As to the structure of the program, DOJ will examine who the chief compliance officer reports to in the company, whether to a business function, general counsel or CEO and/or board.  In addition, DOJ will determine if compliance staff operate exclusively on compliance issues or have other responsibilities (e.g. ethics and compliance ambassadors).  Finally, DOJ will seek an explanation for why the company structured the compliance program a particular way.

With respect to seniority and stature, DOJ will compare the compliance staff to other strategic functions in the company on the basis of seniority, compensation, rank, title, reporting line and access to key decision-makers.  Further, DOJ will determine the level of turnover for compliance and other control functions, and the role of compliance in strategic and business decisions.  In this regard, DOJ will inquire whether any transactions were stopped, modified or further scrutinized to address compliance concerns.

In terms of board reporting, DOJ will examine how often the compliance and relevant control functions report to the board and/or audit committee, whether senior management is present at the meeting and the company ensures independence of the compliance and relevant control personnel.

Finally, to the extent a company outsources compliance functions, DOJ will examine how the relationship is structured, what tasks are taken on by an outside provider, what level of access to information the outside provider has, and who is responsible for ensuring the quality and accuracy of the outside provider’s work.

Incentives and Discipline

Under this category, DOJ will examine the company’s disciplinary procedures, whether they are applied consistently across the organization, and whether the procedures are commensurate with the violations.  As part of its disciplinary system, a company has to communicate that unethical conduct will not be tolerated and have swift consequences, regardless of the position or title of the employee.

In this area, DOJ will focus on who is responsible for making disciplinary decisions, how such procedures work for different types of misconduct, and whether the reasons for a disciplinary action communicated to employees.  In reviewing a company’s transparency, DOJ will examine if the company has investigation-legal reasons for restricting information or pre-textual reasons to protect the company from whistleblowing or outside scrutiny.

As an example, DOJ cites the recent trend of companies that publicize disciplinary actions internally, where appropriate, and the deterrent value of such communications.  Along with disincentives, DOJ noted that companies have beenusing positive incentives through personnel promotions, rewards and bonuses for improving a compliance program or demonstrating ethical leadership.  In particular, DOJ observed that some companies have even made compliance a means of career advancement and/or a metric for management bonuses.