By Sarah Hines

In April 2019, the United States Department of Justice (DOJ), Criminal Division, issued a guidance document entitled “Evaluation of Corporate Compliance Programs.” This guidance updates standards the DOJ utilizes to investigate, charge and negotiate criminal charges related to corporate crimes.

Although the DOJ recognizes that each company has its own set of unique risks, its investigations often include three common questions in assessing the effectiveness of a company’s corporate compliance program.

1. Is the corporation’s compliance program well designed?

In determining if a corporation’s compliance program is well designed, a DOJ prosecutor will examine the comprehensiveness of the compliance program. That is, does the program convey intolerance for misconduct? Do policies and procedures integrate into the company’s operations and workforce? Designing a good compliance program, at a minimum, should consider the following:

• Risk Assessment: How the company has identified, assessed and defined its unique set of risks and what the compliance program does to consider and address those risks. This not only requires a company to develop a risk assessment, but also requires that company to periodically reevaluate its risks and update its risk assessment profile.
• Policies and Procedures: Does the company have a code of conduct prioritizing commitment to compliance with all relevant state and federal laws? Has the company established policies and procedures integrating a culture of compliance into daily operations? The code of conduct as well as policies and procedures should be accessible to all employees, officers and board members.
• Training and Communications: Employees, officers and board members should ideally receive training on an annual basis to ensure its policies and procedures are integrated into the company. Training should ideally cover prior compliance incidents or high-risk areas and should direct employees where to obtain advice as concerns arise.
• Confidential Reporting Structure and Investigation Process: Does the company have a way for employees to anonymously/confidentially report suspected or actual misconduct? Does this reporting structure protect employees from retaliation? When a complaint arises, how does the company ensure investigations are independent and appropriately conducted?
• Third Party Management: A company should ensure contract terms exist with third parties that specifically describe services performed, reflect a fair compensation and consider appropriate actions for misconduct.
• Mergers and Acquisitions: A company should perform due diligence prior to merging with or acquiring another organization that evaluates corruption or misconduct. During the M&A process, compliance must be integrated into the arrangement.

 

2. Is the program being applied earnestly and in good faith (i.e. effectively)?

The DOJ points out that well-designed compliance programs may be unsuccessful in practice if implementation is ineffective. Applying a compliance program should include the following considerations:

• Commitment by Upper Management: The company’s top leaders often set a tone of compliance that trickles down to the rest of the company. Senior leaders’ words and actions that promote compliance as well as oversight and remediation efforts foster a culture of compliance throughout the company.
• Autonomy and Resources: Does a company’s compliance function have the ability to address compliance concerns? Does the compliance function have sufficient resources and autonomy from management? Can the compliance function report directly to the board?
• Incentives and Disciplinary Measures: A company should establish clear disciplinary procedures for non-compliance. These procedures should be enforced consistently across the company in a manner that ensures disciplinary actions are compatible with violations.

 

3. Does the organization’s compliance program work in practice?

Companies should respond to prior misconduct and proactively assess new risks to make improvements to its compliance program as necessary. During investigations, DOJ prosecutors consider how companies’ compliance programs evolve and develop over time to address existing and changing compliance risks. The following factors contribute to a prosecutor’s determination if a compliance program “works in practice:”

• Continuous Improvement, Periodic Testing, and Review: Of course, a company changes over time along with the environment in which it operates. Companies should periodically review their compliance programs to ensure effectiveness. Internal audits, if designed with appropriate frequency and in appropriate scope, may help a company address problems proactively.
• Investigation of Misconduct: Does a company have a timely and thorough process for investigations of misconduct? Does a company document its response to investigations along with any disciplinary or remedial actions?
• Analysis and Remediation of Any Underlying Misconduct: A company should conduct root cause analyses of misconduct to remediate any causes of misconduct.

With the new DOJ guidance, companies have stronger insight into what DOJ prosecutors consider in determining a compliance program’s effectiveness and integration into a company’s operations.

Companies should consider capitalizing on this insight by reviewing their own compliance programs to ensure consistency with DOJ considerations. As Benjamin Franklin once said, “An ounce of prevention is worth a pound of cure.”

-Sarah Hines is an associate in the Lexington office of McBrayer, where she focuses her practice on healthcare law, compliance and administrative law.