New guidance issued by the U.S. Department of Justice (DOJ) is the latest confirmation of the importance of implementing a robust compliance program that is not simply well-designed, but also effective. Issued on April 30, 2019, and titled "Evaluation of Corporate Compliance Programs," DOJ's latest guidance for its Criminal Division builds on prior guidance that encouraged prosecutors to assess the adequacy of corporate compliance programs with respect to charging, sentencing, and plea and settlement decisions. The new guidance reiterates three "fundamental questions" a prosecutor should ask:

  1. "Is the corporation's compliance program well designed?" 
  2. "Is the program being applied earnestly and in good faith?" In other words, is the program being implemented effectively?  
  3. "Does the corporation's compliance program work" in practice?

As this latest guidance makes clear, companies have a strong incentive to maintain an effective compliance program. Most importantly, these programs must be fully implemented, account for a company's changing business, and actually operate effectively. This requires sufficient resources and attention, updating, and periodic auditing and testing to ensure that a compliance program is evolving to account for a company's changing business conditions and risks.

The guidance provides a list of subsidiary topics and questions that may inform prosecutors' evaluation of the adequacy, implementation, and functioning of a compliance program. In Section I, concerning program design, the guidance directs prosecutors to examine the "comprehensiveness of the compliance program" for clear messaging regarding a company's intolerance of misconduct and thorough integration of compliance policies and procedures into ongoing corporate operations. Section II, regarding compliance "implementation," encourages prosecutors to analyze whether a compliance program has been put in place "in an effective manner," with adequate resources devoted to ensuring that staff will "audit, document, analyze, and utilize the results of the corporation's compliance efforts" and that employees are adequately informed of the program. Evidence of ethics and compliance commitment by senior leaders and middle management stakeholders, the autonomy and resources of compliance personnel, and the establishment of meaningful incentives for compliance—as well as disincentives for non-compliance—all are relevant to DOJ's implementation inquiry. Finally, Section III of the guidance directs prosecutors to evaluate "whether a company's compliance program is working effectively." Among other factors, prosecutors may consider evidence of a company's "continuous improvement, periodic testing, and review" of compliance systems, the existence of a "well-functioning and appropriately funded mechanism" for timely investigating alleged misconduct, and the extent to which a company is able to conduct a "root cause analysis" of any identified misconduct, accompanied by appropriate remediation measures.

Well-meaning intentions are not enough for a compliance program to act as a shield in the event of a subsequent government investigation. DOJ's latest guidance on corporate compliance reflects the realities that compliance programs must be appropriately tailored to address particular, foreseeable risks, and that "[e]ven a well-designed compliance program may be unsuccessful in practice if implementation is lax or ineffective." Although the guidance's sample topics and questions "form neither a checklist nor a formula" for prosecutorial decision-making, they emphasize consistent themes of meaningful program implementation and operational testing designed to probe whether a company has created an "effective" versus merely a "paper program." Companies will do well, in light of this guidance, to commit the necessary focus and resources toward the ongoing oversight and auditing of compliance programs, including well after particular policies and procedures are promulgated.

One way to test a compliance program is to ask the questions set forth in the DOJ guidance with regard to a company's existing compliance program; the answers may go a long way toward identifying areas in which the implementation and functioning of a compliance program can be improved. An approach that prioritizes ongoing refinement of compliance programs will not only help companies to identify and address issues in the first instance, but also—as this latest DOJ guidance makes clear—serve companies well should the day come when a compliance issue draws the attention of DOJ.  

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.