DOJ updates guidance on evaluating the effectiveness of corporate compliance programs

On April 30, 2019, the U.S. Department of Justice (DOJ) released updated guidance detailing how prosecutors will evaluate corporate compliance programs in charging and resolving criminal cases. The new guidance document, titled “Evaluation of Corporate Compliance Programs,” expands on prior guidance regarding the topics and questions prosecutors weigh when determining the effectiveness of a company’s compliance program in an enforcement action.  Under the new guidance, the fundamental questions prosecutors will ask when evaluating a company’s compliance program are:

1. Is the compliance program well-designed? The guidance for this question focuses on several key functions of a well-designed compliance program, including proper risk assessments, comprehensive policies and procedures, effective training and communication of requirements to employees and staff, third-party management, an efficient confidential reporting structure and investigation process, and proper due diligence of the company’s business partners.

2. Is the program being applied earnestly and in good faith? This question focuses on features necessary for an effective implementation of the compliance program, including commitment by senior and middle management to implement a top-down culture of compliance, a structure that provides sufficient personnel and resources for compliance functions, and an establishment of incentives for compliance and discipline for non-compliance with the program.

3. Does the compliance program work? This question evaluates whether a program was working effectively at the time the underlying offense occurred. The new guidance notes that “the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense.” Instead, the guidance recommends that prosecutors evaluate several metrics to determine efficacy of the compliance program, including the program’s capacity to improve and evolve in response to new risks, the ability of the program to timely and thoroughly investigate allegations of misconduct, and the program’s prior remediation of underlying misconduct.

The DOJ’s updated guidance provides a clear picture of the agency’s process for evaluating compliance programs. Companies should assess and review their compliance programs to ensure they are prepared to prevent and detect misconduct.