Corporate & Securities Blog

On April 30, 2019, the U.S. Department of Justice (“DOJ”) released new guidance detailing its evaluation of the adequacy and effectiveness of a company’s compliance program (the “Guidance”). The Guidance spells out how prosecutors examine compliance programs when deciding whether to monitor, fine or file criminal charges against a company, and we believe the 18-page document is the most comprehensive and detailed corporate compliance document that informs all businesses, whether or not party to a DOJ enforcement action. The Guidance includes a step-by-step approach to compliance, centering around three fundamental questions: Is the company’s compliance program well designed? Is the program being implemented effectively? And does the company’s compliance program work in practice?

When evaluating whether a company’s compliance program is adequately designed to prevent and detect wrongdoing by employees as well as management’s commitment to the program, the Guidance considers five factors: if the company has tailored its risks to its business; whether the company’s policies and procedures adequately address such risks; whether the company’s training programs and methods of communications are effective; if employees can anonymously and confidentially report misconduct; and whether a company applies a risk-based due diligence approach to its third-party relationships.

When determining whether a company’s compliance program is implemented effectively rather than having a mere “paper program” in place, the Guidance considers the following elements: whether senior managements leads by example; if the compliance department is appropriately staffed and adequately resourced; and whether the program incentivizes compliance and has appropriate disciplinary procedures that are consistently enforced.

When considering whether a company’s compliance program works in practice, the Guidance considers these elements: whether the company engaged in meaningful efforts to review and update its compliance program; and whether the company has an effective and appropriately funded mechanism to provide for timely, thorough and independent investigations undertaken by qualified personnel. 

All companies should review and evaluate their compliance programs in light of the recent Guidance.