Corporate Compliance on the Cutting Edge: New Guidance from DOJ

When investigating alleged corporate misconduct, federal prosecutors are asked to weigh a variety of factors for the purposes of making charging decisions and sentencing recommendations and negotiating plea or other agreements. Specifically, the Justice Manual instructs prosecutors to consider the effectiveness of a corporation's compliance program as one such factor.

On June 1, 2020, the Department of Justice (DOJ) published updated guidance on the factors that prosecutors should consider when evaluating corporate compliance program effectiveness (2020 Compliance Guidance). The changes in the 2020 Compliance Guidance are generally modest and preserve the core elements and structure of the April 2019 version, which itself updated and greatly expanded a prior version released by DOJ's Criminal Division's Fraud Section in February 2017. (Read Arnold & Porter's Advisory on the topic.) However, these latest additions and refinements do offer some insight into DOJ's evolving thinking on issues such as third-party management, the importance of data in compliance-related decision-making and testing, and the potential relevance of foreign law for the design and structure of compliance programs. In the words of Assistant Attorney General Brian Benczkowski, the "revised guidance . . . reflects additions based on our own experience and important feedback from the business and compliance communities."

The 2020 Compliance Guidance focuses on the same three fundamental questions presented in the 2019 version, albeit with one notable addition:

1. "Is the corporation's compliance program well designed?"
2. "Is the program being applied earnestly and in good faith?" In other words, is the program being implemented adequately resourced and empowered to function effectively?
3. "Does the corporation's compliance program work" in practice?

The bolded language in the second question—focusing on the resources available to a compliance program as well as the degree to which it is given the autonomy and authority to function effectively—was added.

So What's New?

The 2020 Compliance Guidance offers some concrete details that companies should keep in mind when designing or enhancing their own compliance programs.

• Emphasis on Continuous Improvement. Prosecutors are now explicitly directed to evaluate compliance programs at the time of the misconduct and at the time of the charging decision. In other words, DOJ has made clear that companies that make remedial improvements to their programs, even after an investigation has started, may secure more favorable treatment. Moreover, DOJ will also consider whether a company is proactively making adjustments such that it "review[s] and adapt[s] its compliance program based upon lessons learned from its own misconduct and/or that of other companies facing similar risks."
• Availability and Utilization of Data. The 2020 Guidance adds several questions concerning the compliance function's access to data resources and other information, reinforcing the need for compliance programs to use data-based methods to make decisions, track effectiveness, and test procedures.
• Management of Third-Party Risks. DOJ guidance has always reflected the importance of third-party management. However, the 2020 Compliance Guidance underscores the need for companies to manage third-party risk not just at the beginning of the relationship, but throughout its lifespan.
• M&A Due Diligence and Integration. The new guidance reinforces that companies need to incorporate compliance considerations into their due diligence and integration processes in the context of mergers and acquisitions. Prosecutors should ask whether companies were "able to complete pre-acquisition due diligence, and, if not, why not?" Further, DOJ expects companies to integrate acquired entities into their existing compliance programs in a "timely and orderly" manner.
• Training and Commitment. The 2020 Compliance Guidance adds several questions that delve into the details of how companies operationalize their compliance training and education programs, and also emphasizes that effective compliance requires commitment from middle-level as well as top-level management.
• Foreign Law. When companies claim that their compliance programs are structured so as to comply with foreign law, prosecutors are now instructed to probe the basis for such representations. As such, companies may need to prove their reliance on foreign law, or reconcile any differences between US and foreign law affecting their compliance programs.

While none of the changes in the 2020 Compliance Guidance represents a shift in the core elements that DOJ instructs prosecutors to take into consideration when assessing corporate compliance program effectiveness, the release of this update—especially so soon after the 2019 overhaul—suggest that DOJ is continuing to examine and clarify its approach to and thinking on these issues.

For further information on the DOJ's "Evaluation of Corporate Compliance Programs" please see our Advisory, "Updated DOJ Guidance on Evaluation of Corporate Compliance Programs Provides Additional Detail to the Existing Framework for Program Assessment," which includes a redline comparison of the 2019 and 2020 Compliance Guidance.

© Arnold & Porter Kaye Scholer LLP 2020 All Rights Reserved. This blog post is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.