The concept of “discipline” is an important part of a compliance program, and it arises in two slightly different situations. First is the notion, under the U.S. Sentencing Guidelines Manual (USSG), that a compliance program should include incentives for employees to follow the program, along with punishment or discipline for failing to do so. Second is the concept that a company should have a rational program of employee discipline for various policy violations. Note that consistent discipline is a key element of effective compliance programs as well as an attribute of good management practices in general.
Sentencing Guidelines
Chapter 8 of the USSG deals with sentencing of organizations. The chapter covers various considerations that go into determining a sentence when an organization is convicted of a federal crime.[2] In most cases, an organization’s punishment is in the form of a fine, which is determined by several factors, including the nature of the offense, a prior history of violations, and the extent to which the organization cooperated with the government. The punishment may also take the form of restitution, disgorgement, debarment from federal contracts, and a period of probation.[3]
The guidelines also include the important concept of the “effective” compliance program. U.S. law generally imposes liability on an employer for actions of an employee, even if the actions were not authorized or directed. But how can an organization credibly assert that the actions of an employee, which may have benefited the organization, were not authorized? The guidelines provide the answer: If an organization can show that it used due diligence to prevent and detect criminal conduct, it may qualify for a reduction in any fine that might be imposed for violation of a federal criminal law. Due diligence is established by following certain basic principles of compliance that the guidelines outline, which essentially provide a credible basis for the assertion that the organization had no intent to violate the law. In essence, the guidelines provide the basis for the organization to say, “Look at all we did to try to prevent any sort of violation by our employees. What more could we have done?”
The guidelines outline the basic attributes of a compliance program designed to promote an organizational culture that encourages ethical conduct and a commitment to compliance with the law. This article will focus on one of those attributes: the concept of discipline or punishment. Specifically, the guidelines provide:
(6) The organization’s compliance and ethics program shall be promoted and enforced consistently throughout the organization through (A) appropriate incentives to preform in accordance with the compliance and ethics program; and (B) appropriate disciplinary measures for engaging in criminal conduct and for failing to take reasonable steps to prevent or detect criminal conduct.[4]
The concept of discipline was specified in the Sentencing Reform Act, which allows a court when sentencing an organization, to consider any measures taken by the organization to discipline employees responsible for misconduct.[5]
The guidelines note that while adequate discipline of individuals responsible for an offense is a necessary
component of enforcement, the form of discipline that will be appropriate will be case specific.[6] So, while the guidelines do not specify what kind of discipline should be imposed for violations, the organization will be expected to demonstrate that it has an appropriate disciplinary program or policy, and that it is fairly applied. Just having a policy on paper, which is ignored in reality, will not be sufficient.
Courts have recognized that employees may be under pressure, for example, to increase profits and “do whatever it takes” to meet quarterly or annual goals. This is why the legislature believes that corporations rather than employees should be punished, even when the actions of the employees were not sanctioned by the corporations. A corporate policy that dryly recites the requirement that employees must obey various laws often gets overlooked or ignored, particularly when all or part of an employee's salary is tied to meeting goals.[7] Thus, an effective compliance program must have sufficient “teeth” that are actually used to punish employees for violating the law or company policies. A policy of punishment for violations should be designed to make it clear to employees that there will be consequences for illegal actions, and the pressure to make profits will not excuse the conduct.
The DOJ notes the important role prosecutors play in analyzing whether corporate management is enforcing the program or is tacitly encouraging or permitting employees to engage in misconduct. The previous mark for this analysis was to ask whether corporations were pressuring employees to engage in misconduct; as of 2023, that mark is now whether corporations simply permit misconduct. This revised approach to prosecutorial analysis should encourage companies to do more than simply note in policies that misconduct is not permitted.
If a violation is detected, the guidelines also require that:
(7) After criminal conduct has been detected, the organization shall take reasonable steps to respond appropriately to the criminal conduct and to prevent further similar criminal conduct, including making any necessary modifications to the organization’s compliance and ethics program.[8]
So, one factor in determining if a compliance program is “effective,” as the guidelines define the term, and therefore worthy of justifying a sentencing reduction, is the response of the organization in the face of a criminal violation. One aspect of the organization’s response is the discipline of employees who may have been involved.
The guidance issued by the Department of Justice on prosecuting corporations notes that it would consider “the corporation’s remedial actions, including, but not limited to, any efforts to implement an adequate and effective corporate compliance program or to improve an existing one, to replace responsible management, to discipline or terminate wrongdoers, or to pay restitution.”[9] The importance of discipline for violations is emphasized in the DOJ’s Evaluation of Corporate Compliance Programs.[10] The DOJ includes “Communications about Misconduct” as one of the attributes of appropriate training and communication of a compliance program:
What has senior management done to let employees know the company’s position concerning misconduct? What communications have there been generally when an employee is terminated or otherwise disciplined for failure to comply with the company’s policies, procedures, and controls (e.g., anonymized descriptions of the type of misconduct that leads to discipline)?
The DOJ Guidance issued in 2023 emphasizes the importance of corporate “Compensation Structures and Consequence Management: including, establishment of incentives for compliance and disincentives for noncompliance. Prosecutors should now assess whether the company has clear consequence management procedures to identify, investigate, discipline, and remediate violations of law, regulation or policy) and enforces them consistently across the organization. Prosecutors should also assess the extent to which the company’s communications convey to its employees that unethical conduct will not be tolerated and will bring prompt consequences, regardless of the position or title of the employee who engages in the conduct.
The design and implementation of compensation schemes play an important role in fostering a compliant culture. Prosecutors may consider whether a company has incentivized compliance by designing compensation systems that defer or escrow certain compensation tied to conduct consistent with company values and policies.
Some companies have also contract provisions that permit the company to recoup previously awarded compensation if the recipient of such compensation is found to have engaged in or to be otherwise responsible for corporate wrongdoing. Finally, prosecutors may consider whether provisions for recoupment or reduction of compensation due to compliance violations or misconduct are maintained and enforced in accordance with company policy and applicable laws.
The DOJ also considers the “Human Resources Process” around employee discipline:
Who participates in making the disciplinary decisions, including for the type of misconduct at issue? How transparent has the company been with the design and implementation of its disciplinary process? In circumstances where an executive has been exited from the company on account of a compliance violation, how transparent has the company been with employees about the terms of separation? Are the actual reasons for discipline communicated to employees? If not, why not? Is the same process followed in each instance of misconduct, and if not, why not? Has the company taken steps to restrict the disclosure or access to information about the disciplinary process? Are there legal or investigation-related reasons for restricting information, or have pre-textual reasons been provided to protect the company from whistleblowing or outside scrutiny?
The DOJ Guidance also emphasizes the importance of consistent application of incentives and the disciplinary process:
Have disciplinary actions and incentives been fairly and consistently applied across the organization? Does the compliance function monitor its investigations and resulting discipline to ensure consistency? Are there similar instances of misconduct that were treated disparately, and if so, why? What metrics does the company apply to ensure consistency of the disciplinary measures across all geographies, operating units, and levels of the organization?
The Incentive System has been revised to highlight the importance of finances:
Financial Incentive System: Has the company considered the impact of its financial rewards and other incentives on compliance? Has the company evaluated whether commercial targets are achievable if the business operates within a compliant and ethical manner? What role does the compliance function have in designing and rewarding financial incentives at senior levels of the organization?
In addition to considering the general financial policies and how they shape compliance in the company, the DOJ also recommends an approach that is more specific:
How does the company incentivize compliance and ethical behavior? What percentage of the executive compensation is structured to encourage enduring ethical business objectives? Are the terms of bonus and deferred compensation subject to cancellation or recoupment, to the extent available under applicable law, in the event that non-compliant or unethical behavior is exposed before or after the award is issued? Does the company have a policy for recouping the compensation that has been paid, where there has been misconduct? Have there been specific examples of actions taken (e.g., promotions or awards denied, compensation recouped or deferred compensation cancelled) as a result of compliance and ethics considerations?
The DOJ for the first emphasizes the importance of compensation not only for compliant employees, but also for employees whose job it is to investigate and adjudicate misconduct: