One way to find out whether compliance and integrity have seeped into the bones of an organization is asking people who would know. There may be a compliance program in place with bells and whistles, but whether its systems for detecting and preventing fraud and abuse are functional may require some private conversations with certain managers, including the compliance officer.
“I have found it enormously valuable” to have “targeted, confidential conversations with people in key positions,” says former Deputy Attorney General David Ogden, who serves as an independent corporate monitor for the Department of Justice (DOJ) in the resolution of criminal cases. For example, do compliance professionals have the support of local leadership? Is there fear of retaliation? If so, why? “What is the lived experience? That’s the real question,” Ogden says. “Is good behavior rewarded, or bad behavior? Do people who want to do the right thing feel supported?”
The answers to these questions and others like them help determine the effectiveness of compliance programs, whether organizations evaluate them or the DOJ and the HHS Office of Inspector General (OIG) kick their tires in the context of enforcement actions. Satisfying responses affect an organization’s fate in a corporate fraud case, as DOJ has conveyed in a series of guidance documents, including its Evaluation of Corporate Compliance Programs,[1] which was updated in April 2019,[2] and the 2018 “Selection of Monitors in Criminal Division Matters” memo.[3]
How DOJ’s policies translate on the ground remains to be seen. “What is coming out of DOJ now is an effort to figure out how to incentivize higher-quality compliance” and self-disclosures, says Ogden, with WilmerHale in Washington, D.C. “To some extent, the proof will be in the pudding. It is a question of looking at the inside of companies [to see] how they are proceeding. My bet is you will see greater change if there becomes a story over time based on how they were treated [by DOJ] if they had a good compliance program in place,” he says. How credible is it when inevitably things go wrong at an organization? “It is more than putting policies down. It is about follow-through.”
