In March 2022, the United States Department of Justice (DOJ) Criminal Division Assistant Attorney General Kenneth Polite announced plans to require chief executive officers (CEOs) and chief compliance offices (CCOs) to certify the effectiveness of the ethics and compliance program as part of all non-prosecution agreements, deferred prosecution agreements, and plea agreements.^[1] The U.S. Securities and Exchange Commission (SEC) often imposes a similar requirement.

DOJ’s announcement has caused concern within the compliance community. Critics worry CEOs and CCOs will face undue personal liability and argue it would dissuade CCOs from accepting the roles. But certifications are not new, nor have they spurred lawsuits against individual members of management and dissuaded candidates from accepting promotions or appointments to senior roles.

The Sarbanes-Oxley Act, for example, has required public company CEOs and chief financial officers (CFOs) to certify the effectiveness of controls over financial reporting for almost 20 years. These certifications have not resulted in lawsuits against CEOs and CFOs absent intentional misconduct or gross negligence. Nor has Sarbanes-Oxley dissuaded candidates from accepting CEO and CFO positions.

As mentioned, compliance program certifications aren’t new. DOJ has long required compliance monitors to certify compliance program effectiveness. Some monitors require management to certify compliance program effectiveness before the monitor certifies. And the new policy is a natural extension of the DOJ policy requiring certifications relating to disclosing information to DOJ.^[2]

In May 2022, Deputy Attorney General Lisa Monaco defended the announcement, explaining DOJ intends CCO certifications to empower compliance officers, not punish them.^[3] Further, the head of the DOJ’s Foreign Corrupt Practices Act (FCPA) Unit predicted compliance certifications would ensure companies take compliance seriously and set CCOs up for success, not punishment.^[4]

Companies should expect requests for compliance program certifications to expand beyond post-incident settlements. For example, counsel can use CCO and third-party certifications to demonstrate the effectiveness of the compliance program in effect when the misconduct occurred.^[5] Counsel can also use certifications to meet DOJ Evaluation of Corporate Compliance Programs^[6] and Corporate Enforcement Voluntary Self-Disclosure Policy^[7] expectations companies use to test remediation and compliance program effectiveness, as well as the SEC Seaboard Factors.^[8] Boards of directors and company management might use certifications to satisfy their duty of oversight.^[9]