Rebecca Walker (rwalker@kaplanwalker.com) is a partner in the law firm of Kaplan & Walker LLP, which specializes in corporate compliance and ethics, located in Santa Monica, California, and Princeton, New Jersey.
In June, the Department of Justice (DOJ) issued a revised version of its guidance to prosecutors regarding the factors that prosecutors should consider in making “informed decisions as to whether, and to what extent, the corporation’s compliance program [is] effective…for purposes of determining the appropriate (1) form of any resolution or prosecution; (2) monetary penalty, if any; and (3) compliance obligations contained in any corporate criminal resolution (e.g., monitorship or reporting obligations).”[1] The guidance includes a number of very detailed questions regarding assessment of the efficacy of a compliance program and is, therefore, an important resource for compliance practitioners.
The 2020 revisions to the evaluation guidance, while not extensive, are meaningful. They focus in on some of the most important developments in the compliance field in recent years. Taken as a whole, they point squarely and unambiguously to the importance of continuous program assessment and improvement. They also tackle the topic of the use of data and metrics to improve programs, as well as the importance of program authority and independence. In this article, we will explore the changes to the evaluation guidance in detail, but before getting to that, we’ll set the stage with a little history.
A little history
Way back in 1999, when Bill Clinton was president and Eric Holder was deputy attorney general, DOJ promulgated a memo that instructed federal prosecutors to consider—among a number of other criteria—the existence of an effective compliance program in determining whether to charge an organization for alleged criminal conduct.[2] The June 1999 memorandum, which was entitled “Bringing Criminal Charges Against Corporations,” became known as the “Holder Memo,” which was subsequently revised several times and ultimately, in 2008, was incorporated into the Justice Manual.[3]
The Holder Memo also provided guidance to prosecutors regarding how to assess the adequacy of compliance programs. Prosecutors were instructed to consider whether the corporation has established corporate governance mechanisms that can effectively detect and prevent misconduct, such as whether directors exercise independent review, whether directors are provided with information sufficient to enable the exercise of independent judgment, whether internal audit functions are conducted at a level sufficient to ensure their independence and accuracy, and whether directors have established an information and reporting system reasonably designed to provide management and the board of directors with timely and accurate information regarding compliance. Prosecutors were also directed to determine:
-
“whether a corporation’s compliance program is merely a ‘paper program’ or whether it was designed [and] implemented…in an effective manner”;
-
“whether the corporation has provided for a staff sufficient to audit, document, analyze, and utilize the results of the corporation's compliance efforts”;
-
“whether the corporation’s employees are adequately informed about the compliance program and are convinced of the corporation's commitment to it”; and
-
whether the program is designed “to detect the particular types of misconduct most likely to occur in a particular corporation’s line of business.”[4]
Last year—20 years after the Holder Memo was promulgated—DOJ issued the Evaluation of Corporate Compliance Programs, which set forth detailed guidance on the factors that prosecutors should consider in determining “whether, and to what extent, [an organization’s] compliance program was effective at the time of the offense, and is effective at the time of a charging decision or resolution.”[5] (The 2019 guidance was initially issued in the form of a series of questions that appeared on the DOJ’s website in 2017, then was issued as a formal memo in 2019.)
The evaluation guidance is structured around three primary questions that prosecutors were first instructed to ask way back in 1999:
-
“‘Is the corporation’s compliance program well designed?’”
-
“‘Is the program being applied earnestly and in good faith?’ In other words, is the program adequately resourced and empowered to function effectively?”
-
“‘Does the corporation’s compliance program work’ in practice?”
In explicating each of the above questions, the DOJ evaluation guidance sets forth a number of questions for prosecutors to ask regarding every element of a compliance program, many of which are quite insightful. Not every question is applicable to every organization, and the guidance—in many areas—asks challenging questions of programs, setting standards that not all programs (even all effective programs) would meet. But the questions are very helpful to compliance practitioners seeking to assess their own organization’s programs, and the guidance is a must-study for any compliance practitioner. While this article focuses on the recent changes to the guidance, I encourage everyone to read the full guidance document closely. It can be found at http://bit.ly/2Z2Dp8R.
