Unpacking DOJ’s updated guidelines

In the process of strengthening the guidelines established by the “Principles of Federal Prosecution of Business Organizations” described in the Justice Manual, DOJ has recently issued its March 2023 update on the Evaluation of Corporate Compliance Programs;^[2] its last update was in June 2020.^[3] The primary changes in the 2023 update are under the headings “Compensation Structures and Consequence Management” and “Investigation of Misconduct”; however, the core structure and content of the guidance remain the same. In general terms, this document is intended to assist prosecutors on how to evaluate the effectiveness of a compliance program in accordance with each company’s risk profile and risk mitigation efforts. While the spirit of this document is to assist US regulators in evaluating corporate compliance programs in the specific context of a criminal investigation, it has also become a vital guide for assessing corporate compliance programs in other parts of the world, including Central and Latin America.

One of the primary themes emphasized by the DOJ update is the need for data-driven assessments of compliance programs. As the management consultant, educator, and author Peter Drucker stated, it’s difficult to fix what you can’t measure.^[4] Therefore, compliance professionals in Central and Latin America must ensure their compliance programs align with DOJ’s new guidance. They must revise policies and procedures, update training programs, and enhance monitoring and testing procedures to ensure their compliance program is appropriately designed and operating effectively.

Compliance professionals must also work closely with senior management to ensure compliance is integrated into the company’s overall strategy. This may involve securing additional funding or staff and ensuring compliance professionals have sufficient access to company data and resources. Companies should also consider engaging outside experts to provide independent compliance program assessments to implement the new guidance.

The update introduced several new components companies should consider when developing or evaluating their compliance programs. In general terms, these updates include:

• Prioritizing training and education: Companies must prioritize training and education for their employees, third-party agents, and business partners. This includes providing regular training on the company’s code of conduct, anti-corruption policies, and other compliance-related topics. Companies should also consider providing specialized training for employees who work in high-risk areas.

• Conducting risk assessments: Companies should regularly conduct risk assessments to identify areas where they are most vulnerable to potential violations. These risk assessments should consider the company’s operations, industry, and location.

• Maintaining accurate and complete records: Companies should maintain accurate and complete records of all compliance-related activities, including training, risk assessments, and investigations. This documentation should be easily accessible to all relevant personnel.

• Conducting thorough investigations: Companies should conduct thorough and impartial investigations of potential violations. This includes providing employees with a way to report violations anonymously and without fear of retaliation.

• Encouraging reporting and creating a culture of compliance: Companies should encourage employees to report potential violations and create a culture of compliance. This includes promoting open communication, providing incentives for good behavior, and creating a system for whistleblowers to report potential violations.