Can Your Compliance Program Pass the Test? The Department of Justice wants boards to invest and empower their programs.

• Author: Raymond, Doug
• Position: LEGAL BRIEF

Recent days have convincingly demonstrated the importance of the board's risk oversight obligations, as the impacts of the COVID-19 pandemic spread and cascaded globally. Under the In re Caremark International line of cases, the board should be aware of the types and magnitudes of the principal risks facing the company, especially in the regulatory sphere, and should assess the company's risk management policies and procedures that are designed to mitigate those risks. The directors also should satisfy themselves that these policies and procedures have been designed and are being implemented effectively and in keeping with the company's strategy.

As an integral part of their risk assessment oversight, directors should consider whether the company's programs and compliance systems would be considered effective if the government were to arrive in the lobby, alleging that the corporation has engaged in wrongdoing. Under federal sentencing guidelines, the existence of an effective compliance program can significantly reduce the punishment imposed on a corporation if its employees were found to have broken the law.

The Department of Justice (DOJ) recently updated its guidance on evaluating corporate compliance programs, and boards should consider this updated guidance in evaluating their own compliance programs. In earlier versions of the guidance, the DOJ posed three "fundamental" questions to ask when evaluating a corporate compliance program: Was it well-designed, was it being implemented, and did it work? The updated guidance refocuses the second question, asking whether the program was "adequately resourced and empowered to function effectively." In particular, the guidance encourages investing in "further training and development of compliance and control personnel" and providing them with more timely and direct access to company data.

The DOJ has long criticized "paper programs" as well as those that grow stale over time. Prosecutors have expressed concern that companies adopt compliance programs and then ignore them until serious misconduct takes place. The updated guidance makes this point, reminding companies that prosecutors evaluate programs "both at the time of the offense and at the time of the charging decision and resolution." The DOJ has a special unit, the Strategy, Policy & Training Unit (SPT), that assists prosecutors who are considering sanctions against the corporation by evaluating the adequacy of the corporate compliance...