Corporate Compliance Programs: Pretext or Panacea?

• Publication year: 2016

Corporate Compliance Programs: Pretext or Panacea?

Justin S. Brooks

CORPORATE COMPLIANCE PROGRAMS: PRETEXT OR PANACEA?

Justin S. Brooks^*

Proponents of corporate compliance programs loudly sing their praises while detractors point to ceaseless prosecutions and a parade of civil suits— often resulting in multi-billion dollar verdicts or settlements—as evidence that they are ineffective. So, are corporate compliance programs a panacea or a pretext? The truth lies somewhere in between.

As a threshold issue, corporations are for-profit institutions. Indeed, most corporations have a mandate to maximize profit for shareholders. This can encourage senior management to operate in grey areas, and regulators may later deem their actions (and board oversight of such actions) to violate a wide array of laws. Second, formalistic compliance programs are not enough to ensure internal reporting of potential fraud and are not enough to inspire companies to take appropriate corrective actions. Instead, as set forth below, companies must take steps to ensure effective implementation of compliance programs and foster a culture of corporate compliance.

The countervailing factors that motivate officers and directors to engage in or acquiesce to fraudulent conduct or, alternatively, devise and implement an effective compliance program warrant in-depth treatment in a standalone piece. Here, I turn to answering the specific questions posed with these general principles in mind.

[Page 2]

Question 1: Do corporate compliance programs actually suppress information from regulatory oversight?

Response: Yes, often appropriately. But meritorious—and sometimes non-meritorious—allegations of misconduct tend to get reported externally where internal responses are inadequate or the company has not created a culture of compliance and reporting.

Recent reports, compiled through surveys of hundreds of senior executives from a broad range of industries, indicate that roughly two-thirds of United States companies are affected by fraud.¹ Costs to companies, including reputational damage, can be substantial as can costs associated with remediation and investigation of fraudulent practices.

Internal reporting programs such as corporate compliance hotlines represent a company's first line of defense against corporate fraud. Internal whistleblower hotlines are a key component of a company's anti-fraud program: where such hotlines are implemented, tips are typically the most common method of detecting fraud.² Moreover, the Sarbanes-Oxley Act ("SOX"), international guidelines from the European Union, and the U.S. Federal Sentencing Guidelines have deemed hotline reporting programs a good and necessary business practice. At the same time, internal compliance hotlines serve to screen out frivolous and baseless claims.

In my experience counseling and defending large corporations on employment matters and corporate compliance, reports to company ombudsman, managers, or human resources and compliance personnel often lack merit or do not implicate fraud. Employees often file malicious or fictitious complaints against fellow employees or the organization to ward off pending termination or to seek revenge for perceived slights. But treating employees with respect, even in these situations, can dissuade employees from unwarranted external reports.

Unfortunately, despite strong incentives to self-report credible evidence of wrongdoing, companies may conceal such evidence. Like companies, whistleblowers have incentives under various statutory regimes to report

[Page 3]

internally. For example, under the SEC whistleblower program established by the Dodd-Frank Wall Street Reform and Consumer Protection Act ("Dodd-Frank") in 2010, a whistleblower's participation in internal compliance systems will generally increase an award and...