Do Corporate Compliance Programs Really Prevent Corporate Wrongdoing? of Course They Do!

• Publication year: 2016

Do Corporate Compliance Programs Really Prevent Corporate Wrongdoing? Of Course They Do!

John T. Boese

DO CORPORATE COMPLIANCE PROGRAMS REALLY PREVENT CORPORATE WRONGDOING? OF COURSE THEY DO!

John T. Boese^*

Introduction

The editors posed three key questions with regard to effective corporate compliance programs. These questions were intriguing, and the answers set forth below are based on the perspective of a defense attorney who, for almost forty years, has represented corporate and individual defendants, predominantly in civil False claims Act cases. Hopefully, these answers will stimulate thought about effective corporate compliance programs, the advantages of having them, and perhaps dampen the enthusiasm by some for forcing compliance through punitive lawsuits. The three questions are: (1) Do corporate compliance programs actually suppress information from regulatory oversight? (2) Do corporate compliance programs create an environment where employees are led to believe that wrongdoing in the corporate environment is implausible because a compliance program exists? (3) From a practical viewpoint, what kind of corporate compliance programs work better than others? Following some background to put corporate wrongdoing in context, the responses to these questions are presented in the question-and-answer format.

Corporate Wrongdoing in Context

In an era when the daily news brings one example after another of corporate and institutional wrongdoing, asking whether corporate compliance

[Page 10]

programs really prevent corporate wrongdoing seems like a legitimate question. After all, if these compliance programs are so useful, why does it seem that instances of corporate and institutional wrongdoing never end?

The answer to that question is pretty simple: blame Adam and Eve and "original sin." Corporations and other major institutions are nothing more than groups of human beings, managed by other humans, who bring to their daily working lives all the failures that infect every other aspect of human life. We are, after all, human. Each of us is plagued by one or more of the deadly sins— greed, sloth, anger, envy, pride¹ —that are inherent in being human and cause much of the corporate wrongdoing we read about daily. Humans are not all perfect, not all knowing, not all good. Unfortunately, we all sometimes act stupidly, sometimes badly.

As a result, asking a corporate or non-profit institution created and populated by humans to be innocent of these human vices is impossible. No institution, corporation, or government entity is without its vices. They are populated by people who are greedy, lazy, envious, hateful, and proud. So every institution, every corporation, will eventually do something wrong, and the bigger the institution, and the more regulated the entity, the greater the possibility of corporate wrongdoing. The real question—and this is where corporate compliance programs are so critical—is not whether corporate wrongdoing occurs, but what the corporation, as an entity separate from the individuals who populate it, does in response when it discovers the wrongdoing, the steps it takes to make sure the wrongdoing does not recur, and the messages it sends to other employees and officials in the organization when such wrongdoing is discovered.

The most effective response always begins with having an effective corporate compliance program in place, which involves first putting in place (and regularly updating) the institutional structure. This structure chiefly includes: (1) the compliance office, including a chief compliance officer,

[Page 11]

assistants, and delegates in each major corporate division or entity; (2) a compliance oversight committee, usually made up of the senior compliance official, the general counsel, and senior management; and (3) a written set of compliance standards and procedures, drafted specifically to address the compliance risks the institution is expected to face. But setting up the structure is the easy part.

The success of any corporate compliance program is judged on what it does, which can be broken down into four interrelated parts (all important to the discussion below):

1. Training
2. Hotlines, audits, and investigations
3. Discipline
4. Correction and restitution

Corporate compliance programs are now headed by trained, experienced managers who report (or should report) directly to the board of directors or the highest legal authority that governs the corporation. As a result of legal and enforcement developments over the last twenty years, the board and senior management now have a vested interest in making that compliance program work.²

With this background, I can now react to the specific questions asked with regard to the effectiveness of corporate compliance programs.

Question 1: Do corporate compliance programs actually suppress...