The Department of Justice (DOJ) updated its Evaluation of Corporate Compliance Programs (ECCP) guidance on March 3, 2023. The ECCP outlines the DOJ’s process for evaluating compliance programs in order to determine corporate prosecution decisions. This guidance is an update to the June 2020 edition that was previously released.
The ECCP is an important tool for companies to ensure they are meeting the DOJ’s expectations for effective compliance programs. It provides a framework for companies to assess and improve their existing compliance programs, as well as for the DOJ to evaluate a company’s efforts in preventing and detecting misconduct.
Why Did the Department of Justice Update the Evaluation of Corporate Compliance Programs?
The DOJ regularly updates its guidance to keep pace with evolving laws and regulatory expectations. The Department released the updated Evaluation of Corporate Compliance Programs in direct response to changes in the corporate compliance landscape and the growing emphasis on ethical business conduct. Through this update, the DOJ reinforces its commitment to effective compliance programs and clearly signals its expectation that companies take proactive steps to prevent misconduct before it occurs.
Key Components of the Updated Guidance
The updated guidance emphasizes three fundamental questions that the DOJ will consider when assessing a company’s compliance program:
1. Is the Compliance Program Well-Designed?
This question examines whether the company has implemented an effective compliance program that aligns with its specific risks, business activities, and operational structure. The guidance outlines several factors that the DOJ will consider when evaluating the design of a compliance program, such as:
- Risk Assessment: According to the Guidance, a prosecutor’s initial step in determining whether a firm has a well-thought-out compliance program is to ascertain how the company has recognized, evaluated, and characterized its risk profile. The Guidance emphasizes the value of ongoing review and lessons learned in risk assessment.
- Policies and Procedures: The Guidance emphasizes the necessity of well-established policies and procedures that integrate the culture of compliance into the business’s daily operations and mandates that companies exhibit a strong code of conduct for the entire organization.
- Training and Communications: According to the Guidance, properly designed training and communications are another essential component of a well-designed compliance program. As a result, the Guidance has improved the compliance training material that prosecutors may be expecting to see.
- Confidential Reporting Structure and Investigation Procedure: Prosecutors should evaluate if the organization’s complaint-handling procedure incorporates proactive steps to foster a work environment free from fear of retaliation, suitable channels for complaint submission, and procedures to safeguard whistleblowers.Prosecutors need to evaluate the organization’s procedures for managing investigations into these complaints.
- Third Party Management: Prosecutors should evaluate the degree to which the business is aware of the qualifications and affiliations of its third-party partners as well as the risks that these partners bring
- Mergers and Acquisitions (M&A):The Guidance states that “A well-designed compliance program should include comprehensive due diligence of any acquisition targets, as well as a process for timely and orderly integration of the acquired entity into existing compliance program structures and internal controls.”
2. Is the program adequately resourced and empowered to function effectively?
This question focuses on whether a company has dedicated sufficient resources and authority to its compliance program to ensure its effectiveness. The DOJ will consider the following factors when evaluating this aspect:
- Autonomy and Resources: The guidance emphasizes the importance of a compliance program having appropriate staffing, budget, and authority within the organization.
- Senior and Middle Management Support: Prosecutors will evaluate whether senior and middle management demonstrate genuine commitment to the compliance program through their actions, decisions, and communications.
- Incentives and Disciplinary Measures: The guidance emphasizes that companies must align incentives and disciplinary measures with their compliance policies and apply them consistently across the organization.
3. Does the Compliance Program Work in Practice?
This question focuses on whether a company’s compliance program is effective in detecting and preventing potential misconduct. The DOJ will consider the following factors when evaluating this aspect:
- Continuous Improvement: The Guidance stresses the importance of companies continually monitoring and testing their compliance programs to identify areas for improvement.
- Periodic Review: Prosecutors will assess whether a company regularly reviews and updates its compliance program to ensure it remains effective in light of changing risks and operations.
- Investigation of Misconduct: The Guidance highlights the importance of companies thoroughly investigating allegations of misconduct and implementing appropriate remedial measures to prevent future incidents.
Final Thoughts
With the latest revisions, the DOJ has given businesses more precise instructions on what to anticipate when they are the subject of a US government investigation. When misconduct occurs, having a strong compliance program in place can influence the prosecution’s or resolution’s outcome, provided that the program meets the essential guidelines.
By addressing key questions related to program design, implementation, and effectiveness, companies can proactively strengthen their compliance efforts and demonstrate a commitment to ethical and lawful behavior. So, it is important for companies to familiarize themselves with this guidance and regularly review and update their compliance programs to ensure effectiveness. With the DOJ’s continued focus on corporate compliance, having a robust program in place has become more essential than ever before.
Staying on the Right Side: How Riddle Compliance Can Simplify Your Compliance Journey
Riddle Compliance is dedicated to helping companies navigate the complex landscape of compliance and ethics. Our team of experienced professionals offers a range of services, including Compliance Program Design and implementation,risk assessments, policy and procedure development, training and communications, Compliance Investigations, due diligence for third-party management, and integration support for mergers and acquisitions.
We work closely with our clients to ensure their compliance program is well-designed, adequately resourced, and effective in practice. Our goal is to simplify the compliance journey for businesses and provide them with the tools they need to prevent misconduct and maintain a culture of compliance.
With Riddle Compliance as your partner, you can rest assured that your compliance program is meeting DOJ guidelines and staying ahead of potential risks. Contact us today to learn more about how we can support your compliance efforts and help your company stay on the right side of the law.
