DOJ Revises Guidelines on Compliance Programs
Tags: DOJ, Compliance, Grc, Guidelines, Risk Management

In the beginning of June, the U.S. Department of Justice released a revised version of its guidance on compliance programs. This updated guidance, replacing the last updated version from over a year ago, includes many new considerations for organizations in their compliance programs.

This guidance is a gauge for federal prosecutors to evaluate the effectiveness of an organization’s compliance program to assist in the decision-making process about prosecutions and appropriate monetary penalties. As a result, these guidelines are an important resource for organizations to evaluate their compliance programs in a way that satisfies DOJ expectations.

One of the main areas in which this updated 2020 version distinguishes itself from the previous update in 2019 is in regard to what it calls the “fundamental questions” — which all of the guidelines are directly based off of. Many of the changes within these questions are a matter of wording. For instance, the second question is whether a compliance program is being “implemented effectively”, but in the updated version it provides more nuance by stating, “is it adequately resourced and empowered to function effectively.”

Although this is just a change in wording, it is a welcome change, nonetheless. An effective compliance program has many layers to it. It is not just a matter of whether the organization has qualified personnel in their compliance program, adequate resources have to be provided for it to operate effectively i.e. finances, technology, personnel etc. Once these resources are in place, the organization must empower its compliance program and officers to take the appropriate and necessary actions when needed to push the compliance program further. This update speaks to one of the biggest problems seen within corporate compliance programs today — the head of the compliance program is a well-qualified individual that’s lacking the adequate resources to operate effectively and is not empowered by the organization and its directors to enact changes that are necessary.

Noteworthy Changes

Other changes to the 2020 update include several important additions:

· Are past issues of the company considered in performing the risk assessment and in making improvements to the program?

· Are policies and procedures made accessible in a searchable manner?

· Is the reporting system publicized to third parties?

· Are post-acquisition audits performed in regard to newly acquired entities, rather than merely during the due diligence process?

· Is there a culture of ethics and compliance?

· Does the company invest in training and development of compliance and control personnel?

· Are risk assessments continuous in or merely “snapshots” from different assessments?

· Do compliance and control personnel have access to data to enable them to perform timely and effective monitoring and testing?

· Do the compliance functions monitor investigations and resulting discipline to ensure consistency?

· Does the company tests employee awareness of and comfort with the reporting system and whether the reporting system is tested for effectiveness by tracking a report from start to finish?

The updates added by the DOJ in their 2020 guidelines is a sign of improved maturity and understanding of corporate compliance programs. The guidelines are largely based off of feedback the DOJ has received over the past year from legal and business communities. These new guidelines acknowledge how an organization can only adapt to this volatile and dynamic business environment by utilizing technology and data. It acknowledges that compliance programs are not a one-size fits all, but rather must be developed based off of the organizations size, industry geography etc. It also highlights the importance and effectiveness of organizations evaluating their compliance programs, responding to the feedback of their employees, and using the lessons they have learned to create and sustain dynamic and effective compliance programs.

At its core, the 2020 DOJ guidance encourages organizations not take a basic in designing and implementing a compliance program, but rather to consider the company’s specific risks and circumstances i.e. the reasons for a company’s structural choices and allocation of resources.

Is your organization ready for effective, efficient, and agile compliance agility in today’s dynamic and risky environment?

Get in touch with us