Following the updates to the DOJ’s Corporate Enforcement Policies, there has been a fair amount of conversation as to what the changes mean for compliance. Matt Kelly has a great piece (as always) on his Radical Compliance blog, noting that the materials and AAG Matthew Galeotti’s recent remarks did not really provide anything of significance regarding compliance programs. And that’s technically true. While a quality compliance program is a piece of the “timely and appropriate remediation” prong for a company to receive the best benefits under the new framework, there is no discussion as to what constitutes an effective program nor any discussion on how the DOJ intends to evaluate these programs. That’s all fair criticism.
However, and maybe I’m just an optimist, I actually see a lot of positive takeaways for compliance, even if they’re merely implied here. I think these updates do indeed put a greater emphasis on an effective compliance program. I also see several important takeaways for compliance professionals.
Clear Business Case for Compliance
The biggest change to the policies is the new guaranteed path to a declination. To me, this gives compliance officers some useful ammunition to improve their programs to ensure the company can take advantage of this benefit. I know how hard it can be for many compliance professionals to get the resources they need for their programs. It’s a never-ending Sisyphean struggle. There are many reasons for this, but it can be especially difficult to convince leadership to work towards anything without a guaranteed payoff. We’re generally wired to work towards a clear goal and compliance doesn’t always offer that, at least in the eyes of the business.
Now, with the guarantee of a declination under the right circumstances—circumstances that include an effective compliance program—compliance officers can sell this to leadership as a sort of “get out of jail free card.” While it may not work exactly like at the end of the day, it’s a great way to sell it to leadership—that our compliance program can indeed provide real, tangible value for the company.
Meanwhile, good companies are already using compliance to bolster its operations. Boiled down to its foundation, business is essentially taking calculated risks. Whether the risk is a new product, a new investment, or a new market, everything entails some type and degree of risk. Compliance is another tool that helps manage those risks.
I’ve worked with clients whose business models essentially involved pursuing opportunities in locations and markets where the big players were afraid to go. This included, for example, working deep within several jurisdictions that ranked very poorly on Transparency International’s Corruption Perceptions Index (talk about taking risks!). It worked for them because they had fantastic compliance departments. The business recognized that compliance would be critical for their operational success and invested accordingly. I believe the recent guarantees for a declination will allow more companies to recognize this importance and act appropriately.
Solidify Internal Investigation Procedures
In order to take advantage of the guaranteed declination path, compliance needs to be ready if and when a problem arises. One of the most important factors on getting that declination is the voluntary self-disclosure. The best way to ensure that your company is able to self-disclose in a timely manner is to conduct quick, efficient, and comprehensive internal investigations. As such, this is one area of compliance that you may want to prioritize following the policy revisions at the DOJ Criminal Division.
Make sure your internal investigation procedures enable you to hit the ground running once a report comes in through the hotline. You should be as quick and efficient as a Formula One pit crew (I type as I watch highlights from the Monaco Grand Prix). As such, evaluate all areas of your internal investigations procedure to ensure everything is working properly. This will ensure that the company will be able to self-disclose in a timely manner, should the need arise.
If you’ve never tested your hotline, now is a great time to do so. Submit a report through all the different avenues that are available—web, phone, email, etc.—and evaluate the user experience. Run through the triage protocol and make sure you have escalation procedures for those critical incidents. Walk through your offices and plants and anywhere else to make sure your flyers and communications for the hotline are displayed prominently and are easily accessible. If you don’t have templates for interview questions and outlines, investigation reports, and any other type of work product, you should consider developing those now to standardize the process and ensure all necessary information is always included. Finally, consider setting up an investigations committee to review investigation findings, ensure consistency of discipline, and share findings and remediation efforts throughout the business.
Prioritize Trade Compliance – Including Tariffs!
I won’t rehash this point too much, since I’ve previously written about the importance of trade compliance under the Trump Administration. However, these policy revisions make clear that trade compliance, including tariff compliance, will continue to be a priority. As such, consider this the final warning to make sure your compliance program is prioritizing sanctions, export controls, and now tariffs.
Start by staying informed on updates on these areas as they will continue to change day by day. The Treasury Department and the Commerce Department both have email services you can subscribe to that will send out updates the minute they are made. Be sure to provide the relevant updates to key employees throughout your company to ensure they can continue to be your eyes and ears on the ground.
Furthermore, be sure to get a complete handle on the company’s third-party relationships. For some companies, this can be overwhelming. If that’s the case, then start by taking a risk-based approach and focus on the most high-risk parties first. Start chipping away and you’ll be able to unravel the web soon enough.