Analysis of the DOJ’s June 2020 updated guidance on Evaluation of Corporate Compliance Programs

June 2, 2020 Articles,

On June 1, 2020, the DOJ updated its Evaluation of Corporate Compliance Programs guidance (“2020 ECCP”) (building on the previous version released in April 2019). Although the updated guidance does not reflect a sea change in the DOJ’s overall approach to corporate compliance, it serves as an important reminder that companies must continue to evaluate and enhance their internal corporate compliance programs to better address evolving internal and external risks. The 2020 ECCP, coupled with the DOJ Criminal Division’s May 2020 job posting for a trial attorney with compliance expertise, indicates the DOJ’s continued efforts to help prosecutors better evaluate and take into account corporate compliance programs in the context of enforcement actions. It also presents an opportunity for in-house compliance professionals to message the continued importance of compliance to their Board, C-Suite, and business partners. The key changes we have identified during our initial analysis of the 2020 ECCP are summarized below:

Additional emphasis on the “circumstances of the Company”: The 2020 ECCP reemphasizes that the DOJ will make a “reasonable, individualized determination in each case” and consider both internal and external factors (e.g., “size, industry, geographic footprint, regulatory landscape”) that may have impacted a company’s compliance program. This is a welcome approach as companies balance how to continue funding and implementing corporate compliance initiatives in light of the financial and personal impact of the COVID19 pandemic and current social unrest.

Focus on internal review and monitoring of the compliance program: There is new reference to whether monitoring looks at merely a “snapshot” of the program or whether it incorporates continuous access to operational data across functions. The expectation is that policies, procedures, and controls will be updated as a result of monitoring exercises.
Incorporate lessons learned internally and externally: Companies have long been aware that they must adapt their programs based on lessons learned from their own internal investigations, monitoring efforts and risk assessments. The 2020 ECCP now reminds companies to take notice of lessons learned from other companies operating in the same industry or facing similar risks, and those in the same geographic region.
Pay attention to your policies and procedures in practice: The 2020 ECCP now not only asks whether companies are regularly updating policies and procedures, but also whether they are making them available in a searchable format, and tracking which policies “are attracting more attention from relevant employees.” Granted, although this latter point seems challenging for even the most mature compliance programs to track and document, it provides an important reminder as companies consider whether to invest in compliance technology and other tools that will enable these tasks.
Training can be short and focused: The 2020 ECCP acknowledges that “shorter, more targeted training” may be more effective in enabling employees to more quickly identify and raise concerns. The updated guidance emphasizes that regardless of the training format, employees should have an opportunity to ask questions that arise from training, and further, that the company identifies a way to test whether and how training has impacted employee behavior. This is welcome news for in-house compliance professionals who routinely field complaints from employees that compliance training is too long, generic, or unhelpful.
Stress test your hotline: There is new language asking whether companies test employee awareness of the hotline, their comfort in using it, and their hotline’s overall effectiveness.
Don’t lose sight of third parties: The 2020 ECCP includes a pointed reminder that companies should be monitoring their third-party relationships on an on-going basis, not just during the onboarding phase.
M&A—Pre- and Post- acquisition due diligence + integration efforts: The 2020 ECCP adds language making clear that pre-acquisition due diligence should be done where possible, and emphasizes that companies should not drop the ball on post-acquisition due diligence and integration efforts.
Is your program adequately resourced and empowered? Importantly, the 2020 ECCP makes several new references to adequate resources for compliance programs. Specifically, question #2 has been revised—rather than asking whether a program “is being implemented effectively,” the focus is whether the program is “adequately resourced and empowered to function effectively.” The 2020 ECCP also asks whether compliance personnel have access to all of the data and information needed to allow them to properly do their jobs—and if not, what is the impediment, and what is the company doing about it? This is an important area for in-house compliance personnel to consider as many companies have significantly scaled back on compliance resources during the current pandemic.
Don’t forget Tone at the Middle: Companies are reminded that commitment to compliance must be at all levels, and there must be strong commitment from leaders both at the top of the company (e.g., C-Suite, corporate executives) and the middle (e.g., managers, supervisors, team leads).
Ensure consistent results in investigations discipline: The 2020 ECCP also includes a nuanced point about investigations—companies should take steps to ensure that disciplinary action resulting from an internal investigation is consistent with results from similar investigations across the company.

We encourage in-house corporate compliance professionals to:

- Closely review the 2020 ECCP;
- Assess how your internal corporate compliance program compares and what updates and changes may need to be made accordingly; and
- Set aside time to discuss the 2020 ECCP with your internal compliance committee, audit committee, and executive leadership and management.

[Download .pdf]

If you have any questions, or if we can provide any additional information regarding the implications of the 2020 ECCP for your company, please contact us at lila@crawfordacharya.com or angela@crawfordacharya.com.

The above is for informational purposes only, does not constitute legal advice, and does not create an attorney-client relationship