31 Days to a More Effective Compliance Program

What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in a regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal of the creation of your company’s Code of Conduct? How important is the Code of Conduct? Consider the 2016 SEC enforcement action involving United Airlines, Inc., which turned on a violation of the company’s Code of Conduct. The breach of the Code of Conduct was determined to be an FCPA internal control violation. It involved a clear quid pro quo benefit paid out by United to David Samson, the former Chairman of the Board of Directors of the Port Authority of New York and New Jersey, the public government entity that has authority over, among other things, United’s operations at the company’s huge east coast hub in Newark, NJ.  Three key takeaways: 1. A Code of Conduct is a foundational document in any compliance regime. 2. The substance of your Code of Conduct should be tailored to the company’s culture, to its industry, and to its corporate identity. 3. “Document, Document, and Document” your training and communication efforts regarding your Code of Conduct. Learn more about your ad choices. Visit megaphone.fm/adchoices

The 2023 ECCP made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.” Employees often look to their direct supervisor to determine what the tone of an organization is and will be going forward. Many employees of large, multi-national organizations may never have direct contact with the CEO or even senior management. By moving the values of compliance through an organization into the middle, you will be in a much better position to inculcate these values and operationalizing compliance with them.  Three key takeaways: 1. Tone at the top—direct supervisors become the most important influence on people in the company 2. Give your middle managers a Tool Kit around compliance so they can fully operationalize compliance 3. Organizational justice is an additional way to help operationalize compliance Learn more about your ad choices. Visit megaphone.fm/adchoices

The 2022 Monaco Memo emphasized the basic point that the key to every company is culture. The bottom line is that corporate culture matters, and corporate culture that fails to hold individuals accountable or fails to invest in compliance—or worse, that thumbs its nose at compliance—leads to bad results. To assist companies in understanding this requirement, the 2023 ECCP sets out inquiries demonstrating that DOJ requirements are more than simply the ubiquitous “tone-at-the-top,” as they focus on the conduct of senior management. The DOJ wants to see a company’s senior leadership actually doing compliance. The DOJ asks if company leadership has, through their words and concrete actions, brought the right message of doing business ethically and in compliance to the organization. How does senior management model its behavior based on a company’s values and finally, how is such conduct monitored in an organization?  Three key takeaways: 1. Senior management must actually do compliance—not simply talk the talk of compliance but also walk the walk. 2. The DOJ is now actively assessing corporate culture during investigations. 3. Your CEO is a Compliance Ambassador. Learn more about your ad choices. Visit megaphone.fm/adchoices

Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were further enshrined in the 2023 Update to the Evaluation of Corporate Compliance Programs (2023 ECCP). In 2023, all companies’ risks changed as we moved from Working From Home to Return To Office and, now, a hybrid model. In addition to this straight-forward change in risk due to working locations, new risks in the form of geopolitical, supply chain, and export control, as well as increased risk due to social media, continue to impact compliance programs.  Your compliance program must be ready to respond to whatever those risks might be going forward. Continuous improvement runs the gamut in a best practices compliance program, from risk assessments to policies and procedures to periodic testing and review. Three key takeaways: 1. How have your company’s risks changed over the past year, and how will they change in 2024? 2. What is your process for continuous monitoring and improvement? 3. What sources of information do you use that come from outside your organization? Learn more about your ad choices. Visit megaphone.fm/adchoices

One of the areas articulated in the 2023 ECCP was around payments and payroll. For both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2023 ECCP was replete with references to payment and its critical nature to any best practices compliance program. This includes references to payments to foreign officials, payments to third parties, and hiding bribes in payments to distributors. The 2023 ECCP begins with an admonition to stop wasting time on low-hanging fruit when there are much higher risks in your business operations. The role of payroll in compliance is not often considered in operationalizing your compliance program, yet the monies to fund bribes must come from somewhere. Unfortunately, one of those places is out of payroll. All CCOs need to sit down with their head of payroll, have them explain the role of payroll, and then review the internal controls in place to see how they facilitate compliance goals. From that review, you can then determine how to use payroll to help operationalize your compliance program. The DOJ has now provided its clearest statement on how it expects a company to actually comply going forward. Long gone are the days where the DOJ simply considered the inputs of a written program as sufficient to protect companies from compliance violations. Yet the mandate to operationalize a corporate compliance program drives home the concept that compliance is a business process that should be administered by the appropriate business unit with the requisite SME. When it comes to following the money, payroll is the most well-suited corporate discipline to provide this first level of oversight and control. Three key takeaways: Payroll can be a key to preventing and detecting control The 2020 Update specified the tie between the corporate compliance function and the corporate payroll function. Offshore payments remain a key indicator of a red flag. Learn more about your ad choices. Visit megaphone.fm/adchoices

Matt Galvin, Counsel, Compliance & Data Analytics at the DOJ and one of the experts leading the DOJ's data analytics initiative, highlighted in another talk, the proactive use of data to generate cases related to the FCPA and emphasized that this is just the beginning. The DOJ expects companies to adopt a similar data-driven approach to compliance. In her speech, Argentieri speech she stated, "just as we are upping our game when it comes to data analytics, we expect companies to do the same." This expectation extends beyond simply tracking trainings, policies, and investigations. The DOJ's focus is on monitoring third parties throughout the lifespan of the relationship, not just during the onboarding process. The DOJ's increasing use of data analytics for proactive enforcement signifies a significant shift in their approach to combating white-collar crime. Companies must embrace this data-driven approach to compliance, continuously monitor high-risk transactions, and invest in the necessary resources and technology. By doing so, they can demonstrate effective compliance programs, uncover hidden financial irregularities, and improve overall efficiency.  Three key takeaways: 1. This also means that data analytics in the compliance function has moved from cutting edge to best practice. It soon may simply mean table stakes for compliance. 2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process. 3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability. Learn more about your ad choices. Visit megaphone.fm/adchoices

In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. Under the policy, the acquiring party will receive a presumption of criminal declination if it promptly and voluntarily discloses criminal misconduct, cooperates with any ensuing investigation, and engages in appropriate remediation, restitution and disgorgement. Under this new Mergers & Acquisitions Safe Harbor, which applies across the Department of Justice, companies that promptly and voluntarily disclose criminal misconduct with the Safe Harbor period, and then cooperate with the resulting investigation, engage in timely and appropriate remediation and pay applicable restitution and disgorgement, will receive a presumption of a declination. Once again, the key deadlines are as follows: Companies must disclose misconduct discovered (whether pre-or post-acquisition) at the acquired entity within six (6) months from the date of closing. Companies will then have one year from the date of closing to fully remediate the misconduct. The 6 month and one-year deadlines are subject to modification depending on the specific circumstances and complexity of the transaction. The acquired company can also qualify under the Mergers & Acquisition Safe Harbor Policy for voluntary self-disclosure benefits. Interestingly, DOJ clarified that any misconduct disclosed under the Safe Harbor Policy will not implicate or be counted in any future potential recidivist analysis.   Three key takeaways: 1. The DOJ Mergers & Acquisitions Safe Harbor policy encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. 2. The DOJ is seeking to incentivize an acquiring company to timely disclose misconduct uncovered during the M&A process. 3. The DOJ has made clear that under this new Mergers & Acquisition Safe Harbor Policy organizations that do not perform effective due diligence or self-disclose misconduct at an acquired entity will be subject to full successor liability. Learn more about your ad choices. Visit megaphone.fm/adchoices

Assistant Attorney General Kenneth A. Polite Jr. began his speech on the clawback policy developed by the DOJ to promote “innovative approaches to compensation,” which would “shift the burden of corporate malfeasance away from uninvolved shareholders onto those more directly responsible.” She believes “Companies should ensure that executives and employees are personally invested in promoting compliance,” as “nothing grabs attention or demands personal investment like having skin in the game, through direct and tangible financial incentives.” This led the Criminal Division to “develop guidance, guidance on how to reward corporations with compliance-promoting compensation programs.” The clawback initiative has two parts. “First, every corporate resolution involving the Criminal Division will now include a requirement that the resolving company develop compliance-promoting criteria within its compensation and bonus system. Second is the creation of a 3-year pilot program under which the “Criminal Division will provide fine reductions to companies who seek to claw back compensation from corporate wrongdoers.”  Three key takeaways: 1. The clawback policy was developed to promote “innovative approaches to compensation. 2. Clawbacks will include those who had supervisory authority over the employees or business area engaged in the misconduct and knew of, or were willfully blind to, the misconduct. 3. How far will the DOJ push companies to move for clawbacks, and how far down the chain will it go? Learn more about your ad choices. Visit megaphone.fm/adchoices

In March, Deputy Attorney General (DAG) Lisa Monaco reviewed a number of initiatives by the DOJ that every compliance professional needs to study in some detail. These new initiatives included: (1) The Criminal Division's Pilot Program Regarding Compensation Incentives and Clawbacks; (2) Evaluation of Corporate Compliance Programs; and (3) Revised Memorandum on Selection of Monitors in Criminal Division Matters. Monaco set the tone for the week by identifying five general areas of DOJ focus. (1) Inspiring a Culture of Compliance; (2) Voluntary Self-Disclosure Programs; (3) Promoting Compliance through Compensation and Clawback Programs; (4) Resource Commitments to Corporate Criminal Enforcement; and (5 ) Individual Accountability.  Three key takeaways: 1. A culture of compliance continues to be the most important component of DOJ review.   2. Self-disclosure will be the number one factor for reducing a potential fine and penalty.  3. Expect more individual accountability.    Learn more about your ad choices. Visit megaphone.fm/adchoices

Messaging Apps There was a significant addition to the language around messaging apps. The ECCP opened this section by noting, “Messaging applications have become ubiquitous in many markets and offer important platforms for companies to achieve growth and facilitate communication.” For any company under investigation or in a FCPA enforcement action, the DOJ will evaluate its “policies and mechanisms for identifying, reporting, investigating, and remediating potential misconduct and violations of law governing the use of personal devices, communications platforms, and messaging applications, including ephemeral messaging applications.” Internal Compliance Controls Under Section II, entitled Is the Corporation’s Compliance Program Adequately Resourced and Empowered to Function Effectively?  We find the new language, “In this regard, prosecutors should evaluate a corporation’s method for assessing and addressing applicable risks and designing appropriate controls to manage these risks.” This simple sentence packs quite a punch as it requires both appropriate internal compliance controls and then monitoring of those controls to see if they are managing the risks identified in the risk assessment. Adequate Compensation and Salary/Bonus Review for Compliance Under Section III, there is a significant new addition to the ECCP. It forces a company to adequately compensate those employees who investigate and pass judgment on misconduct. But it is more than simply adequate compensation, as it also requires a company not to retaliate via low salaries, limited raises, or other compensation for doing their jobs as compliance officers. In other words, if the CEO is being investigated by compliance, that same CEO should not be setting or reviewing the salary of the CCO or those doing the investigation. This mandates that the DOJ review the entire corporate organization on these issues. Three key takeaways: 1. Communications compliance will be a key issue for compliance professionals going forward in 2024. 2. You must have both appropriate internal controls and ensure they are functioning. 3. In addition to adequate resources, a compliance function must be shown to adequately pay, promote, and protect those involved in compliance investigations. Learn more about your ad choices. Visit megaphone.fm/adchoices