Client Alert: Changes to DOJ Corporate Compliance Review
SEPTEMBER 23, 2024
Three – No, Four – Important Revisions to the Department’s Policy on the Evaluation of Corporate Compliance Efforts
BETHANY HENGSBACH, MANAGING DIRECTOR, GLOBAL CORPORATE
COMPLIANCE, AFFILIATED MONITORS, INC.
STEVE SOLOW, PRINCIPAL, SOLOW, PLLC; MANAGING DIRECTOR, GLOBAL
COMPLIANCE AND CORPORATE CULTURE, AFFILIATED MONITORS, INC.
In a speech at the Program on Corporate Compliance and Enforcement at NYU School of Law, Nicole Argentieri, Acting Assistant Attorney General of the Criminal Division, announced key revisions to the March 2023 Evaluation of Corporate Compliance Programs (ECCP). The September 17, 2024 speech was followed by the release of the updated ECCP on the DOJ website. The revised ECCP converts leading edge compliance efforts into SOPs against which companies will be judged by the Department of Justice (DOJ) when making prosecution decisions. The primary changes include three new areas of focus, and a fourth important expansion of a pre-existing idea:
AI: Has the company mitigated risks of the misuse of AI, and has the company sought to use AI to mitigate its own risks of non-compliance?
Whistleblowers: In keeping with DOJ’s emphasis on whistleblowing and whistleblower awards, what concrete efforts can be shown that increase the likelihood of employees’ willingness to speak up and report misconduct? Conversely, DOJ will look to see if there are ways that a company has reduced the likelihood of having a “speak up culture.”
Data and Resources: The new ECCP creates the expectation that companies will push data and resources into their compliance efforts. Presumably tied to the above focus on AI, the government expects to see creative, risk-based efforts to use resources and technology for compliance at comparable levels as those being used to enhance business efforts and increase revenues.
Incorporating Lessons Learned: DOJ notes that companies will be judged not only on what they do, but on what they have learned from their own shortcomings and from the shortcomings of other companies. DOJ will expect to see evidence that the company has incorporated those lessons learned into their compliance efforts.
These changes fit into the increasing sophistication DOJ brings to the analysis of compliance. This includes a focus on culture, and consideration of prior compliance failures across the totality of compliance obligations, as set forth in a 2022 talk at NYU by Deputy Attorney General Lisa Monaco.
Long gone are the days when a company could come to DOJ armed with information about how they have met the seven factors for compliance found in Chapter 8 of the US Sentencing Guide-lines, or even the guidance contained in the original ECCP. Now there are the added expectations above, including that compliance programs cast a wider net to identify and learn from compliance shortcomings, including those of their competitors.