In this and subsequent posts, we will look at ethics and compliance programs and how their structure and implementation is imperative to companies that not only aspire to abiding by the laws governing their industry, but also want to build a culture of integrity and accountability.

The U.S. Department of Justice (DoJ) outlines how its prosecutors should assess the effectiveness of ethics and compliance (E&C) programs in its Evaluation of Corporate Compliance Programs. The document is designed to assist its “prosecutors in making informed decisions as to whether, and to what extent, the corporation’s compliance program was effective at the time of the offense, and is effective at the time of a charging decision or resolution.” With that information, they can then determine an appropriate resolution and whether there should be a monetary or other penalty.

While the DoJ considers a company’s size, industry, regulatory landscape and other “factors, both internal and external to the company’s operations” for every case, its prosecutors are given only three “fundamental” questions to determine effectiveness of an E&C program:

Is the Corporation’s Compliance Program Well-Designed?

This guiding question outlines the factors prosecutors should use in determining whether E&C programs are designed for maximum effectiveness. The report focuses on whether the program prevents and detects wrongdoing and if organization’s management enforces the program or “is tacitly encouraging or pressuring employees to engage in misconduct.”

The DoJ encourages its prosecutors to strive to understand how the company has defined its risk profile, why it chose to design its E&C program as it is and how the program has evolved over time. Key metrics they consider include the company’s risk-management process, whether it focuses on high- or low-risk areas, how often they perform review and revision of the plan and if they track “lessons learned” from its own experiences or by incidents at others in its industry.

Is the Program Adequately Resourced and Empowered to Function Effectively?

A well-designed program that lives “on paper,” but isn’t backed up by action and resources, cannot be implemented properly, according to the DoJ. The focus in this section of the Evaluation of Corporate Compliance Programs is on the commitment to “create and foster a culture of E&C” across the organization and the provision for “a staff sufficient to audit, document, analyze, and utilize the results of the corporation’s compliance efforts.”

The agency looks at several metrics to determine if the E&C program is adequately resourced and reiterates the need for adequate communication with employees about expectations for integrity. It states that a requirement for companies should be that a “culture of compliance include[es] awareness among employees that any criminal conduct … will not be tolerated.”

Does the Corporation’s Compliance Program Work in Practice?

In this part of the document, the DoJ again references the “continuous improvement, periodic testing and review” of effective E&C programs. In fact, it states that prosecutors may reward organizations’ efforts to review and update their E&C programs, as the business and surrounding environment change over time.

The way in which organizations handle investigations of misconduct also are illustrative of whether E&C programs work in practice. This does not mean that misconduct is absent in organization with E&C programs that “work.” Also, they acknowledge that the timely identification and remediation of misconduct should be viewed as a “strong indicator that the compliance program was working effectively.”

This section is backward-looking and concentrates on the methodology behind how investigations of misconduct are handled.  Acknowledging that “no compliance program can ever prevent all criminal activity by a corporation’s employees,” here are what the DoJ considers hallmarks of an effective E&C program:

• Continuous improvement, periodic testing and review with internal audits; testing of controls, collection and analysis of compliance data; and interviews of employees and third parties;
• Properly scoped and effective investigation of misconduct by qualified personnel with an established system for documenting the company’s response, including any disciplinary or remediation measures taken; and
• Analysis and remediation of underlying misconduct to include reviews of the root cause, prior weaknesses, payment systems, vendor management, remediation and accountability.

These guidelines are useful and set the minimum requirements needed for E&C programs. Those who must create and implement them – and grow cultures of integrity around E&C – need to know the framework for creating an effective E&C program.

In our next post, we will explore how to go beyond the basic DoJ requirements to create an effective ethics and compliance program. ECI research has found that organizations that implement the best practices of effective E&C programs experience myriad positive results.

For more information on our updated HQP Assessment Tool, contact: hqp@ethics.org or visit www.ethics.org/hqp/.