The United States Department of Justice (DOJ) is the federal agency tasked with enforcing a wide range of federal laws and regulations. When the DOJ suspects that an individual or business has violated a federal law or regulation, it will initiate an investigation.
The existence and nature of the investigation may or may not be made known to the subject. Depending on the allegations, a DOJ investigation can end in civil or criminal liability, including a federal prison sentence. However, not every federal investigation ends in charges being filed against the subject. One of the criteria DOJ prosecutors rely upon when determining whether they bring formal charges is the existence of a DOJ compliance policy.
While the DOJ oversees the enforcement of most federal laws and regulations, over recent years, investigators have shown the greatest interest in the following potential violations:
- Healthcare Compliance
- Foreign Corrupt Practices Act (FCPA) Compliance
- National Security Compliance
- Political Law and Campaign Finance Compliance
- Federal Contract and Program Compliance
- Antitrust and Securities Law Compliance
- Data Security and Consumer Fraud Compliance
- Financial Transactions, Tax, and Cryptocurrency Compliance
Businesses that may incur federal scrutiny based on any of these laws must take all necessary steps to ensure that they are not only in compliance but that they have a comprehensive DOJ compliance program on the books.
What Is a DOJ Compliance Program?
Simply put, a DOJ compliance program is a written set of policies and procedures that outlines how a business plans to comply with federal laws and regulations. The contents of a compliance program will vary depending on an organization’s unique risk factors.
The Importance of a Robust DOJ Compliance Program
For several reasons, a DOJ compliance program is critical to the long-term success of any business that falls under federal scrutiny. First, the process of creating and maintaining a DOJ compliance program uncovers potentially undiscovered risks, allowing the company to address possible inadvertent violations.
In other words, organizations may learn more about their compliance obligations by creating a compliance program. In turn, this often leads to a decreased likelihood of a federal investigation.
However, even with a compliance program, accidental errors can still occur. Perhaps the most compelling reason to develop a comprehensive DOJ compliance program lies in the fact that having such a program can persuade investigators not to pursue charges.
The DOJ provides guidance to federal prosecutors in their assessments of when to bring charges and how to conduct plea negotiations in the event of a violation of federal law.
According to the most recent DOJ guidance, prosecutors should consider “the adequacy and effectiveness of the corporation’s compliance program at the time of the offense, as well as at the time of a charging decision and the corporation’s remedial efforts to implement an adequate and effective corporate compliance program or to improve an existing one.”
Thus, per DOJ guidance, the existence of a compliance program can put corporations in a much more favorable position should they find themselves at the center of a federal investigation. Essentially, an effective compliance program can stop an investigation in its tracks.
Steps to Creating and Maintaining an Effective DOJ Compliance Program
Developing a DOJ compliance program requires advanced knowledge of both the business landscape in which a corporation operates as well as all the relevant federal laws and regulations. One of the most challenging aspects of creating and maintaining a DOJ compliance program is that federal laws and regulations are frequently changing. Thus, it is important for corporations to work with an experienced DOJ compliance law firm to ensure that the policies and procedures laid out in the compliance program are up-to-date. This is the first step towards developing a robust DOJ compliance program.
When selecting a DOJ compliance lawyer, corporations should keep in mind that federal prosecutors overseeing these investigations are highly experienced in their respective practice areas. Federal investigators are often assigned a relatively narrow scope of cases, allowing them to develop a detailed knowledge of the practices, customs, regulations, and laws governing that particular business. Thus, having an attorney who is similarly knowledgeable is imperative.
What Should a Robust DOJ Compliance Program Contain?
In the DOJ’s eyes, a compliance program should be designed to “maximum effectiveness in preventing and detecting wrongdoing by employees." While the written words contained in the compliance policy are important, they are also insufficient on their own; the DOJ wants to see that the program sends a clear message to employees that any misconduct will not be tolerated and that the company stands behind the importance of compliance, as evidenced by its day-to-day operations.
The DOJ asks investigators to consider three main questions when assessing a compliance program:
- Is the compliance program well designed?
- Is the compliance program effective?
- Does the compliance program work in practice?
Each of these is addressed in turn below.
A Well-Designed Compliance Program
As a result, when DOJ investigators assess a corporation’s compliance program, they will consider the following:
- Whether the corporation conducted an adequate risk-assessment;
- Whether the corporation implemented policies and procedures to address any industry- and business-specific compliance obligations;
- Whether the corporation takes the necessary steps to ensure its compliance program is well-known and understood by employees;
- Whether the program provides a mechanism for confidential reporting and identifies a clear investigatory process; and
- Whether the program considers the compliance requirements when dealing with third parties, such as customers, vendors, payroll companies, etc.
An Effective Compliance Program
The DOJ is not only interested in seeing that a corporation took the time to create a compliance program but also that the corporation carries out its daily business in a way that indicates management is serious about compliance. Thus, a robust DOJ compliance program is one that is “implemented, reviewed, and revised, as appropriate, in an effective manner.” The DOJ also wants to see that “the corporation has provided for a staff sufficient to audit, document, analyze, and utilize the results of the corporation’s compliance effort.”
For example, the following considerations should be addressed:
- Does a corporation’s management foster a culture of compliance?
- Are compliance officers provided the autonomy and authority to enforce the program?
- Are there incentives and disciplinary processes in place to encourage compliance?
In other words, a program that looks good on paper but doesn’t have the support of management is unlikely to provide the desired level of protection.
A DOJ Compliance Program the Works in Practice
A robust DOJ compliance program helps a corporation avoid inadvertent violations. As noted above, federal investigators engage in a multi-faceted inquiry when making charging decisions.
- Whether a compliance program was effective at the time of the alleged violation; and
- Whether a compliance program is effective at the time of charging.
This first inquiry is backward-looking in that it requires investigators, after finding a potential violation, to determine whether a compliance program was effective. Notably, the DOJ acknowledges that “the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense… if a compliance program did effectively identify misconduct, including allowing for timely remediation and self-reporting, a prosecutor should view the occurrence as a strong indicator that the compliance program was working effectively.
Thus, one of the key criteria in assessing whether a DOJ compliance program works in practice is whether the program allowed for the detection of potential misconduct in a timely manner. The DOJ will also consider what resources were in place to investigate suspected misconduct and the nature and thoroughness of the corporation’s remedial efforts.
In determining whether a compliance program is effective at the time of the charging decision, DOJ investigators consider whether the program evolved over time to address the potential violations. Also relevant is whether a corporation undertook efforts to identify the root cause of the misconduct.
Dr. Nick Oberheiden, a DOJ compliance attorney, explains,
In theory, compliance is easy to wrap your head around. So too is the manner in which the DOJ reviews compliance programs. Essentially, the DOJ wants to see that a well-designed program exists, that it is supported by management, and that it actually works to identify potential misconduct. However, in practice, corporations often have trouble developing and maintaining a robust DOJ compliance program, given the complexity of the changing federal regulations. This is especially the case for corporations that do not have a complete vision of the unique compliance risks they face. Every business is different, and no two DOJ compliance programs should be identical. Given the stakes involved in a federal investigation, corporations should create custom-tailored DOJ compliance programs uniquely tailored to their specific business.
For Businesses Subject to a Possible Federal Investigation, the Importance of a Robust DOJ Compliance Policy Cannot Be Overstated
When the DOJ opens an investigation into alleged misconduct, it has not yet decided that a violation has occurred. Even if investigators substantiate their belief that a company ran afoul of federal law, there may still be ways to avoid formal charges. An organization facing a DOJ investigation can use its compliance program as the first line of defense. Frequently, when the DOJ realizes a corporation has implemented a well-designed and effective compliance program that management takes seriously, investigators will close out the investigation.
Even the management teams that believe their organization is in full compliance should ensure the organization has a robust DOJ compliance program on the books, as even well-informed management teams cannot address those issues they are currently unaware of. For organizations that know or fear they are not in full compliance, the importance of retaining dedicated DOJ compliance counsel is even more critical.
