According to statements by a Department of Justice official, corporate Chief Compliance Officers will in the future have to take a more exposed position by providing certifications in settlements with DOJ. Further, corporations should consider specific steps to take that DOJ would consider in evaluating whether the company has built an effective compliance program consistent with the required certifications.

On June 22, Lauren Kootman, Assistant Chief of DOJ’s fraud section’s corporate enforcement, compliance and policy unit, expanded on DOJ’s recent indications that it will require chief compliance officers, along with CEOs, to certify in settlements with DOJ that compliance programs have been “reasonably designed” to prevent future violations. She stated that “The certifications are going to be incorporated into every — most likely — into every resolution,” and added a discussion of steps companies can take to build effective compliance programs.

Perhaps responding to criticisms that the certification requirement exposes CCOs to excessive risk and judgments as to the “reasonableness” of such certifications, Kootman stressed DOJ’s position that the requirement is designed to “empower” CCOs and their influence in organizations. She stated that DOJ’s certification requirement “is not to put a target on the back of a chief compliance officer,”

Kootman went on to describe specific steps DOJ believes can help companies ensure that their compliance programs are “adequately resourced and empowered.” Simply citing the amount of money, staff and resources dedicated to compliance is not informative – companies should consider specific questions and criteria.  These include:

• The CCO having a full roll in development and evaluation of compliance steps. “[Does the] compliance officer … have access to important information? Or do they have a seat at the table? Are they being involved in high-risk transactions [and similar] important decisions at the company?”
• Surveys of employees and analysis of those surveys.
• Tying compensation to compliance incentives.
• An effective process that deals with potential misconduct or violations, including reporting, thorough investigation of concerns, and collection and preservation of information, including a focus on preserving employee communications on company and personal devices.

Certifying the reasonableness of steps taken by a settling company to ensure that such issues do not occur again obviously significantly increases risk exposure for CCOs.  Corporations and CCOs will have to be even more diligent in the buildout of compliance programs and response to potential mistakes and violations.

*Michael Flynn - Admitted to practice in California, the District of Columbia, and Michigan, and in Colorado temporarily authorized pending admission under CRCP205.6