A well-designed program

Prosecutors are encouraged to evaluate compliance programs on a variety of factors, including how well the company has identified its risk profile, how well the compliance program addresses those risks, and whether the program would be expected to detect the sort of misconduct expected to occur in the company’s business operations.

Assessment of risk involves analyzing business operations on a number of parameters. The location of the business, the type of business in which the company is engaged, the competitive pressures on the company in the marketplace, the regulatory framework involved in the company operations, and the type of transactions in which the company is engaged are all significant factors. Corporate compliance programs should engage in “risk-tailoring,” which applies metrics to risk management activities and then tailors the allocation of resources to high-risk and low-risk areas. Finally, risk assessment should be appropriately updated and revised as circumstances change, and particularly as lessons are learned through compliance activities.

Well-designed programs also memorialize best practices in policies and procedures. This should include a corporate code of conduct that establishes a culture of compliance. The manner in which the company designs and implements policies, the comprehensiveness of the policies, employee access to policies, determining who in the organization has responsibility for integrating policies and procedures into corporate operations, and assessing whether key employees have been appropriately trained on their role are all factors that are important for prosecutors assessing a compliance program.

Additionally, prosecutors should evaluate the extent to which training of employees and communication has been designed to effectively communicate policies and procedures based on the audience, subject matter, and sophistication of both what is communicated and the intended audience. In this evaluation, training that employees in key control positions have received, particularly in the context of risk-based training, and the form and content—of both resources readily available and ongoing training—are critical. Training and reference resources should be evaluated for effectiveness using tools such as pre- and post-testing, as well as other metrics that show data over time.

Another parameter that can help define a well-designed compliance program is the existence of a confidential reporting mechanism and an investigative process. Prosecutors are encouraged to consider whether the company has a confidential reporting system, whether it is used, how the company assesses the seriousness of reported issues, whether investigations are properly scoped, whether investigations are conducted by qualified and empowered staff, the promptness of investigation completions, and if follow-up ensures accountability and feedback for the compliance program.

Finally, well-designed compliance programs should include assessment of third-party suppliers, partners, consultants, and distributors, as well as targets of mergers or acquisition. In these circumstances, the compliance program should provide for due diligence and monitoring in fashions akin to the company’s own compliance program. This includes confirming the existence of control mechanisms, particularly with respect to payments, contractual relationships, and metrics in areas designed to detect misconduct and address risks particular to that industry.