Is your compliance program consistent with industry best practice?

Is our compliance program consistent with industry best practice?  Wow, what a scary question.  Gee, is there even a possible antitrust risk in trying to make our compliance program “consistent with industry best practice”?  What difference does it make of what other companies are doing, as long as I hit the minimum standards for a program? Who would even ask a question like this? 

Here’s one answer:  the US Department of Justice, Antitrust Division; the part of DOJ that enforces criminal antitrust law, including any conspiracies among competitors.  In this Division’s version of the ECCP,[1] the Division tells its enforcement people, in evaluating your program, to ask this question: 

“Is the company’s antitrust compliance program tailored to the company’s various

industries/business lines and consistent with industry best practice?” [emphasis added]

So, if you are dealing with these enforcers, you can’t just look inward.  You also need a sense of what others are doing in their compliance programs.  For example, if a DOJ investigator sees that comparable companies have fully empowered, independent chief ethics and compliance officers (“CECOs”) with substantial resources, and CECOs in other companies are reporting to and controlled by the board, and all you have is a junior lawyer you call the “compliance officer” who is nowhere near what other companies have, you will have some tough explaining to do.  

Where does this language come from?   Like many aspects of our field, it can be found in what might be considered the Magna Charta of compliance and ethics, the US Sentencing Guidelines (“USSGs”). However, like many of the important points in the USSGs, it is frequently overlooked by many who have looked at the standards there.  Readers typically ignore the instructive notes that are part of the USSGs.  It is there that one can find the reference to “applicable industry practice.”

Here is the language from the notes, which has been a part of the USSGs since the original version promulgated in 1991:

USSGs Commentary

Application Notes:

.  .  .

1. 2. Factors to Consider in Meeting Requirements of this Guideline. —

(A) In General. —Each of the requirements set forth in this guideline shall be

met by an organization; however, in determining what specific actions are

necessary to meet those requirements, factors that shall be considered

include: (i) applicable industry practice or the standards called for by any

applicable governmental regulation;

(B) Applicable Governmental Regulation and Industry Practice. —An

organization’s failure to incorporate and follow applicable industry

practice or the standards called for by any applicable governmental

regulation weighs against a finding of an effective compliance and ethics

program. (emphasis added)

What the Antitrust Division asks ties directly to this USSGs reference.  But then the logical question would be where is this USSGs reference from?  Did the Sentencing Commission create this from the imaginations of its staff in drafting the standards?  Actually, there is no speculation involved in this question.  The industry practice reference ties directly back to another historical development in field that was a precursor to the USSGs. 

This takes us back to a 1980s development called the Defense Industry Initiative on Business Ethics and Conduct (known generally as “DII”).  This was a group of defense contractors, formed as a reaction to the defense industry-wide scandal known as Ill Wind.[2] They formed DII in an effort to reestablish credibility and commit to legal and ethical practices.  In this process they committed to a list of practices including these two:   

(4) We shall share best practices with respect to business ethics and

compliance, and participate in the annual DII Best Practices Forum.

(5) We shall be accountable to the public, through regular sharing and

reporting of signatory activities in public fora, including www.dii.org . These

reports will describe members’ efforts to build and sustain a strong culture of

business ethics and compliance.[3]

These DII Best Practices forums were in fact the prototype for the various C&E gatherings that flourish today. 

What is the message here?  You clearly cannot do the diligent work the government expects just sitting in your office reading the government standards.  You also need to know what others are doing, particularly those who face the same types of risks you face.  In fact, you cannot really do a complete assessment of what those risks may be without looking out to see what risks comparable companies have, in fact, faced. 

But also consider the experience of the government folks who will be asking you about your compliance program, and the ones you will be trying to convince that your company acts in good faith and has built a serious compliance and ethics program. 

What is the reality and psychology at issue here?  Suppose you work for DOJ or the SEC or the UK’s Serious Fraud Office or any other enforcer or regulator anywhere around the glove.  You are expected to consider a company’s compliance and ethics program. You have been doing this for a while. A potential defendant your office has been investigating offers to come into your office and give a presentation on its compliance program.  You’ve been through quite a few of these now.  You may even have attended a conference on this topic. 

You know what your agency says publicly what it wants to see. You know the stated standards and questions.  But you most remember the other folks who entered your conference room. You remember the strong features all the good ones had, and the sorry examples of those with so little.  So as a human being you are going to have those examples in mind when the next company appears. Is this normal human tendency consistent with the expected standard of assessment?  Absolutely – this is what “industry practices” or “best practices” or “industry standards” is about.

If you are going to be a good advocate for your client’s compliance program, know at least as much as the person on the other side of the table whose job it Is to assess companies’ C&E programs.  You can’t do that if you don’t know what else is going on in the           C&E field.  You do not want to be the one telling DOJ that “this is impossible” or “this doesn’t work” or “it’s unreasonable to expect us to have a speak up line.”   Once they have seen other companies do something successfully, they have just shut down all the excuses management has given you for not doing it. 

You want to be the one who is present when the government investigator says:

“Well, honestly that is quite impressive.  And you should know that when we interviewed your people they all were familiar with your program.  Of the many programs we’ve seen, yours does stand out in its seriousness.”

Perhaps this little exchange with the government also means “you get to keep your job and will see real appreciation in your next evaluation and appearance before the board.” 

If you are a good businessperson and good C&E professional, then by all means take advantage of the various opportunities to learn important lessons from others’ experiences.  Attend the compliance practices forums – local, national, international.  Keep up on LinkedIn. Of course, follow our newsletter.

And remember, this has been a strong and essential part of the C&E profession from the beginning.  We share our knowledge and experience and help all our colleagues who do the day-to-day work to prevent illegal and unethical practices in our companies and other organizations.   

[1] U.S. Department of Justice, Antitrust Division, Evaluation of Corporate Compliance Programs in Criminal Antitrust Investigations (November 2024), p. 8  https://www.justice.gov/atr/media/1376686/dl

[2] See Andy Pasztor, When the Pentagon Was for Sale: Inside America’s Biggest Defense Scandal (1995).

[3] https://higherlogicdownload.s3.amazonaws.com/DII/b52278df-d15b-4fa7-a326-9894c0ff0ea7/UploadedFiles/FBYARzFSBCjIhRAjweeY_DII%20principles.pdf