Unfinished Business at the Department of Justice

The modern era of compliance began in 1991 with the advent of the Corporate Sentencing Guidelines (“the Guidelines”).  The Guidelines and related Department of Justice (“DOJ”) policy did this by providing enforcement-related incentives for companies that had developed effective compliance programs. 

The perverse incentive. However,  in what some of us saw as a perverse incentive, DOJ’s actual practice indicated that a company could receive an enforcement benefit (typically a low fine but also leniency in related matters, such as whether to be required to engage a monitor ) for a program implemented after its offense had occurred, but not discussing or publishing cases where benefits came from a compliance program that had existed before.   

For example, in the FCPA area in years of enforcement activity there was apparently only one case that gave credit (in the form of a declination to prosecute) for a prior existing program – the Morgan Stanley case, in 2012. But this was also a case where the company voluntarily and fully disclosed to the government, and where the company itself was a victim of employee actions.  In other words, while DOJ clearly praised the prior compliance program, the facts suggested this was not the kind of case that merited tough action against the company.  But this case was THE case, not just for FCPA, but for any enforcement we are aware of by either the Criminal Division or the Antitrust Division, where a prior existing compliance program was credited or discussed publicly.    

There have, in fact, been many enforcement cases over the years, with much said about compliance programs.  But other than Morgan Stanley the only reference to compliance programs as positive factors of which we are aware is exclusively about those implemented after a violation occurs.   

In other words, based on the reports of actual cases, a company might conclude that it was in their interest to wait and see if they got in trouble before implementing a compliance program, or at least hold off before doing powerful compliance program measures like addressing incentives or fully empowering the chief ethics and compliance officer (“CECO”).  

With such perverse incentives, what might a rational company general counsel do?   Consider a discussion with such a completely rational general counsel.  She carefully examines the fact patterns in the cases. She does not see cases where companies are recognized or rewarded for their compliance programs implemented before a violation. She does not see companies criticized for having weak programs before a violation occurred. The only response from DOJ relates to program activity implemented after a violation occurs.  

The message our general counsel sees is that you could spend a lot of money and resources to design a state of the art, powerful program today.  But reality is what it is, and you still might have a violation. The cases signal that the government only seems to care what you do AFTER a violation occurs.  But if you had already done so much to be effective and strong, then if a violation does occur you now have difficulty doing enough new things to impress the government.  Might our rational general counsel conclude that her company should just do a few things she thinks are enough for now (a policy, some legalistic online training, a phone line people can call if they speak English and trust it, a mid-level lawyer as “compliance officer”), and hold back on doing more effective but resource-intensive or intrusive things unless and until a problem occurs?  Her company saves money and resources today, and if a violation occurs, she can now impress the government by installing what the company should have done before.   

But clearly this state of affairs would not be in society’s interest. 

Over time DOJ has been providing increasingly detailed direction on how to make a program effective. However, in all this time we have heard little from the government to suggest that companies are in fact getting enforcement-related benefits for implementing what is referred to as “pre-existing programs,” i.e., meaning a program created before the offense in question. 

Note that we cannot absolutely say that there are zero actual cases of this sort where the government did consider a company’s prior-existing program and took it into account. We just do not see or hear about any such cases.  But by not doing more to publicize such cases DOJ is missing out on a chance to negate the perverse incentive – and to further promote compliance.  

Stories are powerful teaching tools. Indeed, compliance professionals might well note the irony of the situation: it is well established that in designing and implementing a compliance program’s training and other communications elements, the program should include actual cases of wrongdoing so that everyone can learn important lessons relating to compliance.  We know well that the best way to reach people is through actual stories.  DOJ’s own guidance in evaluating compliance programs asks if companies are doing this.  They know people remember stories better than they do dry lectures or rules.  Yet when it comes to learning from positive experiences (developing/implementing effective compliance programs) and negative experiences (weak programs that get and deserve no credit) the government is strangely silent.  

Is DOJ prevented from telling us more about the cases? Why is this? Why do we hear no stories from which we can learn important compliance program lessons?  Does this reflect a reluctance to talk about or draw lessons from actual cases?  You would believe that only if you don’t read DOJ press releases.  Read what they say about what really matters: Voluntary disclosure.  Cooperation.  Remediation after the fact.  Do you think lawyers don’t talk about actual past cases?  Then go to any legal conference and hear all kinds of lawyers talk about actual cases. They, like DOJ, know how to convey lessons learned from actual experiences without disclosing any confidences. Here is the bottom line.  There is absolutely no reason DOJ cannot share lessons learned and taught by the cases.  Of course they can do this without disclosing what cases were involved.  That seems to be a skill that every lawyer must have learned in the first year of law school.   

So we look to the government in the desire to promote effective compliance programs.  Where are the stories we can use to motivate our managers?  Where are the factual examples that can convince our boards of directors?  How do we prove to normal people that this is more than just talk by the government, and that those regulators and enforcers actually care about all the work we did to create effective compliance programs before a violation occurred? 

A company scenario. Picture this scenario. Another general counsel wants to implement a compliance program at her company but other senior managers are pushing back, expressing concern that a program will take up too much time and resources. The general counsel responds by describing several cases publicized by DOJ where DOJ resolved an investigation leniently – in particular, no criminal charges – based on the strength of the respective targets’  pre-existing compliance programs. The DOJ publicity had identified key aspects of these programs – including but not limited to strong oversight by the board of directors, an empowered CECO, a comprehensive risk assessment, rigorous auditing and self-assessment and incentives for effective compliance. Based upon this  precedent the general counsel persuades her colleagues to authorize the development of a compliance program. Later on, and notwithstanding the strength of this program an employee violates the law and the DOJ  launches an investigation. Will the DOJ give the company credit for its strong compliance program in determining how to resolve the matter?  

DOJ has given us a whole manual of questions about our compliance programs, but in the critically important context of pre-existing programs no actions that also speak to us. Where is the proof that any of these DOJ compliance program guides and manuals actually matter? 

We urge the government to tell us about their actions that back up their words. Show us you really do apply the words you are offering us. Show us by your actions that what we do in our compliance programs to prevent violations actually does matter.