Publications
The Essentials of a Corporate Compliance Program
The Organizational Sentencing Guidelines
In 1991 Congress implemented the Federal Sentencing Guidelines for Organizations, which were intended to accomplish the twin goals of deterrence and punishment through the imposition of mandatory restitution, substantial monetary fines and a variety of other measures. The Organizational Guidelines provide that the existence of an internal compliance program to prevent, detect and facilitate the reporting of criminal conduct constitutes a mitigating factor that may justify a significant reduction in the applicable fine or other penalties. As discussed below, the Organizational Sentencing Guidelines establish seven factors that, if adopted, serve as the basis for a qualifying compliance program.
In re Caremark
A recent ruling by Chancellor William T Allen of the Delaware Chancery Court has rendered internal compliance programs even more valuable to corporations, by suggesting that good faith attempts to implement and monitor internal compliance programs should satisfy a director’s duty of care to oversee corporate operations. Thus, the existence of a legitimate compliance program may very well insulate directors from shareholder derivative suits. The directors cannot be faulted, according to Chancellor Allen, for the fact that they did not know the specifics of the activities that led to the lawsuit, if a program is in place that represents a good faith attempt to be informed of relevant facts. Equally significant, the Caremark decision suggests that the absence of a compliance program may increase the likelihood of a finding that the directors breached their duty of care.
Understanding The Guidelines’ Seven Criteria In Practice
The import of Caremark and the Organizational Sentencing Guidelines is that a company’s compliance program must be designed to prevent, detect and facilitate the reporting of criminal conduct. The Guidelines’ seven criteria provide a useful way of assessing the effectiveness of a compliance program.
- Established compliance standards and procedures should be written, along with an established compliance infrastructure that clearly identifies the chain of authority for compliance responsibilities. The compliance standards and procedures should be documented in materials such as compliance manuals, employee handbooks, corporate policy and mission statements and auditing and monitoring practices.
- Assignment of overall responsibility to specific high-level personnel to oversee compliance with standards and procedures should focus on requiring accountability from the highest levels of the company on down. The company should require top executives to take part in key compliance meetings and training, and should place responsibility – whether through discipline or otherwise – for violations that happen on an executive’s watch. Active board oversight of the program should be mandated, including periodic reports to the board or audit committee.
- Careful delegation of substantial discretionary authority must be undertaken to ensure that such authority will not reside in individuals whom the organization knows, or should know through the exercise of due diligence, have a propensity to engage in illegal activities. The company must be able to show that it is using reasonably diligent and vigorous screening methods in the hiring of employees, such as background checks and the use of probing questions in interviews and employee applicant questionnaires.
- Effective communication of standards and procedures to all employees and other agents should be accomplished by requiring participation in training programs and disseminating information explaining in a practical manner what is required. Effective and practical communication can take such diverse and creative forms as e-mail, posters, coffee mugs, ethics simulations or intra-net or CD-ROM computer programs for employee compliance training and reference.
- Reasonable steps to achieve compliance is the most critical of the criteria. It may be satisfied by utilizing monitoring and auditing systems reasonably designed to detect criminal conduct by employees and other agents and by having in place and publicizing a reporting system whereby employees and other agents can report unlawful conduct by others within the corporation without fear of retribution. The company must practice true self-policing by establishing a compliance hotline or post office box and/or a compliance ombudsman position, with demonstrated follow-up of all reports except those that are patently frivolous.
- Consistent enforcement through appropriate disciplinary mechanisms and appropriate responses to committed offenses go hand in hand. The company must show that it does not tolerate employees who violate ethical or legal codes and standards. If it is clear that a crime has been committed, the company should not wait for the government to take action. Rather, the employee must be disciplined or terminated. If appropriate, the company should also discipline individuals responsible for the failure to detect an offense. Prevention of further similar offenses should include any necessary modifications to the compliance program to prevent and detect future similar violations.
Although an effective program must, at a minimum, satisfy these criteria, an organization must be careful not to set standards that it cannot meet; a failure to comply with one’s own internal standards will not only reflect poorly for criminal liability, but can also cause problems in civil litigation. For example, a company’s commitment to uphold domestic environmental standards in its world-wide operations, although well-intentioned, could prove difficult to satisfy and might operate to make the company look worse in litigation when it is demonstrated that such standards have not been met.