In our last alert, we discussed the first three fundamental categories of an effective compliance program: (1) Risk Assessment; (2) Management Buy-in; and (3) Code of Conduct [see our previous alert for the full discussion on these categories]. The next four are just as crucial:
These core principles are the foundation of an effective compliance program in any size business. The ways in which the principles are implemented, however, will vary depending on the context of the business. Such adaptations for different sized businesses will be the subject of a future alert. But all leaders should consider whether their business has a compliance program at all and, if so, whether it is sufficiently robust to address each of these principles. If not, the first step is for management to direct an integrity evaluation and risk assessment and implement or upgrade the current compliance program.
- Training and Communication: An effective compliance program must be clearly communicated to all levels of the organization. Communication alone, however, is not enough. The company must allocate the resources to provide and document effective training of employees with regard to compliance issues.
- Reporting: Reporting includes at least two critical aspects. First, the company must be clear that every employee has both the duty, and also the opportunity, to report any potential violation of the company’s integrity program. That reporting should be designed so that, if necessary, the information reported is kept confidential, and the reporting employee may remain anonymous. There must be an express (and enforced) prohibition on retaliation for such reporting. Second, there must be clear channels for updates, oversight, and lessons-learned to be communicated to senior management.
- Third parties: An effective compliance program does not only look inward, but also looks outward. Policies and procedures to perform due diligence on third-party business partners are essential to any compliance program. The company must communicate its ethical standards and values expressly to third-party partners. Contracts with such partners should include reference to the company’s integrity compliance program, audit rights, and provision for termination if that partner is found to have violated such standards. There must also be ongoing monitoring of the relationship, including requesting annual compliance certifications, audit rights, and proper internal controls to monitor the payments made to those third-parties.
- Testing, Review, and Adaptation: No integrity program can be constantly effective without continuous improvement. The program must include policies for the regular reevaluation of risk, review of the business environment, testing of controls, and assessment of the program’s current suitability. Further, each time an investigation is conducted, the company should review the process to determine whether improvements should be made. When appropriate, modifications should be made to overcome the shortcomings identified.
Heather Hatfield represents clients in corporate investigations, white-collar crime investigations and defense involving the Foreign Corrupt Practices Act (FCPA), complex contract disputes, oil and gas litigation ...
Blake Runions assists clients with broad range of business disputes and investigatory matters, including partnership disputes, internal investigations, and commercial litigation.
Prior to joining the Firm, Blake worked in the ...
Jamie Godsey represents public and private corporations, partnerships, and small companies on a broad range of complex business and commercial litigation. Her experience includes a wide variety of matters such as contractual ...
- Goldman Sachs Reaches Record $2.9 Billion Settlement of Malaysia FCPA Violations
- Recent Advisory Opinion Provides Important Guidance to Mitigate Sanctions Risk
- DOJ Releases Rare FCPA Opinion Procedure
- Essentra Settlement Demonstrates Government Commitment to Compliance Framework
- DOJ Updates Corporate Compliance Evaluation Guidance
- Political Retribution in Bridgegate Cannot Sustain Federal Fraud Convictions in Kelly v. United States
- Key Considerations in the Timing of FCPA Violation Disclosures
- Ensuring Compliance During the COVID-19 Pandemic
- Former Alston S.A. Exec’s FCPA Conviction Overturned
- Astros Scandal Demonstrates Importance of Tone at the Top