New FCPA Corporate Enforcement Policy: Effective Compliance Programs Now More Important Than Ever
Business Law Alert 11/30/17 Edwin J. Broecker
On November 29, Deputy Attorney General Rod Rosenstein announced that many of the policies adopted in the 2016 Pilot Program would be incorporated into the U.S. Attorneys' Manual and become "more permanent." This is a major policy shift because earlier this year, the one year pilot program was only renewed on an interim basis. To be clear, the policy, like all the prior announcements, is guidance to provide "greater clarity" into the Department of Justice's (DOJ) decision making process in resolving FCPA enforcement actions, but is not "binding" against the DOJ.
The key purpose of the Pilot Program was to promote and incentivize voluntary self-disclosures. In his remarks, Mr. Rosenstein stated two new enforcement presumptions and one guidance making it clearer the incentives associated with voluntary self-disclosure:
- First, the new Policy states that when a company satisfies the standards of voluntary self-disclosure, full cooperation, and timely and appropriate remediation, there will be a presumption that the DOJ will resolve the company’s case through a declination. That presumption may be overcome only if there are aggravating circumstances related to the nature and seriousness of the offense, or if the offender is a criminal recidivist. The formal presumption announced in the new Policy provides greater assurance that companies which voluntarily disclose should not be prosecuted absent compelling, aggravating circumstances. Nevertheless, the policy also makes clear that companies should expect to disgorge any ill-gotten profits.
- Second, if a company voluntarily discloses wrongdoing and satisfies all other requirements, but aggravating circumstances compel an enforcement action, the DOJ will recommend a 50% reduction off the low end of the Sentencing Guidelines fine range.Repeat offenders may not be eligible for such credit. Here again, the new Policy is trying to provide greater transparency into the DOJ procedures. Under the Pilot Program, the credit would only be "up to" 50% reduction.
- Third, the Policy provides details about how the DOJ evaluates an appropriate compliance program, which will vary depending on the size and resources of a business. While judging the "effectiveness" of a compliance policy has been a discussion within the DOJ for months (recall the Guidance Document issued in February 2017), having specific criteria incorporated into the U.S. Attorneys' Manual is new.
Under the updated U.S. Attorneys' Manual, the criteria for evaluating the "effectiveness" of the compliance and ethics program may include:
- The company’s culture of compliance, including awareness among employees that any criminal conduct, including the conduct underlying the investigation, will not be tolerated;
- The resources the company has dedicated to compliance;
- The quality and experience of the personnel involved in compliance, such that they can understand and identify the transactions and activities that pose a potential risk;
- The authority and independence of the compliance function and the availability of compliance expertise to the board;
- The effectiveness of the company’s risk assessment and the manner in which the company’s compliance program has been tailored based on that risk assessment;
- The compensation and promotion of the personnel involved in compliance, in view of their role, responsibilities, performance, and other appropriate factors;
- The auditing of the compliance program to assure its effectiveness; and
- The reporting structure of any compliance personnel employed or contracted by the company.
- Appropriate discipline of employees, including those identified by the company as responsible for the misconduct, either through direct participation or failure in oversight, as well as those with supervisory authority over the area in which the criminal conduct occurred;
- Appropriate retention of business records, and prohibiting the improper destruction or deletion of business records, including prohibiting employees from using software that generates but does not appropriately retain business records or communications; and
- Any additional steps that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risks.
The importance of a robust and effective ethics and compliance program is probably the most important take-away from Mr. Rosenstein's announcement. The FCPA Professor has already suggested that the new Policy is a move toward recognizing a "compliance defense" to enforcement action. The key element of such a defense will be having an "effective" program, at least at the time of the disclosure.
For more information regarding the new FCPA Corporate Enforcement Policy, please contact Ed Broecker at [email protected]/(317) 399-2828 or your Quarles & Brady attorney.