Third-party management

The biggest change to this passage in the guidance document is the replacement of “due diligence” with “management.” This change reflects the DOJ view that due diligence is not good enough and that a compliance program should have an ongoing process for evaluating third-party relationships instead of relying on a snapshot.

The emphasis on ongoing monitoring and evaluation is reflected throughout the document. Specifically, in the passages on third-party management, the guidance asks:

How has the company considered and analyzed the compensation and incentive structures for third parties against compliance risks? How does the company monitor its third parties? Does the company have audit rights to analyze the books and accounts of third parties, and has the company exercised those rights in the past? How does the company train its [third-party] relationship managers about compliance risks and how to manage them? How does the company incentivize compliance and ethical behavior by third parties? Does the company engage in risk management of third parties throughout the lifespan of the relationship, or primarily during the onboarding process?

The last sentence is an update from the previous version and underscores the DOJ perspective that monitoring should be ongoing.

Another addition to third-party management pops up in the passages about reporting mechanisms. Here, the updated version includes the added part, italicized here:

“Effectiveness of the Reporting Mechanism – Does the company have an anonymous reporting mechanism and, if not, why not? How is the reporting mechanism publicized to the company’s employees and other third parties?”

This addition addresses the fact that many companies may not be marketing the reporting mechanism to their vendors in a meaningful way, and that needs to change.

Risk-based approach and ongoing monitoring

The new update emphasizes using a risk-based approach and ensuring that monitoring spans the entirety of a relationship. For many companies, the resources simply do not exist to tackle every possible compliance issue, so compliance professionals often fall back on what they can do, as opposed to what they should do. This means the low-hanging fruit takes priority over the difficult high-risk issue.

DOJ has made it very clear in this document that it will require an explanation from companies as to why they set up their compliance programs the way they have. A risk-based approach provides a framework and outline that overwhelmed and under-resourced professionals can rely on and, critically, take to the board to ask for more resources.

The same goes for ongoing monitoring. A snapshot approach to compliance is not adequate and will fall afoul of DOJ prosecutors, should an investigation happen. Again, the language in the document calls for monitoring that spans the entirety of the relationship and also provides compliance professionals with the necessary arguments to ask for more resources.

One more thing

A footnote at the bottom of the document raises an important point:

Prosecutors should consider whether certain aspects of a compliance program may be impacted by foreign law. Where a company asserts that it has structured its compliance program in a particular way or has made a compliance decision based on requirements of foreign law, prosecutors should ask the company the basis for the company’s conclusion about foreign law, and how the company has addressed the issue to maintain the integrity and effectiveness of its compliance program while still abiding by foreign law.

This applies to global companies, of course, but also to companies with supply chains that cross borders. Foreign laws are constantly changing, and every jurisdiction has its own unique political and cultural framework. This presents a huge challenge for companies operating across the globe. The DOJ guidance includes important considerations that companies should continually monitor. They should consider these evolving laws and related landscapes and be ready to evolve their compliance programs as needed to meet requirements. This includes being able to provide rationale for their decision-making and actions in this regard.

Takeaways

• The updated guidance on Evaluation of Corporate Compliance Programs contains significant changes to several passages. Compliance officers must acquaint themselves with this document and use the language to improve their own programs’ effectiveness.

• Two of the major themes in this update are risk-based approaches to compliance and establishing ongoing monitoring programs. These themes reflect the Department of Justice’s perspective that a snapshot approach that goes after low-hanging fruit is inadequate.