On June 1, the Criminal Division of the Department of Justice (“DOJ”) issued new guidance on how it evaluates corporate compliance programs when making corporate charging decisions. The additional guidance provides valuable insight into best practices when companies update their corporate compliance programs and paints a clear picture of the DOJ’s expectations regarding those programs.

These guidelines, originally issued in 2017 and previously updated in 2019, aim to provide transparency into the DOJ’s compliance program policies and priorities. The guidelines help prosecutors make charging decisions and allow them to ask companies relevant questions related to their compliance programs during a criminal investigation.

The DOJ’s guidance provides a framework that poses three primary questions about a corporation’s compliance program: (1) is it well designed; (2) is it being applied earnestly and in good faith, specifically, is the program adequately resourced and empowered to function effectively; and (3) does it work in practice. The June 2020 guidance revised question two to reflect the importance of compliance programs having adequate resources to function effectively.

A few of the key updates to the framework are below:

Providing an Individualized Assessment: in assessing a company’s individual compliance program, the DOJ will look at specific factors, including the company’s size, industry, regulatory landscape, and geographic footprint.

Resources and Empowerment of Compliance Program: the DOJ now places emphasis on ensuring a company’s compliance program is adequately resourced and is empowered to function effectively.

A Culture of Compliance: it is important that companies demonstrate compliance at all levels within a company, not just among high level executives.

Risk Assessment: the guidance added clarifying language for prosecutors to consider and understand why a company has set up its compliance program the way it did and why/how the program has evolved over time.

Policies and Procedures: the DOJ will now consider whether a company’s policies and procedures are tested, and the level of access employees have to the company’s policies and procedures. Further, prosecutors will look to which policies attract the most employee attention and will consider if a company is proactive in updating its existing policies to reflect changing circumstances.

Lessons Learned: In the same vein as evaluating whether a company is consistently updating its policies and procedures, prosecutors will look to whether these policies and procedures have been updated to reflect lessons learned from previous misconduct or from other companies in the same industry.

While there has not been significant deviation from the April 2019 guidance, the new revisions and updates provide a clear insight into the DOJ’s expectations that companies have robust compliance programs. Perhaps what is most surprising about the new guidance is the DOJ’s emphasis on ensuring that compliance programs have adequate resources to function effectively in the wake of the coronavirus (“COVID-19”). It is no secret that many companies have significantly reduced their staffing across the board and are monitoring expenses more closely than ever. The pandemic will surely test companies’ abilities to consistently comply with these new heightened guidelines.

Previously, the DOJ had been receptive to feedback from companies and could issue additional guidance on its expectations for compliance while companies struggle to deal with the ramifications of a global pandemic.