A Blueprint for Targeted Enhancements to Corporate Compliance Programs
This article discusses corporate compliance programs, such as artificial intelligence. "The Department of Justice (DOJ) recently updated the Evaluation of Corporate Compliance Programs (ECCP) to direct prosecutors who are considering charges or resolutions to assess how a company addresses, among other topics, disruptive technologies and AI, self-disclosure initiatives, and the compliance function’s access to corporate data."
November 13, 2024 at 12:23 PM
7 minute read
The Department of Justice (DOJ) recently updated the Evaluation of Corporate Compliance Programs (ECCP) to direct prosecutors who are considering charges or resolutions to assess how a company addresses, among other topics, disruptive technologies and AI, self-disclosure initiatives, and the compliance function’s access to corporate data. This enhanced guidance follows a pattern for ECCP amendments and reveals a trend toward an expectation of more proactive compliance efforts as a predicate for credit from prosecutors. Compliance stakeholders, therefore, can use this update as a blueprint for high-value program enhancements.
Since 2017, the ECCP has been prosecutors’ formal tool to judge compliance program adequacy. Largely presented as questions rather than prescriptions, the original ECCP provided “some important topics and sample questions that the [DOJ] … has frequently found relevant in evaluating a corporate compliance program.” In 2019, the DOJ reorganized the ECCP into three topics—program design, implementation, and efficacy—and better aligned the questions with policies and priorities. In 2020, the DOJ substantively expanded the ECCP to address the compliance function’s data use, role in M&A, and resourcing. In March 2023, the DOJ made two significant changes to address the data preservation and corporate compensation programs.
AI and Disruptive Technologies
Beginning in early 2024, the DOJ previewed anticipated ECCP changes addressing AI (defined in OBM Memo M-24-10) and new technologies. It announced the Justice AI Initiative to accelerate DOJ’s understanding and use of AI and noted the “promise” and “peril” of AI and its anticipated robust enforcement and accompanying stiffer penalties for offenses involving AI. The ECCP update, developed in consultation with compliance executives with AI expertise, examines how a company addresses these technologies in its compliance life cycle. Prosecutors will ask questions such as:
- How do the business and compliance function use technology?
- Is “management of risks related to use of AI and other new technologies integrated into” risk assessments?
- What actions is the company taking to “curb[] any potential negative or unintended consequences” and to “mitigat[e] the potential for deliberate or reckless misuse of technologies”?
- What “controls [are] in place to monitor and ensure [technologies’] trustworthiness, reliability, and use”?
DOJ expects a company to thoroughly inventory its use of technology—being mindful of the broad definition of AI—across the entirety of the enterprise so that the organization knows everywhere it uses AI and how it uses AI. In addition, the business should assess its exposure to the malign use of AI against it. With this context, a company is expected to assess risks associated with internal use and external misuse of technology. (A company needing guidance on an AI-focused risk assessment can look to the NIST’s AI Risk Management Framework.) The next step is the adoption of appropriate controls to mitigate these risks and proactively monitor the use of these technologies. Finally, the ECCP suggests the compliance function consider leveraging AI and other new technologies as part of its compliance work and self-assessment.
Developments in Voluntary Self-Disclosure (VSD) Initiatives
The DOJ seized upon this ECCP update to further publicize significant new policies encouraging the reporting of misconduct.
Speak Up Programs
The ECCP’s section on whistleblower programs and protections now aligns with the Corporate Whistleblower Awards Pilot Program (CWA), announced in August 2024, and other recent VSD initiatives. Under the CWA, the DOJ provides financial rewards to non-culpable whistleblowers who report misconduct to the government. Similarly, the DOJ’s other VSD programs aim to entice self-reporting in exchange for more lenient treatment. The CWA and VSD initiatives expect robust speak up mechanisms and anti-retaliation regimes. In this regard, prosecutors will ask whether a “company encourage[s] and incentivize[s] reporting” or “chill[s] such reporting,” how a company evaluates employee comfort with reporting, and how comprehensive a company’s whistleblower and anti-retaliation training is.
The ECCP places a premium on proactive efforts to support speaking up and no longer appears to offer full credit for a purely reactive program. The ECCP now looks at what a company does to affirmatively encourage and incentivize reporting. This, coupled with the CWA, appears to be the strongest suggestion to date that the DOJ is amenable to a company providing financial rewards to its own whistleblowers who report substantiated claims. Regardless, a company cannot merely rely on reporting metrics to determine efficacy of a speak up program and must instead find other means to assess whether employees are comfortable raising concerns. Finally, this version of the ECCP includes the most directive guidance on training. No longer will the DOJ look only at a company’s training on speak up policies and mechanisms and the applicable anti-retaliation laws, prosecutors will examine whether the company trains its employees about external reporting mechanisms, like the CWA.
Mergers & Acquisitions Safe Harbor Policy
The M&A Safe Harbor Policy announced in October 2023, provides that the DOJ presumptively will decline to charge an acquiring company that voluntarily discloses and remediates, in a timely manner, misconduct discovered during pre- or post-acquisition diligence. This policy embodies the DOJ’s goal of encouraging effective diligence and integration. Relatedly, the ECCP now directs prosecutors to ask what role “compliance and risk management functions play[ed] … in designing and executing the integration strategy” and whether the integration strategy is reasonably designed “to ensure appropriate compliance oversight of the new business.”
To meet DOJ expectations, a company that engages in M&A activity should fully integrate the risk and compliance functions in its M&A processes to help with early identification, assessment, and remediation of compliance matters. Further, the company should invest in timely remediation to preserve options if misconduct is identified at an acquired company. The compliance function needs to be fully engaged to meet the M&A Safe Harbor Policy’s strict deadlines on reporting and remediation to qualify for a declination.
Compliance Access to Data
The DOJ has been increasingly focused on leveraging data in the compliance function to detect and prevent misconduct—the word “data” appears 12 times in the 2023 ECCP and more than 20 times in the 2024 ECCP. The 2024 ECCP makes clear that the DOJ will no longer ask if compliance has access to corporate data; it will ask what data compliance has access to. Accordingly, compliance should inventory available data sources across the enterprise and its access to them. The amended ECCP directs prosecutors to measure a company’s commitment to such data usage. Prosecutors will now ask questions such as:
- Do “compliance personnel have knowledge of and means to access all relevant data sources … to create efficiencies … and measure the effectiveness of … compliance programs”?
- How do “the assets, resources, and technology available to compliance and risk management compare to those available elsewhere in the company”?
The ECCP also clarifies that access to data alone is not sufficient; what compliance does with the data and what skilled resources are enlisted to assist with those tasks also matter. As a result, compliance needs access to staffing and other resources to permit effective use of data to assess both compliance with company policies and efficacy of the compliance program itself.
The updated ECCP reflects both the DOJ’s priorities and expanding expectations regarding compliance programs. Although the ECCP update covers additional topics, those addressed here offer opportunities for a strong return on the investment of compliance budget and effort.
David E. Carney and Edward J. Heath are partners with Robinson+Cole and focus their practices on government enforcement, internal investigations, and corporate compliance programs.
NOT FOR REPRINT
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
You Might Like
View AllTurbocharge Growth: How Technology Will Shape a Successful 2025
Decision of the Day: Judge Denies Standing for Plaintiffs in Copyright Suit Over AI Training of ChatGPT
OpenAI, NYTimes Counsel Quarrel Over Erased OpenAI Training Data
Using In Rem Jurisdiction to Ameliorate Artificial Intelligence Difficulties
5 minute readTrending Stories
- 1Justices Will Weigh Constitutionality of Law Allowing Terror Victims to Sue PLO
- 2Nevada Supreme Court to Decide Fate of Groundbreaking Contingency Cap Ballot Measure
- 3OpenAI Tells Court It Will Seek to Consolidate Copyright Suits Under MDL
- 44th Circuit Allows State Felon Voting Ban Challenge to Go Forward
- 5Class Actions Claim Progressive Undervalues Totaled Cars
Who Got The Work
Michael G. Bongiorno, Andrew Scott Dulberg and Elizabeth E. Driscoll from Wilmer Cutler Pickering Hale and Dorr have stepped in to represent Symbotic Inc., an A.I.-enabled technology platform that focuses on increasing supply chain efficiency, and other defendants in a pending shareholder derivative lawsuit. The case, filed Oct. 2 in Massachusetts District Court by the Brown Law Firm on behalf of Stephen Austen, accuses certain officers and directors of misleading investors in regard to Symbotic's potential for margin growth by failing to disclose that the company was not equipped to timely deploy its systems or manage expenses through project delays. The case, assigned to U.S. District Judge Nathaniel M. Gorton, is 1:24-cv-12522, Austen v. Cohen et al.
Who Got The Work
Edmund Polubinski and Marie Killmond of Davis Polk & Wardwell have entered appearances for data platform software development company MongoDB and other defendants in a pending shareholder derivative lawsuit. The action, filed Oct. 7 in New York Southern District Court by the Brown Law Firm, accuses the company's directors and/or officers of falsely expressing confidence in the company’s restructuring of its sales incentive plan and downplaying the severity of decreases in its upfront commitments. The case is 1:24-cv-07594, Roy v. Ittycheria et al.
Who Got The Work
Amy O. Bruchs and Kurt F. Ellison of Michael Best & Friedrich have entered appearances for Epic Systems Corp. in a pending employment discrimination lawsuit. The suit was filed Sept. 7 in Wisconsin Western District Court by Levine Eisberner LLC and Siri & Glimstad on behalf of a project manager who claims that he was wrongfully terminated after applying for a religious exemption to the defendant's COVID-19 vaccine mandate. The case, assigned to U.S. Magistrate Judge Anita Marie Boor, is 3:24-cv-00630, Secker, Nathan v. Epic Systems Corporation.
Who Got The Work
David X. Sullivan, Thomas J. Finn and Gregory A. Hall from McCarter & English have entered appearances for Sunrun Installation Services in a pending civil rights lawsuit. The complaint was filed Sept. 4 in Connecticut District Court by attorney Robert M. Berke on behalf of former employee George Edward Steins, who was arrested and charged with employing an unregistered home improvement salesperson. The complaint alleges that had Sunrun informed the Connecticut Department of Consumer Protection that the plaintiff's employment had ended in 2017 and that he no longer held Sunrun's home improvement contractor license, he would not have been hit with charges, which were dismissed in May 2024. The case, assigned to U.S. District Judge Jeffrey A. Meyer, is 3:24-cv-01423, Steins v. Sunrun, Inc. et al.
Who Got The Work
Greenberg Traurig shareholder Joshua L. Raskin has entered an appearance for boohoo.com UK Ltd. in a pending patent infringement lawsuit. The suit, filed Sept. 3 in Texas Eastern District Court by Rozier Hardt McDonough on behalf of Alto Dynamics, asserts five patents related to an online shopping platform. The case, assigned to U.S. District Judge Rodney Gilstrap, is 2:24-cv-00719, Alto Dynamics, LLC v. boohoo.com UK Limited.
Featured Firms
Law Offices of Gary Martin Hays & Associates, P.C.
(470) 294-1674
Law Offices of Mark E. Salomone
(857) 444-6468
Smith & Hassler
(713) 739-1250