Skip to main content

Why Should Your Company Establish an Effective Corporate Compliance Program?

In recent years, both federal and state government have increased enforcement activities as they relate to corporate conduct. Tough new civil and criminal penalties have been enacted to deal with corporate wrongdoing.

Publicly traded companies and businesses that operate pursuant to a license, permit, statutory scheme or government regulatory approval find themselves subject to higher governmental expectations. Corporations that compete in industries of high government interest, such as health care and financial services, are particularly at risk and are increasingly targeted in both civil and criminal proceedings.

In some jurisdictions, the collective knowledge of the employees and agents of a corporation can be imputed to the corporation and support a criminal prosecution, even if no corporate officer had full knowledge of the wrongdoing.

False Claims Act

For companies that do business with the government, or participate in federally subsidized programs, the last ten years has witnessed the rebirth of the federal False Claims Act, 31 U.S.C. §§ 3729 - 3733 (the "Act"), a statute originally enacted during the Civil War. The False Claims Act was amended in 1986 to allow hefty rewards to whistle blowers who report false claims made against the federal government. It has been amended several times since then and has been interpreted hundreds of times by the federal courts.

In cases of false claims, the Act authorizes civil actions by the whistle blowers and imposes stringent penalties, and even the possibility of debarment, against offending companies. Under the Act, the definition of what constitutes a claim is expansive.

If the United States government provides any portion of the funding, any request or demand for money or property to any governmental agency or intermediary, is considered a claim. Some recent cases have gone so far as to hold that the contents of the claim itself need not be false.

Liability Under the Act

Liability can exist if there is a false representation that the company is acting in compliance with all applicable rules and regulations, where such compliance is a condition of payment. Although Congress determined that, for there to be a violation, false claims must have been made knowingly, that does not mean they must be submitted with an intent to defraud. For the purposes of the False Claims Act, the definition of knowingly includes both deliberate ignorance and acting in reckless disregard of the truth or falsity of the claim. There is nowhere to hide behind a veil of ignorance.

The practical result of such an action can be catastrophic for the reputation and business of any company. It is simply not a good business practice, or cost effective in the long term, to risk suffering this type of embarrassment if it can be avoided. With some very strong encouragement from the federal government, it is not a coincidence that many companies have adopted corporate compliance programs.

The Federal Sentencing Guidelines

In November of 1991 the United States Sentencing Commission adopted new sentencing guidelines (the "Guidelines") applicable to all organizational defendants in criminal cases. The guidelines have regularly been amended and revised since then, most notably the Sarbanes-Oxley Act as amended in 2004.

The guidelines were declared unconstitutional in 2005, in the United States Supreme Court decision of United States v. Booker, 123 S.Ct. 785 (2005), the court determined the guidelines violated a defendant's Sixth Amendment right to a jury. However, the court determined that the Guidelines could be saved by changing the wording from mandatory to advisory. [18 U.S.C. §3553] A sentencing court is still required to consider the Guidelines, but is permitted to tailor the sentence in light of the circumstances.

In any event, the Guidelines, which still must be consulted, substantially increase the financial penalties for corporations whose employees engage in unlawful conduct which is ostensibly intended for the corporation's benefit.

Along with the enhanced penalties, the Guidelines reward corporations which have effective internal compliance programs in place, programs which are designed to "prevent and detect violations of the law".

The Guidelines also provide for a substantial reduction of criminal fines if the detected violations are reported without unreasonable delay. Using a complicated mathematical formula, the Guidelines literally add points to a culpability score for bad corporate behavior and subtract points for good behavior.

The judge then looks at the numerical total and is bound by the final number to a limited range of options when considering what sentence to impose. Companies with an effective compliance program have the opportunity to greatly reduce penalties for violations of almost all federal statutes.

The net effect of this approach is a fundamental change in the way American companies are expected to conduct their business. Self-policing is the new rule. Corporations now have the primary responsibility for the prevention, detection and reporting of criminal conduct in their ranks and for fully cooperating and assisting law enforcement authorities.

The "Effective" Compliance Program

Concern about corporate compliance is not a new concept, but in the past there has been less concern about the effectiveness of such programs. The mandate of the Guidelines is not a mere formality. The stakes are much higher with corporate liability and even survival depending on whether compliance efforts are effective and creditworthy.

It is expected that managers will be held accountable for the failure to detect violations. Employees must be screened for their propensity to violate the law. It is no longer enough to go through the motions. Detecting criminal conduct and regulatory violations after the fact is simply not good enough.

What is an effective compliance program? For one thing, it depends on the business of the organization. An effective program in one industry might not work as well in another. Companies are expected to exercise due diligence and be innovative in designing and implementing their own program. While the Guidelines apply to all corporations, the larger the organization the more formal the program should be and the greater the penalty for failure to comply. Much more is expected of a large publicly traded corporation than a small business.

Minimum Requirements of an Effective Compliance Program

The minimum requirements of an effective compliance program are spelled out in some detail in a seven-part definition in the commentary to the Guidelines. These include:

  • high level management must be designated as responsible for compliance;
  • the development of written policies and procedures;
  • the institution of training programs;
  • a consistent internal auditing system to detect illegal conduct;
  • reasonable steps by management to prevent further occurrences after illegal conduct is detected;
  • consistent enforcement and sanctions against wrongdoers;
  • the exercise of due care to avoid delegation of authority to those with a propensity to engage in illegal conduct.

The program is expected to capture the employees' attention and deliver the message in a way that leaves a lasting impression. Companies must understand and take into account what their competitors are doing in this area and what comports with industry practice. However, depending upon the industry, it may not be good enough to merely keep up with the competition.

Danger of Not Having a Compliance Program

Why bother? There is a danger that if you don't do it, the government will do it for you. Without an effective program, when trouble strikes, the Guidelines require that the court impose a period of probation and the conditions of probation will dramatically affect the company's operation.

Important management and financial decisions may have to be reviewed and approved in advance by the government and the court. Government agents can be authorized to participate in the management of the business, conduct company audits and investigations and operate internal disciplinary programs.

If necessary, the court can appoint a monitor to see to it that business is conducted in a lawful manner. The thought of having someone else run the company should be enough to get the attention of most members of the business community.

The Guidelines offer some very compelling incentives. Most importantly, the existence of an effective program, even if it does not prevent all criminal conduct by employees, can still reduce the corporate fine by as much as 80%.

Also, the existence of an effective program provides a compelling argument that a company, and perhaps its senior executives, should not be charged for the criminal conduct of lower level employees -- even if the object of the illegal activity was to benefit the company.

The Guidelines should also be an important consideration for anyone serving as a director on any corporate board. A 1996 decision by the Court of Chancery of Delaware, In re Caremark International Inc. Derivative Litigation, (Civ. No. 13670, 698 A.2d 959 (Del. Ch.1996)) held that it is the responsibility of board members to ensure the existence of such programs and continually monitor their effectiveness.

The court held that a director's obligations include a duty to assure that a corporate information and reporting system exists. The failure to do so could render a director personally liable to shareholders for losses caused by non-compliance with applicable legal standards.

The Role of Internal Investigations

Greater scrutiny of corporate behavior by both state and federal government has forced organizations to be proactive in monitoring and, where necessary, correcting the manner in which they do business.

When problems occur, as they will, it is now of paramount importance that the company be prepared to demonstrate what steps were taken to avoid the problem before it happened, that a full investigation was immediately conducted and that appropriate corrective steps have been taken. Internal investigations, conducted by outside professionals, can be used as a tool in a corporation's process of self-evaluation and as a means of assessing potential civil or criminal liability as well as meeting the new obligations imposed by the Guidelines.

Because corporations cannot assert the Fifth Amendment privilege against self incrimination, they cannot refuse to provide testimony or produce non privileged documents within corporate files. The traditional method of ensuring that the results of an internal investigation remain within the company's control is to hire outside counsel to conduct the investigation in a manner specifically designed to maintain both the confidentiality of the investigative results and the attorney-client or work product privileges associated with them. The company can then assess how to deal with this information in a manner consistent with the Guidelines.

For those with an obligation to report the results of the investigation to others, such as publicly traded companies and investigations involving the use of public funds, this approach may not be good enough. In the aftermath of the Caremark decision, directors may feel more pressure to demonstrate that they have acted responsibly.

These situations may call for the employment of an outside professional who specializes in such reports but who, from the outset, will prepare the report with an understanding that the results of the investigation will be shared with others outside the company. The dual reporting obligation is the principle behind the concept of the private sector inspector general and is intended to lend credence in the objectivity of such reports to others. In dire circumstances, this is one way that companies in trouble can demonstrate good faith to the government.


In either circumstance, a properly conducted investigation can maximize the ability to obtain the most favorable resolution of the problems at hand and demonstrate the corporation's desire to act as a good corporate citizen in a manner consistent with the mandate of the Guidelines.

Copied to clipboard