Today’s post is from Marcia Narine (St. Thomas University School of Law).
*****
First, I would like to thank Mike Koehler for the opportunity to add to the debate about an affirmative defense for a corporate compliance program. Although I am now an academic, I write from the perspective as a former compliance officer and deputy general counsel, and as a current consultant to a boutique law firm that advises multinationals, startups and suppliers grappling with the Foreign Corrupt Practices Act on a daily basis. I vote “yes” for the defense, but not for compliance programs that would currently be considered “effective” under the Federal Sentencing Guidelines.
I believe that the current system provides a disincentive for optimal investment in compliance. It is no surprise to me that only 30-40% of SEC cases and less than 50% of DOJ cases come from voluntary disclosures, as was reported by the FCPA Professor here last week. Why voluntarily disclose wrongdoing by a rogue employee when doing the right thing may still subject your firm to fines, penalties, shareholder derivative suits, possible debarment, and potential loss of licenses?
As I wrote here, the burden for corporations attempting to avoid deferred or nonprosecution agreements altogether should be high. I would require the prosecutor to rebut the affirmative defense posed by the firm, which would provide evidence that:
(1) it has implemented a state of the art program approved and overseen by the board or a designated board committee, which receives comprehensive updates at least twice yearly on the program from the compliance officer;
(2) elevated the compliance officer to report directly to the board or a designated committee and make the officer terminable only by the board (a suggestion rejected in the 2010 amendments to the Guidelines and which could eliminate potential conflicts when the general counsel does not want to disclose to the government but the compliance officer does);
(3) clearly communicated the corporation’s intent to comply with the law and appropriate penalties for prohibited acts to employees, suppliers, agents, and partners;
(4) has developed and provided position-specific training on legal and ethical obligations for employees and board members annually (at a minimum), which is revised as the law changes;
(5) meets or exceeds industry standards and norms related to compliance and ethics;
(6) provides the appropriate training and policies to agents, joint venture partners and others who can subject it to liability, requires them by contract to comply, receives annual compliance certifications, and audits their compliance with the same rigor as they audit their own processes;
(7) has consistently applied anti-retaliation policies for whistleblowers, including terminating those who engage in retaliation;
(8) is not a habitual recidivist, meaning that the company may have had rogue employees in the past but has endeavored to learn from the compliance failure rather than continuing the same conduct;
(9) has voluntarily reported wrongdoing to authorities when appropriate;
(10) is periodically audited and benchmarked by an independent third party that does not provide any other consulting or professional services to it or have any actual or perceived conflicts of interest (such as providing legal advice or external auditing for Sarbanes-Oxley or other purposes) and/or is pre-certified by the appropriate US government agency; and
(11) has made modifications if necessary to the compliance program based upon the results of the audit.
The external compliance audit or pre-certification process should benchmark the company compared to peer companies and the general corporate population, reviewing, at a minimum, the following factors:
(1) The corporate culture and tone at the top and throughout the organization. The higher up the level of the wrongdoer, the higher the burden for the company.
(2) Incentive programs and compensation plans at all levels of the organization that encourage legal, ethical behavior. Companies that have financial incentives in place that either encourage unlawful or unethical behavior through goals that are impossible to reach or that fail to penalize bad conduct would fail this critical prong, which would disqualify them from using the defense.
(3) Promotional practices and whether compliance and ethical behavior are considered prior to such decisions.
(4) Adequacy, timeliness and comprehensiveness of training initiatives and the level of employee engagement and understanding of their compliance responsibilities (both position-specific and general).
(5) The effectiveness of the anti-retaliation programs.
(6) The effectiveness and usage rate of the anonymous reporting mechanisms.
(7) The process by which complaints are investigated, including an audit of a random sampling of investigations for thoroughness.
(8) The adequacy of the resources for the compliance function including continuing external education, appropriate salary and sufficient personnel commensurate with the size of the organization and the nature of the risks for that organization and that industry and
(9) The level of board engagement and understanding of the compliance priorities of the company based upon the risks related to its business, geography, employee base and incentive structures.
My criteria –which make more sense after reading the longer article– incorporate research about behavioral economics, executive compensation, and best practices from around the world, and would likely disqualify Wal-Mart Mexico and a number of high profile companies that are alleged to have engaged in bribery. It would also add a tool to the arsenal of beleaguered compliance officers who need ammunition every year around budget time. Most important, this defense would level the playing field between corporations and prosecutors, would provide the proper incentives for companies to prevent, detect and disclose criminal activity, and would allow both the private and public sector to allocate their resources more productively.