New Steps for an Effective Company Compliance Program

New Compliance Program Requirements

The goal of the revised definition for “effective compliance and ethics program” is to give companies an incentive to “promote an organizational culture that encourages ethical conduct and a commitment to compliance with the laws.” To achieve this goal, ' 8B2.1 of the Guidelines now requires that an effective compliance program contain what we count as 10 separate elements. Most of these are predictable, and for purposes of the summary here, the most important and specific elements are:

• The company must assign specific, “high-level personnel” overall responsibility for the compliance program.
• The company must delegate day-to-day operational responsibility for the compliance program to specific individuals. These individuals must periodically report to management and the board of directors, or an appropriate committee of the board. These individuals must be given “adequate resources,” “appropriate authority,” and must have direct access to the board of directors.
• The company must communicate periodically its standards and procedures, and other aspects of the compliance and ethics program, to the board of directors, high-level personnel, and employees by conducting training programs and disseminating appropriate information.
• The organization must establish a system that allows employees to report anonymously or confidentially potential or actual criminal conduct without fear of retaliation. This will be one of the biggest changes in most companies' compliance programs.
• The organization must take “appropriate disciplinary measures” for officers or employees engaging in criminal conduct. This is undefined, as before, and will continue to cause difficult decisions on whether a company must fire an officer or employee.
• The revised Guidelines' definition of an “effective compliance and ethics program” substantially raises the requirements for a company's compliance program, and imposes more responsibility on a company's board and senior management.

The Guidelines' commentary indicates that the “off-the-shelf ” compliance policies that can be purchased in print or online — a common practice among U.S. companies — may not be sufficient. A company should tailor its program to take into account factors such as the size of the company, where it conducts business, and the industries in which it operates.

Interaction with Other Corporate-Governance Reforms

Publicly traded companies already in compliance with the requirements of SOX and with SEC rules and regulations and the listing requirements of public exchanges such as the NYSE will already have in place many of the elements of an effective compliance and ethics program. Many parts of the revised compliance program provisions copy SOX and SEC regulations. The Securities Exchange Act of 1934, at ' 10A(m)(4), for example, requires the audit committee of an SEC issuer to receive employee complaints related to accounting and auditing in a confidential, anonymous manner. NYSE Corporate Governance Rule 10 requires listed companies to adopt and disclose a code of business conduct and ethics for directors, officers and employees, and to disclose promptly any “waivers” of the code for directors or executive officers. Compliance with these statutes and rules goes a long way towards an effective program under the Guidelines that “promot[es] an organizational culture that encourages a commitment to compliance with law.”

Impact of Booker

Ironically, even as the revised Guidelines take effect, the Supreme Court's June 2004 decision in Blakely v. Washington, invalidating part of Washington State's sentencing statutes, raised doubts about the constitutionality and continued existence of the federal Sentencing Guidelines. In its Jan. 12, 2005 decision in United States v. Booker, the Court clearly stated that its holding in Blakely is applicable to the federal Guidelines: “Any fact … which is necessary to support a sentence exceeding the maximum … must be admitted by the defendant or proved to a jury beyond a reasonable doubt.” Though the holding in Booker applied only to facts that increase a sentence, the defense bar should be able to use this decision in arguing that facts that decrease a sentence, like the existence of a company's compliance program, must also be tried to a jury. For now, the Court resolved this problem for the federal Guidelines by making them advisory rather than mandatory. But if Congress attempts to impose mandatory rules, facts regarding compliance programs may have to be found by the jury. Under the Guidelines, the outcome of factual disputes regarding the existence of an effective compliance program has a significant impact — up to 25% — on a company's fine. The Court's language discussing the right of a defendant to have a jury determine facts that significantly impact a sentence should be equally applicable to mitigating facts, such as the existence of an effective compliance program.

Conclusion

The Organizational Sentencing Guidelines left several elements of an effective compliance program undefined. The revised Guidelines are far better and give an objective standard about what is an “effective compliance and ethics program” for use in court at sentencing. Judging by publicly available compliance policies, and by companies we advise, most compliance programs will have to be revised, some substantially, to meet the high requirements of the revised Guidelines. Though intended for use when corporations are sentenced, the revised Guidelines' greatest value may be in arming company counsel with a powerful argument for persuading officers and directors that the compliance policy must contain some difficult elements, such as specifically identified personnel with responsibility, creation of an anonymous “hot line” to report problems, and the need to take disciplinary action for violations. The new Guidelines also provide a more objective standard of what is an effective compliance program, to counter prosecutors' arguments that any company with an effective program wouldn't be in a sentencing hearing in the first place

[IMGCAP(1)]

U.S. Sentencing Commission statistics indicate that companies charged with federal crimes have been doing an awful job of creating effective programs to detect and deter employees' criminal acts. According to the Commission, of the more than 850 companies convicted of crimes from 1995 through 2002, only two had a compliance program that a federal judge recognized as effective. In one respect, this is not surprising, as federal prosecutors routinely argue that if a company had an effective compliance program, the company wouldn't have committed the crime in the first place, and the court wouldn't be spending its time in a sentencing hearing.

On Nov. 1, 2004, significant revisions to the Federal Sentencing Guidelines, including the Organization Sentencing Guidelines, took effect. The revised Guidelines include a new and expanded definition of “effective compliance and ethics program” for organizations in Section 8B2.1 and provide useful guidance on what a compliance program should include. The Guidelines' revisions significantly increase the requirements for an effective compliance program and mark the first major change to the Organizational Guidelines since they took effect in 1991. The revised Guidelines also respond to Sarbanes-Oxley (SOX), which directed the Sentencing Commission to amend the Guidelines and related policy statements to ensure that they “are sufficient to deter and punish organizational criminal misconduct.”

The actual impact of having an “effective compliance and ethics program” is a three-point reduction in the company's “culpability score.” This can reduce the fine calculated under the Guidelines by as much as 25%. Though under the Supreme Court's Jan. 12, 2005 decision in United States v. Booker, the fine yielded by the Guidelines is no longer mandatory, the sentencing court must still make the calculation and give it considerable weight. A company only gets this “benefit,” of course, if it is already in the miserable position of having been convicted of a federal crime. The real benefit of a compliance program is to stop the problem from occurring in the first place. A well-deserved criticism of the Guidelines has been that they provide no guidance for what a judge should consider an “effective” compliance program. The November 2004 revisions go a long way toward fixing that.

New Compliance Program Requirements

The goal of the revised definition for “effective compliance and ethics program” is to give companies an incentive to “promote an organizational culture that encourages ethical conduct and a commitment to compliance with the laws.” To achieve this goal, ' 8B2.1 of the Guidelines now requires that an effective compliance program contain what we count as 10 separate elements. Most of these are predictable, and for purposes of the summary here, the most important and specific elements are:

• The company must assign specific, “high-level personnel” overall responsibility for the compliance program.
• The company must delegate day-to-day operational responsibility for the compliance program to specific individuals. These individuals must periodically report to management and the board of directors, or an appropriate committee of the board. These individuals must be given “adequate resources,” “appropriate authority,” and must have direct access to the board of directors.
• The company must communicate periodically its standards and procedures, and other aspects of the compliance and ethics program, to the board of directors, high-level personnel, and employees by conducting training programs and disseminating appropriate information.
• The organization must establish a system that allows employees to report anonymously or confidentially potential or actual criminal conduct without fear of retaliation. This will be one of the biggest changes in most companies' compliance programs.
• The organization must take “appropriate disciplinary measures” for officers or employees engaging in criminal conduct. This is undefined, as before, and will continue to cause difficult decisions on whether a company must fire an officer or employee.
• The revised Guidelines' definition of an “effective compliance and ethics program” substantially raises the requirements for a company's compliance program, and imposes more responsibility on a company's board and senior management.

The Guidelines' commentary indicates that the “off-the-shelf ” compliance policies that can be purchased in print or online — a common practice among U.S. companies — may not be sufficient. A company should tailor its program to take into account factors such as the size of the company, where it conducts business, and the industries in which it operates.

Interaction with Other Corporate-Governance Reforms

Publicly traded companies already in compliance with the requirements of SOX and with SEC rules and regulations and the listing requirements of public exchanges such as the NYSE will already have in place many of the elements of an effective compliance and ethics program. Many parts of the revised compliance program provisions copy SOX and SEC regulations. The Securities Exchange Act of 1934, at ' 10A(m)(4), for example, requires the audit committee of an SEC issuer to receive employee complaints related to accounting and auditing in a confidential, anonymous manner. NYSE Corporate Governance Rule 10 requires listed companies to adopt and disclose a code of business conduct and ethics for directors, officers and employees, and to disclose promptly any “waivers” of the code for directors or executive officers. Compliance with these statutes and rules goes a long way towards an effective program under the Guidelines that “promot[es] an organizational culture that encourages a commitment to compliance with law.”

Impact of Booker

Ironically, even as the revised Guidelines take effect, the Supreme Court's June 2004 decision in Blakely v. Washington, invalidating part of Washington State's sentencing statutes, raised doubts about the constitutionality and continued existence of the federal Sentencing Guidelines. In its Jan. 12, 2005 decision in United States v. Booker, the Court clearly stated that its holding in Blakely is applicable to the federal Guidelines: “Any fact … which is necessary to support a sentence exceeding the maximum … must be admitted by the defendant or proved to a jury beyond a reasonable doubt.” Though the holding in Booker applied only to facts that increase a sentence, the defense bar should be able to use this decision in arguing that facts that decrease a sentence, like the existence of a company's compliance program, must also be tried to a jury. For now, the Court resolved this problem for the federal Guidelines by making them advisory rather than mandatory. But if Congress attempts to impose mandatory rules, facts regarding compliance programs may have to be found by the jury. Under the Guidelines, the outcome of factual disputes regarding the existence of an effective compliance program has a significant impact — up to 25% — on a company's fine. The Court's language discussing the right of a defendant to have a jury determine facts that significantly impact a sentence should be equally applicable to mitigating facts, such as the existence of an effective compliance program.

Conclusion

The Organizational Sentencing Guidelines left several elements of an effective compliance program undefined. The revised Guidelines are far better and give an objective standard about what is an “effective compliance and ethics program” for use in court at sentencing. Judging by publicly available compliance policies, and by companies we advise, most compliance programs will have to be revised, some substantially, to meet the high requirements of the revised Guidelines. Though intended for use when corporations are sentenced, the revised Guidelines' greatest value may be in arming company counsel with a powerful argument for persuading officers and directors that the compliance policy must contain some difficult elements, such as specifically identified personnel with responsibility, creation of an anonymous “hot line” to report problems, and the need to take disciplinary action for violations. The new Guidelines also provide a more objective standard of what is an effective compliance program, to counter prosecutors' arguments that any company with an effective program wouldn't be in a sentencing hearing in the first place

[IMGCAP(1)]