31 Days to a More Effective Compliance Program

One cannot really say enough about risk assessments in the context of anti-corruption programs. This is because every corporate compliance program should be based on a risk assessment, on an understanding of your organization’s business from a commercial perspective, on how your organization has identified, assessed, and defined its risk profile, and, finally, on the degree to which the program de...

One of the biggest benefits of podcasting is that it allows a compliance function to connect with their audience on a more personal level. Unlike traditional forms of advertising, which often come across as impersonal and sales-driven, podcasts enable businesses to build a loyal following by offering valuable and engaging content. This can include interviews with industry experts, behind-the-scene...

One of the key goals of any compliance program is to train employees in awareness and understanding of the FCPA, your specific company compliance program, and to create and foster a culture of compliance. While it seems axiomatic that compliance training is the mainstay of any best practices compliance program, the conversation around training has evolved over the years. The importance of determin...

What happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities that violate the FCPA or some other law, such as Sarbanes-Oxley (SOX)? Cristina Revelo said she would start out with some basic questions, such as “How often would something be manually approved? How often are controls skipped? What are the levels of approvals that you have a...

What are internal controls? The best definition I have come across is from Jonathan Marks, partner at BDO, who defined internal controls as: An internal control is an action or process of interlocking activities designed to support the policies and procedures detailing the specific preventative, detective, corrective, directive, and corroborative actions required to achieve the desired process out...

There are numerous reasons to put some serious work into your compliance policies and procedures. They are certainly a first line of defense when the government comes knocking. The 2023 ECCP made clear that “Any well-designed compliance program entails policies and procedures that give both content and effect to ethical norms and that address and aim to reduce risks identified by the company as pa...

What is the value of having a Code of Conduct? In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to wave in a regulator’s face during an enforcement action as proof of ethical overall behavior. Is such a legalistic code effective? Is a Code of Conduct more than simply your company’s internal law? What should be the goal of the creation of your company’s Code of Con...

The 2023 ECCP made clear a company must have more than simply good ‘Tone-at-the-Top’; it must move down through the organization from senior management to middle management and into its lower ranks. It stated, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The...

The 2022 Monaco Memo emphasized the basic point that the key to every company is culture. The bottom line is that corporate culture matters, and corporate culture that fails to hold individuals accountable or fails to invest in compliance—or worse, that thumbs its nose at compliance—leads to bad results. To assist companies in understanding this requirement, the 2023 ECCP sets out inquiries demons...

Continuous monitoring and continuous improvement are two of the most important phrases for any compliance program. These twin concepts were further enshrined in the 2023 Update to the Evaluation of Corporate Compliance Programs (2023 ECCP). In 2023, all companies’ risks changed as we moved from Working From Home to Return To Office and, now, a hybrid model. In addition to this straight-forward cha...

One of the areas articulated in the 2023 ECCP was around payments and payroll. For both the compliance professional and the corporate payroll function, there is a significant role to play in the operationalization of a corporate compliance program. The 2023 ECCP was replete with references to payment and its critical nature to any best practices compliance program. This includes references to paym...

Matt Galvin, Counsel, Compliance & Data Analytics at the DOJ and one of the experts leading the DOJ's data analytics initiative, highlighted in another talk, the proactive use of data to generate cases related to the FCPA and emphasized that this is just the beginning. The DOJ expects companies to adopt a similar data-driven approach to compliance. In her speech, Argentieri speech she stated, "jus...

In October 2023, Deputy Attorney General Lisa Monaco announced a new policy regarding M&A. It is a Mergers & Acquisitions Safe Harbor policy that encourages companies to self-disclose criminal misconduct discovered by an acquiring company during the acquisition of a target company. Under the policy, the acquiring party will receive a presumption of criminal declination if it promptly and voluntari...

Assistant Attorney General Kenneth A. Polite Jr. began his speech on the clawback policy developed by the DOJ to promote “innovative approaches to compensation,” which would “shift the burden of corporate malfeasance away from uninvolved shareholders onto those more directly responsible.” She believes “Companies should ensure that executives and employees are personally invested in promoting compl...

In March, Deputy Attorney General (DAG) Lisa Monaco reviewed a number of initiatives by the DOJ that every compliance professional needs to study in some detail. These new initiatives included: (1) The Criminal Division's Pilot Program Regarding Compensation Incentives and Clawbacks; (2) Evaluation of Corporate Compliance Programs; and (3) Revised Memorandum on Selection of Monitors in Criminal Di...

Messaging Apps There was a significant addition to the language around messaging apps. The ECCP opened this section by noting, “Messaging applications have become ubiquitous in many markets and offer important platforms for companies to achieve growth and facilitate communication.” For any company under investigation or in a FCPA enforcement action, the DOJ will evaluate its “policies and mechanis...

The 2023 ECCP had significant changes regarding compliance-based incentives, both financial and non-financial; consequence management; messaging apps; and ancillary matters. I.               Incentives This section begins with a new introduction that makes clear the seriousness in which the DOJ views incentives, both financial and other types of incentives. The ECCP states, “The design and impleme...

2023 was a very significant year for every compliance practitioner and compliance program. While there was a paucity of corporate enforcement actions under the Foreign Corrupt Practices Act (FCPA), there were significant announcements from the Department of Justice (DOJ) that directly impacted compliance professionals and compliance programs. The first came in January, and it was an update to the...

What are the key factors that impact these strategic considerations for implementing AI in compliance, exploring the tradeoffs, challenges, and importance of considering the impact on decision-making. Key Considerations 1.     Understand the impact of AI on the company.  2.     Maintain an inventory of all tools used.  3.     Understand the tools for cost efficiency and risk avoidance.  4.     Inv...

As organizations transition to remote work and embrace cloud technologies, it is crucial to adapt compliance programs to ensure regulatory obligations are met.  Companies are shifting away from traditional tools like Excel or SharePoint towards centralized systems that facilitate compliance monitoring. Compliance teams can no longer rely on face-to-face collaboration and need systems to manage com...

To address this challenge, AI-powered data cleansing capabilities have been developed. These capabilities sift through content and focus on relevant and risky information while minimizing false positives. By removing duplicative content, obvious junk, and non-human generated text, compliance teams can efficiently focus on the content that is potentially risky. This targeted approach significantly...

Data analytics is revolutionizing the field of law and compliance, providing valuable insights and enhancing effectiveness. Data analytics is often referred to as the fuel that moves the compliance engine. It provides the necessary insights to make informed decisions and drive compliance programs effectively. By analyzing data, compliance professionals can gain a deeper understanding of their orga...

How can you integrate compliance, risk management, and your security framework? Igor Volovich, Vice President, Compliance Strategy at Qmulos, introduced the innovative concept to this discussion: Converged Continuous Compliance. This approach aims to reunite compliance, security, and risk management, which have historically operated independently. One of the key requirements impacting this new app...

Data automation not only streamlines the compliance process but also provides transparency and visibility into the decision-making process. There is a clear importance to connecting people, data, process systems, and tools in one place. This eliminates the need for compliance officers to navigate multiple systems and tools, allowing them to focus on risk-based due diligence. By having a clear unde...

As with all other components of a best practices compliance program, robust policies and procedures in data governance need to be in place to effectively address privacy concerns. This is even more true with the shift from breach data protection to data privacy as a regulatory focus. This shift is gaining momentum, especially in the EU under GDPR, where data privacy is a significant concern for co...