The Department of Justice (DOJ) is a top-level federal agency responsible for enforcing all federal laws. Given its mandate, they are one of the largest federal agencies and oversees 100,000 attorneys, special agents, and other law enforcement personnel. 

The DOJ has created many specialized groups that focus on enforcing a particular type of law or regulation to facilitate its objectives. Thus, generally, DOJ staff are very knowledgeable and experienced in their particular practice area, and can be a force to be reckoned with. 

Among the DOJ's duties includes deciding whether to bring civil or criminal charges against businesses, healthcare practices, and individuals alleged to have violated a federal regulation. While there are many considerations that go into the charging decision, one of the more important ones is whether the subject of the investigation has an effective DOJ compliance program.

Areas of Particular Concern

While the DOJ oversees a vast number of federal laws and regulations it has shown a particular interest in a few select areas in recent years, including:

• Antitrust and Securities Law Compliance

• Data Security and Consumer Fraud Compliance

• Federal Contract and Program Compliance

• Foreign Corrupt Practices Act (FCPA) Compliance

• Financial Transactions, Tax, and Cryptocurrency Compliance

• Healthcare Compliance

• National Security Compliance

• Political Law and Campaign Finance Compliance

While these are areas of recent concern, participants in almost every industry can be subject to their oversight. Developing, maintaining, and adhering to a strict DOJ compliance program is critical to avoid civil and criminal liability. 

Three Steps to Ensure a Comprehensive DOJ Compliance Program

For those individuals and organizations in need of a DOJ compliance program, there are a few steps to follow to make sure that the selected program adequately affords the necessary level of protection. According to attorney Dr. Nick Oberheiden: 

DOJ compliance requires a comprehensive approach that focuses on each individual company’s or practice’s specific compliance obligations. Not only will a generic compliance program fail to ensure that an organization is compliant, but it will also fail to the expected level of provided protection in the event of an unexpected DOJ investigation.

Along those lines, organizations should consider the following when thinking through the process of creating a compliance program: 

1. Engage a dedicated DOJ compliance and defense law firm

When considering a compliance program, it is essential to realize that DOJ investigators have a vast knowledge of the area in which they practice. Given their often-narrow practice area, they typically have extensive experience investigating these claims and know where to look and what to ask for. 

Additionally, the federal regulations the DOJ enforces are constantly in flux and subject to changing interpretations from the courts. This is especially the case in recent months, as the Trump and Biden administrations have very different views on certain issues and regulations. 

The result of this being, what was once a rock-solid compliance program may no longer provide the protection it once did. And while a business owner may feel they have a grasp on their regulatory requirements, if they are not staying on top of recent developments, their confidence may be misplaced. 

All this to say, the first step in developing a DOJ compliance plan is to engage the assistance of a knowledgeable federal defense attorney who has specific experience working within the business’s industry. Like DOJ investigators, many compliance and defense attorneys have niche practice areas, allowing them to stay abreast of all recent and up-and-coming developments. 

2. Identify the scope of a business' compliance obligations

The next step is to sit down with a lawyer and identify a business's compliance requirements. While federal regulations apply to companies in most industries, the manner in which these regulations apply and are interpreted vary widely. While total compliance is the goal, generally, a business will want to start by focusing on any regulation that could result in criminal liability. 

3. Mitigate risk through the creation of new policies, employee training, and other measures

Every business must have a custom-tailored DOJ compliance program. Given the nuance of federal regulations, there is no room for a one-size-fits-all approach. For example, in June 2020, the U.S. Department of Justice, Criminal Division released an update to guidance on the Evaluation of Corporate Compliance Programs. The purpose of the update is to help prosecutors determine the effectiveness of a DOJ compliance program. 

According to the 2020 guidance, prosecutors are to consider three questions when reviewing a compliance program:

1. Is the compliance program well designed?

2. Is the program effective?

3. Does the compliance program work, in practice?

Each of these is discussed below.

What does a "well-designed" compliance program look like?

According to the DOJ 2020 guidance, a compliance program should be designed to "maximum effectiveness in preventing and detecting wrongdoing by employees." 

While the text of a compliance program is important, the DOJ wants to see that the program sends a clear message to employees that any misconduct will not be tolerated, and that the company wholeheartedly adopts the spirit of the program, as evidenced by its day-to-day operations. Thus, the DOJ considers:

• Whether the company conducted an adequate risk-assessment;

• Whether the company implemented policies and procedures to address any industry- and business-specific compliance obligations; 

• Whether the company takes the necessary steps to ensure its compliance program is well-known and understood by employees;

• Whether the program provides a mechanism for confidential reporting and identifies a clear investigatory process; and

• Whether the compliance program considers the compliance requirements when dealing with third-parties.

What does an "effective" DOJ compliance program look like?

For a compliance program to be effective in the eyes of the DOJ, it must be "implemented,

reviewed, and revised, as appropriate, in an effective manner." Thus, "paper programs," that do not show employees the management's commitment to compliance will not be given much weight. 

When assessing the effectiveness of a program, the DOJ will consider whether management is leading by example, or merely relying on the words contained in the program. They also want to see that those in charge of enforcing the compliance program are given the autonomy and resources to carry out the goals of the program. Finally, the DOJ will look at how an organization's compliance program rewards compliance and disincentivizes non-compliance. 

What makes a compliance program "work in practice"?

In its most recent guidance, the DOJ makes clear that a compliance program must work, as it is applied by the organization. Throughout the investigation process, prosecutors consider "the adequacy and effectiveness of the corporation's compliance program at the time ofthe offense, as well as at the time of a charging decision." 

The DOJ acknowledges that merely because a violation occurred does not mean that a compliance program didn't work. Instead, the DOJ looks to whether there were tools in place to identify the misconduct and cure any compliance issues in a timely manner. 

The guidance specifically highlights the importance of a DOJ compliance program that evolves over time to address changing compliance needs. This is an implicit acknowledgment that compliance requirements frequently change, and reiterates their position that organizations must stay on top of all developments to maintain an effective compliance program. 

Also important is an organization's response to any potential regulatory infractions. Along these lines, employers have an obligation to only to identify the root cause of the violation, but also to employ a sufficient mechanism to address potential violations. Thus, to the DOJ, how an organization actually responds to real or perceived violations is a critical component of a compliance program. 

An Effective DOJ Compliance Program Can End an Investigation in Its Tracks

The importance of a thoughtful and comprehensive DOJ compliance program cannot be overstated. When the DOJ opens an investigation, it has not decided that a violation has occurred, only that the potential for wrongdoing exists. 

An organization facing an investigation can use its compliance program as its first line of defense. In many cases, once they realize that an organization has an effective compliance program that management takes seriously, the Department will cease investigations, preventing any further investigation or enforcement action. 

However, the best way to handle a DOJ investigation varies case-by-case. 

In some situations, where an organization has a compliance program in place, it behooves an organization to affirmatively approach the Department. That said, if there are any grey areas in the compliance program, this can be a risky maneuver. Thus, organizations under a DOJ investigation should consult with an experienced attorney to determine the best course of action in their specific circumstances. 

For organizations that fear they are not in full compliance, the importance of retaining dedicated DOJ compliance counsel is even more critical. However, it is important to remember that they will consider the effectiveness of a compliance program both at the time of the violation, as well as at the time of the charging decision. This opens to door for organizations to make good-faith remedial efforts, even after an investigation is ongoing. 

Ultimately, regardless of the industry in which an organization operates or whether it has an existing compliance program in place, businesses and individuals facing a DOJ investigation should take the situation seriously. There is too much at stake to risk taking any shortcuts.