On March 3, 2023, the Department of Justice (DOJ) announced noteworthy updates to its Evaluation of Corporate Compliance Programs (ECCP) guidance. In remarks at the American Bar Association’s National Institute on White Collar Crime, Deputy Attorney General Lisa Monaco and Assistant Attorney General for the Criminal Division Kenneth Polite reiterated DOJ’s goal of encouraging corporations to prevent and detect wrongdoing through robust corporate compliance programs. To that end, DOJ unveiled two important changes to its ECCP guidance. First, DOJ directed prosecutors to assess a company’s compensation structures and announced a Pilot Program on Compensation Initiatives and Clawbacks (Pilot Program).  Second, DOJ introduced new guidance for assessing how companies permit employees to use personal devices and communication platforms. Companies should review this guidance carefully and consider how their compliance programs would compare to DOJ’s evolving expectations.

Promoting Compliance through Compensation and Clawbacks

Noting that “nothing grabs attention or demands personal investment like having skin in the game,” Monaco introduced measures aimed at rewarding companies that provide financial incentives for compliant behavior and that punish wrongdoers through compensation-based penalties. Monaco emphasized DOJ’s goal of “shift[ing] the burden away from uninvolved shareholders and onto those more directly responsible.”

This new focus on compensation has been incorporated into the ECCP. The ECCP advises prosecutors to consider “whether a company has incentivized compliance by designing compensation systems that defer or escrow certain compensation tied to conduct consistent with company values and policies.” Prosecutors may also consider whether companies deter misconduct by enforcing “contract provisions that permit the company to recoup previously awarded compensation if the recipient of such compensation is found to have engaged in or to be otherwise responsible for corporate wrongdoing.” Other considerations will include whether a company has made working on compliance a “means of career advancement” or a “significant metric” for management bonuses.

This focus on compensation is also reflected in the Pilot Program, which consists of two parts. First, the DOJ Criminal Division will require that every corporate resolution include a requirement that the company develop compliance-promoting criteria within its compensation and bonus systems. Criteria may be tailored to fit the company’s existing compensation program. Second, the Pilot Program will provide for fine reductions to companies that seek to claw back corporate compensation from wrongdoers. Companies will be able to reduce criminal fines by attempting in good faith to claw back compensation from individual wrongdoers, even if those efforts are unsuccessful. Companies that are successful in these clawback efforts will be able to retain any recovered funds.

Personal Device and Third-Party Messaging Policies

Acknowledging the use of personal devices and messaging platforms has become “ubiquitous,” Polite stated that DOJ expects companies to “adapt to the realities of modern life and update their policies and practices accordingly.” Accordingly, the ECCP now contains guidance for evaluating companies’ procedures regarding the use of personal devices, communications platforms, and messaging applications. The guidance encourages prosecutors to “consider how the policies and procedures have been communicated to employees, and whether the corporation has enforced the policies and procedures on a regular and consistent basis in practice.”

In particular, Polite noted a company that fails to produce communications from third-party messaging applications risks jeopardizing any offer it receives to resolve criminal liability. He warned that prosecutors will not accept failures to retain such data at face value and that companies should expect to be asked about their ability to access such communications, whether stored on corporate devices or servers, among other things.

Implications

DOJ’s evolving expectations require close monitoring and create significant challenges for companies to design and implement corporate compliance programs that will be deemed effective. Although DOJ’s ECCP is intended to guide federal prosecutors and is not directly binding on companies, it nonetheless provides a key reference for companies. Steps for companies to consider in the short term include these:

• Prioritize compliance considerations in compensation discussions, and assess whether existing compensation structures incentivize compliance while effectively deterring and punishing misconduct. The Pilot Program has created a tangible benefit to companies for expending resources to claw back compensation received by culpable individuals. At the same time, the costs associated with recovering compensation, as well as potential employment-related implications, warrant discussion between companies and their counsel. DOJ’s current guidance is relatively sparse, and compensation programs implicate myriad other issues, including employment and securities laws. Thus, companies may wish to proceed cautiously now while DOJ’s Pilot Program informs future guidance.

• Review and refresh personal device, messaging application, and document retention policies. In many companies, employees routinely communicate on channels such as text messages on personal devices that are not within the companies’ direct control. Consider how best to communicate policies to employees, especially if employees’ current awareness and compliance with the policies are lax. Implement mechanisms for monitoring compliance and enforcing consequences for deviations from these policies.