Series
Blogs
3 October 2024
While fall is always a busy time of year, this fall has been particularly busy for the US Department of Justice (“DOJ”) and US Attorneys’ offices around the country (collectively, the “Agencies”), at least as it relates to corporate compliance. The Agencies have continued to prioritize compliance by, among other things, enhancing publicly available guidelines and introducing or improving initiatives geared at incentivizing whistleblowing and voluntary disclosures.
With regards to the DOJ, on September 23, 2024, Principal Deputy Assistant Attorney General Nicole M. Argentieri introduced an amended version of its Evaluation of Corporate Compliance Programs policy (“ECCP”), updated to address “emerging risks,” which include technology, data, and AI. This revised guidance also features insights into what DOJ expects to see in corporate compliance programs in terms of whistleblowing mechanisms. This addition is no surprise considering DOJ’s recently implemented whistleblower rewards pilot program and similar initiatives.
Several US Attorneys’ offices have likewise been busy. We reported in the spring that (like the DOJ) the Southern District of New York (“SDNY”) and Northern District of California had announced pilot programs focused on incentivizing voluntary self-disclosure. Since then, several other US Attorneys’ offices have introduced similar initiatives.
Clearly, corporate compliance is an area of top priority for the Agencies. In this context, it is vital that companies take this opportunity to re-assess their corporate compliance programs in accordance with DOJ’s amended ECCP and invest in making improvements where needed. Whistleblowing mechanisms (including ensuring there are proper protocols in place for employees to “blow the whistle” if needed and providing protection against retaliation) should be a particular point of focus.
DOJ updates its ECCP to address evolving technologies, data, and whistleblowing
In Argentieri’s words, the ECCP is “the roadmap Criminal Division prosecutors use to evaluate a company’s compliance program, including questions prosecutors will ask as they assess a compliance program in determining how to resolve a criminal investigation.” She added that DOJ’s assessment of a company’s compliance program is a “critical component” of any corporate resolution, evaluated both at the time of the misconduct and the time of resolution.
With its September 2024 update, the ECCP now addresses the following new areas (among others):
Several more US Attorneys’ Offices announce whistleblower pilot programs
In the past few weeks, there has been a flurry of activity in US Attorneys’ offices across the country. In particular, the Eastern District of New York (EDNY Program), District of New Jersey (DNJ Program), Southern District of Florida (SDFL Program), Eastern District of Virginia (EDVA Program), District of Columbia (DDC Program), Southern District of Texas (SDTX Program), and Northern District of Illinois (NDIL Program) each announced new whistleblower pilot programs. These programs are broadly similar to the pilot program announced by SDNY earlier this year.
EDNY’s pilot program, for example, grants cooperating individuals the prospect of a non-prosecution agreement if they come forward with original information about the following types of criminal conduct: (1) fraud or corporate control failures; (2) IP theft; (3) market integrity violations; (4) state or local bribery or fraud related to federal, state or local funds; (5) obstruction of justice, perjury, or false statements; (6) healthcare fraud; and (7) money laundering.
Companies should take this opportunity to review and strengthen whistleblower protocols and protections
In this regulatory environment, companies operating in the US would be well advised to devote time and resources to evaluating and improving corporate compliance programs in line with the updated ECCP. One area that warrants particular attention is company whistleblowing protocols. Companies should have processes in place allowing employees to report misconduct internally and which ensure such complaints are reviewed thoroughly, appropriately triaged to legal, HR, and/or other departments as needed, and effectively resolved. Indeed, many external whistleblower reports are made after internal reporting fell on deaf ears.
Crucially, companies should ensure that whistleblower complaints are reviewed and handled expeditiously, as delays can have serious implications. In particular, DOJ has confirmed that companies can still qualify for a presumption of a declination under its Corporate Enforcement and Voluntary Self-Disclosure Policy if a whistleblower submits a report to DOJ before the company self-discloses, but only if the company self-reports the conduct at issue to DOJ within 120 days after receiving the whistleblower’s report (assuming all other policy requirements are met).
Finally, companies should also adopt policies that both encourage and protect whistleblowers from retaliation.