Editor: So, what has changed lately regarding corporate governance?
Boss: In April, the U.S. Sentencing Commission promulgated revised sentencing guidelines for corporations. This is the first change to these guidelines since they were enacted in 1991. These guidelines not only serve as the basis for determining punishment for corporations convicted of crimes but also provide the "gold standard" for evaluating internal corporate compliance programs. The newly revised guidelines will become effective November 1 of this year, absent any congressional intervention.
Editor: Why are these guidelines so important?
Boss: In today's environment, there has been an unprecedented focus on corporate wrongdoing. Ferreting out white-collar fraud in the wake of the Tyco, Adelphia and Enron scandals has become a top priority for governmental agencies including the Department of Justice, the SEC and many state Attorney Generals. The challenge is clear: companies must become ever more vigilant in creating a culture, and a way of doing business, that withstands increased scrutiny from all sides. Unfortunately, the way our society tends to fix any high-profile, social ill is to increase prosecution and enhance punishments. Because this is the current climate we're all facing, it's imperative that corporations focus on compliance efforts in a systematic and comprehensive manner.
Editor: Will these changes put a strain on corporate organizations?
Boss: Certainly in the short term, the answer is yes, at least for many companies that have not already dedicated resources to creating an effective compliance program. Adapting to these changes is resource intensive. Companies must make cost benefit decisions, but it's important to remember that a short-term investment may pay long-term dividends when it comes to dealing with the inevitable problems that every entity faces, whether in the form of a rogue employee or a questionable accounting decision. Of course, it is important to always remember that a corporation is criminally liable for any criminal acts by its employees or agents committed during the course of their employment - even if the acts were violative of internal company guidelines. And, prosecutors are now pursuing corporations as criminal defendants with renewed vigor.
Editor: What role does corporate counsel play in meeting these new guidelines?
Boss: Corporate Counsel plays a critical role in this whole equation. The guidelines require that a specific, high-level individual be given primary responsibility for ensuring the implementation and effectiveness of a compliance program. The obvious person for that job is the general counsel, or a representative from his or her office. Corporate counsel should play a role in designing compliance standards that comport with the company's size and type of business. In addition, the guidelines require ongoing risk assessment with corresponding revisions to the compliance program, and corporate counsel must play a role in this process. Finally, counsel needs to have a plan in place for dealing with crisis contingencies: who gets notified; when should outside counsel be contacted; under what circumstances should law enforcement be contacted.
Editor: What constitutes a good compliance program?
Boss: The extent of a compliance program should be commensurate with the size and complexity of an organization, and the nature of its business. Obviously, a mom-and-pop, 10-person company has different needs than a Disney or a General Motors. The Sentencing Commission has now created the archetype for an effective compliance program, and you can be sure that prosecutors and regulators will evaluate your company's program against those standards in determining whether to prosecute a corporation at all as opposed to perhaps just prosecuting the individual employees who engaged in illegal activity. There are seven minimum standards required for an effective compliance program.
Editor: What are those minimum standards?
Boss: First, the company must establish compliance standards designed to prevent and detect criminal conduct. Although there was pressure on the Commission to require that compliance programs have a broader objective of detecting any illegal conduct, even regulatory violations, the Commission opted for the more narrow and reasonable approach.
Second, the corporate leadership must be knowledgeable about the content and operation of the compliance program. The new amendment requires that the "organization's governing authority" be aware of the compliance efforts and shall exercise "reasonable oversight." There must be a specific individual "within high-level personnel of the organization" (that's where the general counsel comes in) who is assigned general responsibility for the compliance and ethics program. There must be a specific person within the organization (again, someone in the general counsel's office is a likely choice) who is delegated "day-to-day" operational responsibility for the program. That individual shall report periodically to high-level personnel, and as appropriate, to the governing authority.
Third, the corporation must use "reasonable efforts" to exclude criminals or other individuals with questionable backgrounds from positions of "substantial authority" within the organization.
Fourth, the corporation must educate all officers, directors, employees and, as appropriate, the organization's agents about its compliance standards and procedures.
Fifth, the corporation must use auditing and monitoring systems, which are "designed to detect criminal conduct." The organization must periodically evaluate the effectiveness of its compliance program, and must also implement a system where the employees and agents may report or seek guidance about potential or actual violations without fear of retaliation.
Sixth, the compliance program must be enforced not only through disciplinary measures, but also by including "incentives to perform in accordance with such program."
Seventh, after detection of a criminal violation, the corporation must take reasonable steps to respond appropriately and to prevent future similar violations, including making modifications to its compliance program.
Editor: What are the most significant changes from the previous version of the guidelines?
Boss: The guidelines now expressly require "ethical" conduct and stress a connection between such conduct and an effective compliance program. Previously, "ethics" was never mentioned as a component of an effective compliance program to prevent criminal conduct. The guidelines now require specific oversight by the Board and management of the program by "high-level personnel." The Board must be knowledgeable about the compliance program and exercise reasonable oversight. Training is now specifically required of everyone including Board members. In addition, the corporation both must discipline wrongdoers and provide "appropriate incentives" to perform properly. The corporation must also periodically conduct risk assessments and modify the program as necessary.
Editor: You mentioned before that different types of companies will be subject to different compliance standards. What factors are considered in determining whether, in a specific case, the compliance program is sufficient?
Boss: The guidelines in general refer to applicable industry practice or the standards called for by any applicable government regulation, the size of the company and any prior misconduct. While smaller companies are expected to demonstrate the same commitment to ethical and lawful conduct, the guidelines recognize that a smaller company can meet the requirements of the guidelines with less formality and fewer resources than a large company. Where a company has a recurrence of similar misconduct, there is a presumption that the company's compliance program is ineffective.
Editor: What effect do you see this having on companies after the November 1 deadline comes and goes?
Boss: Ultimately, a company will need to create a compliance resume. If a problem does occur, the prosecutor in the case will be able to clearly see that the company took every reasonable measure to comply with the highest standards of corporate governance. Given that, the prosecutor may just exercise his or her prerogative and opt against prosecuting the corporation. Despite its best intentions, a corporation may run into a rogue employee or a high-level manager with bad judgment.
It behooves a forward-thinking company to shore up its entire chain of command with an ironclad compliance program. With general counsel leading that charge, a company will be as protected as possible from the misdeeds of the few.
With the recent headlines and corresponding public perceptions about corporate wrongdoing, prosecutors are looking for cases to demonstrate that they are tough on corporate crime. Expect much more difficult questions if someone in your company is the subject of a criminal investigation. You need to be able to demonstrate that corporate compliance is the highest priority for your company and that you did everything that could be reasonably expected to detect and prevent such criminal conduct.
Published June 1, 2004.
