US Department of Justice releases updated guidance on evaluating corporate compliance programmes

Compliance programmes should be lead from the top down and senior management must demonstrate a strong commitment to compliance. This could be demonstrated by promoting a culture of compliance throughout a firm.

The best designed compliance programmes will ultimately fail if they are under-resourced. Programmes will be assessed on whether the compliance team have sufficient qualifications, seniority and stature (both actual and perceived) within the organisation, are sufficiently staffed and have autonomy from management.

In addition to regularly assessing their financial crime risks, firms should evaluate and assess the risks related to the use of new and emerging technologies such as the use of AI within their compliance programmes. As part of this assessment, firms should evaluate how quickly they can detect, and correct decisions made by AI.

Firms should ensure they have clear policies and procedures that set out detailed compliance requirements. Support should be in place to ensure the policies are understood and enforced by all employees. Policies should be living documents which are reviewed and updated to reflect changes to firms’ exposure to risk as well as to reflect changes to firms’ businesses more generally.

Training programmes are a critical aspect to implementing compliance programmes. The guidance emphasises that it is essential for employees to understand the compliance policies and the importance of following them.

Firms must have robust systems in place so that employees are able to report misconduct anonymously or confidentially. Hotlines or whistleblower programmes should be supported by clear policies. Firms should also ensure that any reported issues are thoroughly investigated, and that findings and corrective actions are documented.

The guidance makes it clear that a hallmark of an effective compliance programme is its ability to improve and evolve. Firms need to adjust their compliance programmes to any changes to their businesses. Firms may wish to undertake internal audits as well as establish metrics to measure the success of their compliance programmes.