# Compliance Program Design Reference Guide

## Overview

An effective compliance program is essential for preventing, detecting, and responding to legal violations. This guide outlines the key elements of compliance program design based on DOJ guidance and industry best practices.

---

## DOJ EVALUATION OF CORPORATE COMPLIANCE PROGRAMS

### Framework Overview
The DOJ Criminal Division regularly updates guidance on evaluating corporate compliance programs. Key questions focus on three fundamental areas:

1. **Is the corporation's compliance program well designed?**
2. **Is the program being applied earnestly and in good faith?**
3. **Does the corporation's compliance program work in practice?**

### Source Documents
- DOJ Criminal Division "Evaluation of Corporate Compliance Programs" (Updated 2024)
- U.S. Sentencing Guidelines Chapter 8 (Sentencing of Organizations)
- Monaco Memorandum (2022)
- Individual Accountability Policies

---

## SEVEN ELEMENTS OF AN EFFECTIVE COMPLIANCE PROGRAM

The U.S. Sentencing Guidelines (USSG § 8B2.1) establish seven minimum elements:

### Element 1: Standards, Policies, and Procedures

**Requirements**:
- Establish standards and procedures to prevent and detect criminal conduct
- Written code of conduct
- Detailed compliance policies
- Clear procedures for implementation

**Key Components**:

**Code of Conduct**:
- Articulate company values and commitment to compliance
- Communicate expectations for ethical behavior
- Address key risk areas specific to organization
- Accessible to all employees
- Available in relevant languages

**Policies and Procedures**:
- Tailored to specific business risks
- Practical and understandable
- Regularly reviewed and updated
- Integrated into business processes

**DOJ Evaluation Questions**:
- Are policies designed to address identified risks?
- Are policies communicated effectively?
- Are policies enforced consistently?
- Do policies cover all relevant risk areas?

### Element 2: Compliance Program Governance

**Requirements**:
- High-level personnel assigned overall responsibility
- Specific individual(s) assigned day-to-day operational responsibility
- Authority and resources to implement effectively

**Governance Structure**:

**Board of Directors**:
- Oversight of compliance program
- Regular reporting from compliance function
- Review of significant compliance matters
- Setting "tone at the top"

**Compliance Committee** (if applicable):
- Senior management representation
- Cross-functional membership
- Regular meetings
- Clear charter and responsibilities

**Chief Compliance Officer (CCO)**:
- Direct reporting to CEO and/or Board
- Appropriate seniority and authority
- Independence from business units
- Adequate resources and budget

**DOJ Evaluation Questions**:
- Does compliance have sufficient stature?
- Does CCO have direct access to Board?
- Has CCO authority been undermined?
- Is compliance function adequately funded?

### Element 3: Due Diligence in Delegation

**Requirements**:
- Exercise due diligence to exclude from substantial authority individuals whom the organization knew, or should have known, have engaged in illegal activities or other conduct inconsistent with an effective compliance program

**Implementation**:

**Hiring Practices**:
- Background checks for positions of authority
- Reference verification
- Screening against sanctions lists
- Review of disciplinary history

**Promotion Decisions**:
- Consider compliance record in advancement
- Evaluate ethical conduct
- Document compliance-related performance issues

**Third-Party Due Diligence**:
- Risk-based screening of vendors, agents, partners
- Contractual compliance representations
- Ongoing monitoring
- Termination rights for violations

### Element 4: Training and Communication

**Requirements**:
- Take reasonable steps to communicate standards and procedures
- Conduct effective training programs
- Disseminate information periodically and as appropriate

**Training Program Components**:

| Element | Description |
|---------|-------------|
| Audience | All employees; enhanced for high-risk roles |
| Content | Code of conduct, key policies, risk areas |
| Frequency | Annual minimum; ongoing as needed |
| Method | In-person, online, hybrid |
| Documentation | Attendance records, completion tracking |
| Assessment | Testing, certification requirements |

**Risk-Based Training**:
- Identify high-risk positions and functions
- Provide specialized training for risk areas
- More frequent training for higher-risk roles
- Language-appropriate materials

**DOJ Evaluation Questions**:
- Is training tailored to relevant audiences?
- Have employees been trained on relevant policies?
- How is training effectiveness measured?
- Is training updated based on lessons learned?

### Element 5: Monitoring, Auditing, and Evaluation

**Requirements**:
- Take reasonable steps to ensure compliance program is followed
- Evaluate effectiveness of the program periodically
- Use monitoring and auditing systems

**Monitoring vs. Auditing**:

| Monitoring | Auditing |
|------------|----------|
| Ongoing, continuous | Periodic, point-in-time |
| Real-time or near real-time | Retrospective review |
| Embedded in processes | Independent assessment |
| First/second line function | Third line function |

**Monitoring Activities**:
- Transaction monitoring
- Metrics and KPIs
- Exception reports
- Management review
- Trend analysis

**Audit Activities**:
- Compliance audits
- Internal audits
- Risk assessments
- Gap analyses
- Control testing

**DOJ Evaluation Questions**:
- Is monitoring designed to detect misconduct?
- Does company analyze compliance data?
- Are audits risk-based?
- How has company responded to audit findings?

### Element 6: Incentives and Disciplinary Measures

**Requirements**:
- Compliance program shall be promoted through appropriate incentives
- Consistent enforcement through appropriate disciplinary measures

**Incentive Structures**:
- Compliance metrics in performance evaluations
- Recognition programs for ethical behavior
- Consideration in compensation decisions
- Promotion criteria include compliance

**Disciplinary Framework**:
- Clear standards for discipline
- Consistent application across levels
- Proportionate to violation severity
- Documentation of disciplinary actions
- Non-retaliation for good faith reporting

**DOJ Evaluation Questions**:
- Does compensation system incentivize compliance?
- Are compliance failures reflected in evaluations?
- Has company disciplined employees for violations?
- Is discipline applied consistently regardless of position?

### Element 7: Response and Remediation

**Requirements**:
- Take reasonable steps to respond to and prevent further similar criminal conduct
- Modify compliance program as appropriate

**Incident Response**:
- Investigation protocols
- Escalation procedures
- Privilege preservation
- Remediation planning
- Root cause analysis

**Program Improvement**:
- Lessons learned integration
- Policy and procedure updates
- Training modifications
- Control enhancements
- Risk assessment updates

---

## RISK ASSESSMENT

### Purpose
Risk assessment identifies, evaluates, and prioritizes compliance risks to focus resources effectively.

### Risk Assessment Framework

#### Step 1: Risk Identification
Sources of risk information:
- Industry guidance and enforcement trends
- Prior incidents and near-misses
- Regulatory changes
- Business changes
- Employee feedback
- Third-party relationships
- Geographic factors

#### Step 2: Risk Evaluation

**Risk Scoring Matrix**:

| Factor | Description | Weight |
|--------|-------------|--------|
| Likelihood | Probability of occurrence | Variable |
| Impact | Severity if risk materializes | Variable |
| Velocity | Speed of impact realization | Variable |
| Controls | Current control effectiveness | Variable |

**Inherent vs. Residual Risk**:
- Inherent risk: Risk before controls
- Control effectiveness: How well controls mitigate risk
- Residual risk: Risk after controls

#### Step 3: Risk Prioritization
- Rank risks by residual risk score
- Identify top risks requiring attention
- Allocate resources accordingly
- Document risk acceptance decisions

#### Step 4: Risk Response
- **Avoid**: Discontinue activity creating risk
- **Mitigate**: Implement controls to reduce risk
- **Transfer**: Insurance, indemnification
- **Accept**: Acknowledge and monitor

### Risk Assessment Frequency
- Annual comprehensive assessment minimum
- Update for significant changes
- Ad hoc assessments for new risks
- Trigger-based reviews (incidents, regulatory changes)

---

## COMPLIANCE PROGRAM DOCUMENTATION

### Essential Documents

| Document | Purpose | Review Frequency |
|----------|---------|-----------------|
| Code of Conduct | Core values and expectations | Annual |
| Compliance Charter | Program authority and scope | Annual |
| Risk Assessment | Risk identification and prioritization | Annual |
| Policies and Procedures | Detailed requirements | Annual or as needed |
| Training Materials | Education and awareness | Annual or as needed |
| Investigation Protocol | Response procedures | Annual |
| Third-Party Standards | Vendor/partner requirements | Annual |

### Recordkeeping Requirements
- Training attendance and completion
- Policy acknowledgments
- Investigation files
- Audit reports
- Disciplinary actions
- Remediation tracking
- Board/committee minutes
- Risk assessment documentation

---

## PROGRAM EFFECTIVENESS METRICS

### Leading Indicators
- Training completion rates
- Policy acknowledgment rates
- Hotline/helpline awareness
- Control testing pass rates
- Audit finding closure rates
- Third-party screening completion

### Lagging Indicators
- Number and type of violations
- Investigation outcomes
- Regulatory findings
- Enforcement actions
- Litigation matters
- Reputational incidents

### Reporting Dashboard
- Regular reporting to management and Board
- Trend analysis over time
- Benchmarking where available
- Root cause analysis for failures

---

## THIRD-PARTY COMPLIANCE MANAGEMENT

### Risk-Based Due Diligence

**Risk Tier Framework**:

| Tier | Risk Level | Due Diligence | Monitoring |
|------|------------|---------------|------------|
| 1 | High | Enhanced DD, site visits | Continuous |
| 2 | Medium | Standard DD | Periodic |
| 3 | Low | Basic screening | As needed |

**Due Diligence Components**:
- Sanctions and watchlist screening
- Beneficial ownership verification
- Financial stability review
- Reputation assessment
- Compliance program evaluation
- Reference checks

### Contractual Requirements
- Compliance with laws representations
- Audit rights
- Subcontractor flow-down
- Termination for cause
- Reporting obligations
- Indemnification

---

## PROGRAM IMPLEMENTATION

### Phase 1: Assessment (Months 1-3)
- Current state assessment
- Gap analysis
- Risk assessment
- Resource planning
- Governance structure design

### Phase 2: Design (Months 3-6)
- Policy development
- Procedure documentation
- Control design
- Training development
- Technology selection

### Phase 3: Implementation (Months 6-12)
- Policy rollout
- Training delivery
- Control implementation
- Communication campaign
- System deployment

### Phase 4: Optimization (Ongoing)
- Monitoring and testing
- Program assessment
- Continuous improvement
- Maturity advancement

---

## REGULATORY PROGRAM EXPECTATIONS BY INDUSTRY

### Financial Services
- BSA/AML compliance
- Consumer protection
- Fair lending
- Privacy and data security
- Conflicts of interest

### Healthcare
- False Claims Act compliance
- Anti-Kickback/Stark Law
- HIPAA privacy and security
- Quality of care
- Billing compliance

### Government Contracting
- FAR/DFARS compliance
- Procurement integrity
- Cost accounting
- Security requirements
- Organizational conflicts

### Life Sciences
- GxP compliance
- Promotional practices
- Clinical trial integrity
- Pharmacovigilance
- Anti-corruption

---

## KEY CITATIONS

- **U.S. Sentencing Guidelines**: USSG § 8B2.1
- **DOJ Guidance**: Evaluation of Corporate Compliance Programs
- **Monaco Memorandum**: Deputy AG Policy (2022)
- **Individual Accountability Policy**: DOJ Criminal Division
- **Industry-Specific**: OIG Compliance Program Guidance (healthcare), FINRA rules (securities), FAR 52.203-13 (government contracting)

---

*Last Updated: March 2026*
*This reference is for informational purposes only and does not constitute legal advice.*