What's Happening?
Assistant Attorney General A. Tysen Duva, head of the Justice Department’s Criminal Division, recently addressed corporate boards and chief executives at a third-party risk management and supply chain conference in Chicago. His message emphasized the critical
importance of adequately funding compliance programs and promptly disclosing any discovered wrongdoing to the Department. Duva highlighted that companies can achieve one of three outcomes under the Corporate Enforcement Policy: a Part I declination, a Part II 'near miss' resolution, or a Part III resolution. He stressed that early disclosure can lead to a declination, which is a significant benefit, but this option is off the table if a whistleblower or the media reports the issue first. The Department evaluates whether compliance programs are sufficiently resourced, indicating that underfunded programs will not earn credit. Duva also noted that the Department will consider the totality of circumstances and will not retroactively fault companies for not discovering problems sooner, but warned against sitting on known issues for years.
Why It's Important?
This directive from the DOJ's Criminal Division Chief carries substantial implications for U.S. businesses, particularly those operating in complex regulatory environments or with extensive supply chains. The emphasis on early self-disclosure and robust compliance funding aims to shift corporate behavior towards proactive risk management rather than reactive crisis control. Companies that invest in and effectively implement compliance programs stand to gain significant advantages, including potential declinations from prosecution, which can save them from hefty fines and reputational damage. Conversely, those that fail to prioritize compliance or delay disclosure risk severe penalties, including substantial disgorgement payments and prolonged external monitoring. This policy also underscores the increasing scrutiny on third-party risk management, especially in regions prone to corruption, and highlights the DOJ's focus on cyber-enabled scams and the involvement of U.S. markets in unlawful activities tied to foreign entities.
What's Next?
Companies are expected to review and potentially enhance their compliance budgets and internal investigation protocols in response to Duva's remarks. The guidance suggests that companies should conduct swift and diligent internal investigations to identify wrongdoing and responsible parties, then present a summary of findings and relevant documents to the Department without delay. This proactive approach is crucial for securing the most favorable outcomes under the Corporate Enforcement Policy. The DOJ's continued pursuit of individuals involved in corporate misconduct, even when companies receive declinations, indicates a dual enforcement strategy. Businesses, especially financial institutions and advisors with exposure to markets in Southeast Asia, should anticipate increased scrutiny and potential questions as the Criminal Division's Cyber-Enabled Scam Initiative progresses.
Beyond the Headlines
The DOJ's stance reflects a broader trend towards holding corporations accountable for their internal controls and ethical conduct. The policy's focus on 'third-party risk' and 'high-risk regions' suggests an acknowledgment of the globalized nature of business and the challenges companies face in maintaining oversight across complex international operations. The mention of AI as a tool for compliance, rather than a replacement for human expertise, highlights the evolving role of technology in corporate governance while emphasizing the irreplaceable value of human judgment and investigation. This approach could lead to a more sophisticated integration of AI in compliance efforts, coupled with a renewed focus on human-led oversight. The policy also implicitly encourages a 'race to disclose' among companies, potentially leading to more frequent self-reporting and a more transparent corporate landscape, albeit with the inherent pressure of being the first to come forward.
