New DOJ Corporate Enforcement Policy Places Still More Pressure on Companies to Cooperate and Self-Report

Last month in a speech at Georgetown University Law Center, Assistant Attorney General Kenneth A. Polite, Jr., announced revisions to the Department of Justice’s Corporate Enforcement Policy, to apply to all corporate criminal matters. The new policy places greater emphasis — and incentives — on companies to voluntarily self-disclose wrongdoing and cooperate with DOJ investigations. Absent “aggravating circumstances,” the new policy declares that “when a company has voluntarily self-disclosed misconduct, . . . fully cooperated, and timely and appropriately remediated, . . . there will be a presumption that the company will receive a declination” (i.e., the company will not be charged). While the new policy provides strong incentives for companies, it also will require them to make decisions that could have significant, long-term ramifications quickly, and possibly even before they have fully ascertained and assessed the relevant facts and circumstances.

In announcing the new policy, AAG Polite emphasized the DOJ was “sending an undeniable message — come forward, cooperate, and remediate. We are going to be closely examining how companies discipline bad actors and reward good ones. . . . Failing to take these steps, a company runs the risk of increasing its criminal exposure and monetary penalties.” The new policy furthers the DOJ’s goals of efficiently identifying and addressing criminal wrongdoing, with particular emphasis on prosecuting individual wrongdoers and deterring corporate malfeasance with incentives that include declining prosecution for cooperating companies and increasing the discount on fines and penalties for companies that are charged. But it also places greater and more time-sensitive pressure on companies considering whether to self-disclose possible wrongdoing and leaves unanswered many questions about how the policy will be implemented in practice.

Key Provisions of the Corporate Enforcement Policy

The Policy provides an avenue for a company to avoid being charged if, absent “aggravating circumstances,” it has:

1. 1. voluntarily self-disclosed;
   2. fully cooperated;
   3. timely and appropriate remediated; and
   4. paid all disgorgement, forfeiture, and/or restitution stemming from the misconduct at issue.

Where “aggravating circumstances” are present, the DOJ still may decline to prosecute the company, but the company will not qualify for a presumption of declination. “Aggravating circumstances” are not fully defined under the policy but include:

1. 1. involvement by executive management of the company in the misconduct;
   2. significant profit to the company from the misconduct;
   3. egregiousness or pervasiveness of the misconduct within the company; and
   4. criminal recidivism.

To achieve a declination in these circumstances, the company must meet all of the following factors:

1. 1. The voluntary self-disclosure was made immediately upon the company becoming aware of the allegation of misconduct;
   2. At the time of the misconduct and disclosure, the company had an effective compliance program and system of internal accounting controls, which enabled the identification of the misconduct and led to the company’s voluntary self-disclosure; and
   3. The company provided extraordinary cooperation with the Department’s investigation and undertook extraordinary remediation that exceeds the respective factors listed herein.

Where the company has met the factors listed above, but the DOJ has nonetheless determined that a criminal resolution is warranted, the DOJ will recommend to the court that the company receive a reduction of up to 75% off the low end of the U.S. Sentencing Guidelines fine range. The DOJ will not “generally” require a corporate guilty plea (instead of a Deferred Prosecution Agreement or a Non-Prosecution Agreement) absent the presence of “particularly egregious or multiple aggravating circumstances.” Additionally, the DOJ will not require a monitor if the company has demonstrated that it has an effective compliance program and that it has remediated the root cause of the misconduct.

If the company did not voluntarily self-disclose the misconduct but later fully cooperated and appropriately remediated, it may still qualify for a reduction of up to 50% off the low end of the Sentencing Guidelines fine range.

The revised CEP defines certain key terms as follows:

“Voluntary Self-Disclosure” requires that:

• The company had no pre-existing obligation to disclose the misconduct.
• The voluntary disclosure qualifies under U.S.S.G. § 8C2.5(g)(1) as occurring “prior to an imminent threat of disclosure or government investigation.”
• The company discloses the conduct to the Criminal Division within a reasonably prompt time after becoming aware of the misconduct, with the burden being on the company to demonstrate timeliness.
• The company discloses all relevant, non-privileged facts known to it, including all relevant facts and evidence about all individuals involved in or responsible for the misconduct at issue, including individuals inside and outside of the company regardless of their position, status, or seniority.

“Full Cooperation” requires:

• Timely disclosure of all non-privileged facts relevant to the wrongdoing at issue.
• Proactive cooperation, rather than reactive; that is, the company must timely disclose all facts that are relevant to the investigation, even when not specifically asked to do so.
• De-confliction of witness interviews and other investigative steps that a company intends to take as part of its internal investigation to prevent the company’s investigation from conflicting or interfering with the Criminal Division’s investigation.
• Subject to the individuals’ Fifth Amendment rights, making company officers and employees who possess relevant information available for interviews by the Criminal Division.

“Timely and Appropriate Remediation” requires:

• Demonstration of thorough analysis of causes of underlying conduct (i.e., a root cause analysis) and, where appropriate, remediation to address the root causes.
• Implementation of an effective compliance and ethics program.
• Appropriate discipline of employees, including those identified by the company as responsible for the misconduct, either through direct participation or failure in oversight, as well as those with supervisory authority over the area in which the criminal conduct occurred.
• Any additional steps that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risks.

Finally, the Policy specifically notes that declinations of corporate prosecution made pursuant to the Policy will be made public.

Implications of the Policy and Unanswered Questions

It is both laudable and appropriate that the DOJ has publicly provided its guidelines for determining when — and when it will not — prosecute corporate misconduct. That said, the revised CEP assumes ab initio that the wrongdoing identified is criminal in nature and leaves many questions unanswered.

First, by its terms, the Policy applies only to criminal activity. However, the question of whether corporate misconduct, including the personal misconduct of individual executives and employees, was criminal is often unclear in complex, white-collar matters. Learned legal minds may and often do reasonably disagree on whether there was a crime. A lengthy internal investigation and substantial legal analysis by the company’s attorneys may be necessary to differentiate between intentional misconduct and a negligent mistake or series of mistakes. Under the revised CEP, however, companies that undertake a thoughtful and thorough investigation before determining that there was criminal activity could be punished for doing so, while alternatively companies that rush to voluntarily self-disclose and then endure a costly and painful DOJ investigation, may end up with a determination that there was no criminal activity after all. Companies must perform the complicated calculus of choosing between self-reporting, with the consequent cost and disruption of a federal criminal investigation, in the hope of possibly obtaining a more favorable outcome against the inevitable scrutiny by other regulators and potential civil lawsuits by shareholders, corporate partners, or others.  Companies that have identified aggravating circumstances may be less inclined to voluntarily self-report, which ironically is what the DOJ is purportedly trying to avoid.

Second, the definitions of certain terms are vague and subject to interpretation, while other important terms are not defined. The Policy provides a non-exhaustive list of “aggravating circumstances,” which suggests that there could be others, while the ones provided are subject to interpretation. What level of involvement by executive management counts? What proportion of the profit from the wrongdoing to the company’s overall profits qualifies as “significant”? 5%? 10% 25%? How does the DOJ define the level of pervasiveness of the misconduct within the company?

For companies that do not benefit from the presumption of declination based on of aggravating circumstances but are still seeking declination, how does the DOJ decide that the company provided “extraordinary cooperation” as opposed to “full cooperation”? Interestingly, AAG Polite provided an answer reminiscent of Justice Potter Stewart’s infamous obscenity test, stating that, “In many ways, we know ‘extraordinary cooperation’ when we see it, and the differences between ‘full’ and ‘extraordinary’ cooperation are perhaps more in degree than kind. To receive credit for extraordinary cooperation, companies must go above and beyond the criteria for full cooperation set in our policies — not just run of the mill, or even gold-stand cooperation, but truly extraordinary.”

The voluntary self-disclosure must be made “immediately upon the company becoming aware of the allegation of misconduct” in order to avoid prosecution if there are aggravating circumstances. How does the Department determine whether the self-disclosure was made “immediately”? To what extent may the company take the time to investigate whether the allegation was even credible? Additionally, the voluntary self-disclosure factors specifically require that the company had no pre-existing obligation to disclose the misconduct. How does this affect companies in regulated industries like healthcare, which have statutory or regulatory self-disclosure obligations?

The remediation definition includes a requirement that the company undertook “[a]ny additional steps that demonstrate recognition of the seriousness of the company’s misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risks.” How will the DOJ determine if the company needed to and undertook specific “additional steps”?

Conclusion

Notwithstanding the unanswered questions, with the updated Corporate Enforcement Policy, the DOJ is signaling increased and stricter focus on corporate criminal enforcement and an emphasis on individual accountability. Further, the DOJ is trying to provide concrete guidance to companies on how they can mitigate adverse corporate consequences in the event they discover criminal wrongdoing. In that regard, the Policy seeks to provide tangible benefits to companies that have strong compliance programs, voluntarily self-disclose wrongdoing as soon as practically possible, and cooperate with any investigation.