Musings on ‘Aggravating Circumstances’ 

Today I want to return to the Justice Department’s new policies meant to encourage more self-disclosure of corporate misconduct, even from companies whose violations include aggravating circumstances. Those policies are a welcome step forward, but they create just as many questions for compliance officers as they answer.

Let’s first review what these new policies are. Announced last week by assistant attorney general Kenneth Polite, they state that a company whose misconduct includes aggravating circumstances might still be able to secure a declination to prosecute from the Justice Department if the company can meet three criteria:

• Self-disclose the misconduct immediately; 
• Have an effective compliance program and system of internal controls in place both at the time of the misconduct and of the disclosure; and 
• Provide an “extraordinary” level of cooperation and remediation. 

You can see why the Justice Department would want to offer such policies. A company that violates the Foreign Corrupt Practices Act or some other criminal statute with aggravating circumstances is in serious, expensive trouble. Corporate lawyers can make some compelling arguments that the wiser course of action is to keep quiet, fix the issue, and hope the Justice Department is never the wiser. These new policies are meant to tilt that calculus back toward disclosure, cooperation, and stronger compliance programs. 

Except, there’s the small matter of what “aggravating circumstances” actually are. When you look at them up close, they raise some tricky questions about how a company with such circumstances can meet those three criteria listed above. The possible answers could have big implications for where compliance officers want to devote resources and what messages you want to stress to senior management.

Define ‘Aggravating’

The Justice Department’s Corporate Enforcement Policy does include a (non-exhaustive) list of aggravating factors that might warrant criminal prosecution. Those factors include:

• Involvement by executive management of the company in the misconduct; 
• Egregiousness or pervasiveness of the misconduct within the company; 
• A significant profit to the company from the misconduct; or 
• Criminal recidivism. 

So let’s say you have an FCPA violation that involves executive management at the company. How can you square that fact with the second criteria mentioned above, that the company has an effective compliance program in place at the time of the misconduct? 

Like, can you have an effective compliance program in place if executive management is violating it? What would that even look like? 

Consider the Justice Department’s guidance on effective compliance programs, last updated in 2020. It says the following:

Prosecutors should examine the extent to which senior management have clearly articulated the company’s ethical standards, conveyed and disseminated them in clear and unambiguous terms, and demonstrated rigorous adherence by example…  How have senior leaders, through their words and actions, encouraged or discouraged compliance, including the type of misconduct involved in the investigation? What concrete actions have they taken to demonstrate leadership in the company’s compliance and remediation efforts? How have they modeled proper behavior to subordinates?

I’m hard-pressed to see how executive management can both uphold the compliance program and violate the compliance program at the same time. That’s not an effective compliance program, which logically means you can’t meet the new Corporate Enforcement Policy’s criteria.

One can say the same about another aggravating factor, “egregiousness or pervasiveness of the misconduct.” If the misconduct is pervasive, that means you have either a bad culture or bad policies and procedures. But the Justice Department guidance on compliance programs also says prosecutors should assess “whether the company has established policies and procedures that incorporate the culture of compliance into its day-to-day operations.” 

Again, isn’t there a logical inconsistency here? If your misconduct is pervasive, you haven’t established policies and procedures that incorporate a culture of compliance into daily operations. So you don’t have an effective compliance program. So you fail the second criteria of the new aggravated circumstances policy.

Alternate Theories of the Crime

Let’s go back to Polite’s speech, and exactly what he said about that second criteria:

At the time of the misconduct and the disclosure, the company has an effective compliance program and system of internal accounting controls that enables the identification of the misconduct and leads to the company’s voluntary self-disclosure.

What about that “system of internal accounting controls that allows identification of the misconduct” part? Is that supposed to be where compliance officers focus their attention?

One can see why that’s tempting. Compliance officers know how to build systems of internal controls. They are policies you write, approval requests you review, questionnaires you send out, duties you segregate, or reports you pass along. Systems of internal control are tangible things; cultures of compliance are not. 

Plus, the most important part of rooting out misconduct is finding it. We’re written up scads of FCPA enforcement actions over the years, and they always involve incomplete documentation or bogus third parties or some other failure of internal control.

So if you have an effective system of internal control that quickly surfaces a violation riddled with aggravating circumstances — would that bring your company back into the good graces of our new and improved Corporate Enforcement Program? Would the system of internal control make up for the aggravating circumstances that, as we explored above, otherwise invalidate your chance for a declination?

I suppose that would be great as a practical matter; it gives your company a path to declination, which is the goal here. But shouldn’t your culture of compliance and tone at the top outweigh your system of internal controls? If not, then why are we talking so much about culture and tone in the first place? 

Sigh. I think we need more speeches from the Justice Department.