Why compliance programs are judged
When misconduct surfaces, the Justice Department, the SEC, and other regulators look closely at whether the company had a compliance program that was designed sensibly, funded adequately, and actually worked. Their published guidance asks practical questions: whether the program fits the company's real risks, whether leadership supports it, and whether problems that were reported got investigated and fixed. A strong program does not prevent every violation, but it can affect whether a company is charged, how a matter is resolved, and whether a monitor is imposed. Federal enforcement priorities have shifted in recent years, so a program built around risk rather than around one agency's current focus tends to hold up better over time.
Building around actual risk
A useful starting point is a risk assessment that asks where the business could realistically get into trouble: bribery in overseas sales, sanctions and export controls, antitrust contact with competitors, data privacy, workplace issues, or industry-specific rules. Policies and training should then follow those risks, written for the employees who face them. Reporting channels need to be trusted, which means protecting people who raise concerns and following up visibly. Third parties such as agents, distributors, and consultants are a common source of exposure, so diligence on them deserves attention. Testing and auditing show whether the program works in practice, not just on paper.
Responding when something goes wrong
When a report or audit suggests a real problem, the response often matters as much as the original conduct. Preserve relevant records, decide who will investigate and whether counsel should direct the work, and keep the board appropriately informed. Some situations raise a question about voluntary self-disclosure, and government policies reward timely disclosure, cooperation, and remediation in many matters. In a first engagement, we review the program and recent incidents, identify gaps by priority, and recommend steps the company can sustain with its current resources. For a company facing an active issue, we start with the investigation plan and the disclosure question.
