AI, Whistleblower Protection, Post-M&A Integration in Corporate Compliance Programs
Question: What factors our company needs to take into account when revising and updating its corporate compliance program?
Answer: The U.S. Department of Justice (DOJ) regularly updates its guidance on evaluation of corporate compliance programs, which serves as a helpful resource for companies. In case of an enforcement action, a company with an effective compliance program is more likely to receive a favorable resolution. In September 2024, the DOJ updated its guidance, focusing on the following key areas:
1. Assessment of New Technology Risks:
New and emerging technology is among the new risk factors highlighted by the DOJ. Companies are recommended to conduct a risk assessment related to the use of new technology and make sure that any risks are appropriately mitigated. Particular emphasis is placed on artificial intelligence (AI) and making sure its use is monitored to avoid any potential negative or unintended consequences. In addition, companies are advised to appropriately leverage data analytics tools to create efficiencies in compliance operations.
2. Commitment to Whistleblower Protection and Anti-Retaliation:
DOJ is emphasizing its commitment to whistleblower protection and going forward will evaluate whether companies have an anti-retaliation policy and whether employees are appropriately trained on anti-retaliation and whistleblower protection policies and on internal reporting systems.
3. Post-Transaction Integration:
Post M&A compliance integration is high on the DOJs agenda. Companies should have a process in place to ensure compliance oversight of the newly acquired business. The new business should also be incorporated into the company’s risk assessment and internal policies and procedures should reflect that. Post-acquisition audits at newly acquired entities are equally important.
*The contents of this message, current at the date of publication, are for reference and general informational purposes only and do not constitute legal advice. You should contact your attorney to obtain advice with respect to any particular legal matter. You should not act or refrain from acting on the basis of information in this publication without first seeking legal advice from counsel in the relevant jurisdiction. Only your individual attorney can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation.
Question: What factors our company needs to take into account when revising and updating its corporate compliance program?
Answer: The U.S. Department of Justice (DOJ) regularly updates its guidance on evaluation of corporate compliance programs, which serves as a helpful resource for companies. In case of an enforcement action, a company with an effective compliance program is more likely to receive a favorable resolution. In September 2024, the DOJ updated its guidance, focusing on the following key areas:
1. Assessment of New Technology Risks:
New and emerging technology is among the new risk factors highlighted by the DOJ. Companies are recommended to conduct a risk assessment related to the use of new technology and make sure that any risks are appropriately mitigated. Particular emphasis is placed on artificial intelligence (AI) and making sure its use is monitored to avoid any potential negative or unintended consequences. In addition, companies are advised to appropriately leverage data analytics tools to create efficiencies in compliance operations.
2. Commitment to Whistleblower Protection and Anti-Retaliation:
DOJ is emphasizing its commitment to whistleblower protection and going forward will evaluate whether companies have an anti-retaliation policy and whether employees are appropriately trained on anti-retaliation and whistleblower protection policies and on internal reporting systems.
3. Post-Transaction Integration:
Post M&A compliance integration is high on the DOJs agenda. Companies should have a process in place to ensure compliance oversight of the newly acquired business. The new business should also be incorporated into the company’s risk assessment and internal policies and procedures should reflect that. Post-acquisition audits at newly acquired entities are equally important.
*The contents of this message, current at the date of publication, are for reference and general informational purposes only and do not constitute legal advice. You should contact your attorney to obtain advice with respect to any particular legal matter. You should not act or refrain from acting on the basis of information in this publication without first seeking legal advice from counsel in the relevant jurisdiction. Only your individual attorney can provide assurances that the information contained herein – and your interpretation of it – is applicable or appropriate to your particular situation.
