The U.S. Department of Justice (DOJ) recently updated its guidance for evaluating corporate compliance programs, highlighting its continued focus on ensuring businesses implement effective, responsible, and well-resourced compliance measures. These updates provide critical insights for corporations, particularly in the life sciences and healthcare sectors, as they navigate the evolving landscape of compliance and regulatory enforcement.

Key Updates to the DOJ Guidance

The guidance is structured around three fundamental questions for prosecutors:

1. Is the compliance program well-designed?
2. Is the compliance program adequately resourced and empowered to function effectively?
3. Does the compliance program work in practice?

Risk Assessments

The DOJ emphasizes the importance of conducting risk assessments, particularly for emerging technologies such as artificial intelligence (AI). Companies must evaluate the risks associated with these technologies and take proactive steps to mitigate them. Prosecutors will assess whether organizations have updated their policies and procedures to address new challenges, including whistleblower protection and anti-retaliation measures.

Mergers & Acquisitions

The revised guidance expands its focus on post-transaction compliance. Companies must integrate compliance programs effectively after mergers or acquisitions, with DOJ assessing activities such as policy integration, risk assessments, and post-acquisition audits.

Compliance Program Resources

Prosecutors are directed to examine the proportionality of resources allocated to compliance functions relative to other company operations. This includes an evaluation of data resources, access, and quality management.

Effectiveness in Practice

The DOJ introduces a new focus on leveraging data to measure compliance program effectiveness. Companies should monitor and test emerging technologies like AI to ensure they function as intended and align with their ethical standards. Transparency and proactive data collection to identify misconduct or deficiencies are also emphasized.

What These Updates Mean for Corporations

The DOJ’s updated guidance reinforces the importance of robust and adaptive compliance programs, particularly in industries facing heightened regulatory scrutiny. Key takeaways include:

• Increased focus on AI and emerging technologies: Companies must monitor AI systems post-deployment to ensure responsible usage.
• Enhanced post-merger compliance: Organizations should prioritize the seamless integration of compliance policies and procedures after transactions.
• Data-driven compliance evaluations: Leveraging data effectively is now a critical component of demonstrating program effectiveness.

Corporations should evaluate their compliance programs against the updated DOJ standards, ensuring that policies are not only well-designed but also effectively implemented and monitored.