What the DOJ compliance guidance means for your ethics program

What to take away

What the DOJ Criminal Division evaluates in a compliance program

The DOJ Criminal Division, through its Fraud Section, publishes the questions its prosecutors use when assessing a company's compliance program. Those questions come from the Evaluation of Corporate Compliance Programs (updated guidance), which is the working document most compliance officers should read first.

The current version is dated September 2024.

The guidance is not a rulebook. It is a set of prompts prosecutors apply when deciding whether to charge a company, what to charge, and what penalty to seek. The practical effect is that a program's design, its day-to-day operation and its track record all become evidence.

Prosecutors also weigh the company's size, industry, geographic footprint and regulatory environment. A Delaware holding company with a small compliance team is not measured against a global bank. The measure is whether the program fits the risk the business actually carries.

The Fraud Section's questions reach beyond written policy. They cover how risk assessments are done, who owns compliance, how training is delivered, how reports are handled, how investigations are run, and what happens to people who break the rules. Each of those areas has its own expectations.

One theme runs through the guidance: documentation. Prosecutors cannot credit a control they cannot see. A decision to decline a risky client, a training session that changed behavior, an investigation that led to discipline, all of it needs a record.

The Criminal Division's approach sits alongside other DOJ materials. The department publishes its policy documents through the Department of Justice | Guidance Documents | United States Department of Justice, and its charging and cooperation principles live in the Justice Manual | Justice Manual | United States Department of Justice.

The core sections are Justice Manual 9-28.300, which lists the factors prosecutors weigh when charging a business organization, and 9-28.700, on the value of cooperation. Section 9-47.120 sets the FCPA Corporate Enforcement Policy.

The Justice Manual matters because it governs how prosecutors treat voluntary disclosure, cooperation and remediation. A company that finds and fixes a problem early can fare very differently from one that waits for a subpoena.

The U.S. Sentencing Guidelines Chapter 8 baseline for effective ethics programs

U.S. Sentencing Guidelines Chapter 8 is the sentencing framework for organizations convicted of federal crimes. It sets out the seven elements that define an effective compliance and ethics program, and it is the baseline the DOJ guidance builds on. The U.S. Sentencing Commission publishes the organizational guidelines at Organizational Guidelines | United States Sentencing Commission.

Chapter 8 also requires that the program promote a culture that encourages ethical conduct and a commitment to compliance with the law. That cultural requirement is why prosecutors ask about tone at the top and middle, not just policies.

The guidelines reward companies that had an effective program in place at the time of the offense. They also allow a culpability reduction for self-reporting, cooperation and acceptance of responsibility. Those reductions are the financial reason to invest in a real program.

Chapter 8 is updated periodically, and the current standards appear in the 2025 Guidelines Manual | United States Sentencing Commission. Compliance officers should track the manual because the commentary explains how the Commission reads each element.

The guidelines apply to organizations of every size, but the commentary recognizes that smaller entities may satisfy the requirements with less formality. A 200-person manufacturer in Ohio does not need the same apparatus as a Fortune 100 company, but it does need the same seven elements.

Two elements are most often underbuilt in mid-sized companies: monitoring and auditing, and consistent enforcement. Both require someone to look at data and act on what it shows, which is harder than publishing a policy.

A useful discipline is to map each of the seven elements to a named owner, a document and a test.

How the Evaluation of Corporate Compliance Programs guidance maps to training

The DOJ guidance treats training as a risk-based activity, not a calendar event. Prosecutors ask whether training is tailored to the company's risk profile, delivered to the right people, and evaluated for effectiveness. Attendance records alone do not answer those questions.

The guidance asks whether training covers the company's code of conduct, its policies, and the specific legal and ethical risks employees face. A sales team in Texas facing Foreign Corrupt Practices Act exposure needs different content from a procurement team negotiating with domestic suppliers.

It also asks who receives training and how often. High-risk roles, new hires, managers and third-party intermediaries are the groups prosecutors expect to see addressed. Managers matter because they are the first line of detection in most organizations.

Delivery format is secondary to comprehension. The guidance asks whether employees understood the training and whether the company tested that understanding. A quiz that everyone passes on the first try is weak evidence. A stronger metric is the share of managers who answer the same scenario question correctly a year later.

Companies that want training to hold up should treat it like any other control: define the behavior it is meant to change, measure whether the behavior changed, and keep the results. Our guide to building ethics training programs covers how to design sessions around real decisions rather than legal abstractions.

The guidance also asks whether training is updated when risks change. A new market, a new product line, a new acquisition or a new regulatory requirement should trigger a review of content. Static decks age badly.

For a structured self-audit, our guide to the best customer ethics tools 2027 sets out twelve tests that go beyond attendance, including whether employees can describe the reporting channel and whether managers know when to escalate.

Reporting channels and investigation standards the DOJ expects

The guidance asks whether the company has an anonymous reporting mechanism, whether employees know about it, and whether they trust it. A hotline that exists but is never used is a warning sign, not a comfort.

Prosecutors look at how reports are triaged, who sees them, and how quickly they move. They also ask whether the company tracks reports for patterns, because repeated complaints about the same manager or the same region should change how the company allocates oversight.

Anti-retaliation is a specific focus. The guidance asks whether the company has a policy against retaliation and whether it has ever enforced that policy. Employees who fear consequences report less, and prosecutors know it.

The investigation standard is independence, competence and documentation. The guidance asks who conducts investigations, whether they report to the board or a committee, and whether the company uses outside counsel when the matter involves senior management.

Investigations should reach a factual conclusion and a documented decision.

The same logic applies to individual accountability. The Criminal Division has been explicit that it will pursue individuals, and compliance officers themselves are not immune. Our article on Compliance Officer Personal Liability explains what prosecutors actually examine when a program fails.

A reporting system is only as good as its follow-through. If employees see that reports lead to action, they keep reporting. If they see silence, the channel dies quietly and the company loses its best early-warning system.

Remediation, discipline and program updates after misconduct

Remediation is where the guidance gets specific. Prosecutors ask whether the company disciplined the people responsible, whether it fixed the root cause, and whether it changed the program so the same problem cannot recur.

Discipline must be consistent across seniority. The guidance asks whether the company has ever disciplined a senior executive or a high performer, because that is the test of whether the program applies to everyone.

The company should also examine incentives. The guidance asks whether compliance is built into compensation, promotion and bonus decisions, and whether managers are rewarded for ethical outcomes or only for revenue.

Root-cause analysis is a distinct step from investigation. The investigation establishes what happened. The analysis asks why the controls failed, which may point to staffing, training, incentives, unclear authority or an unaddressed conflict of interest.

After a violation, the company should update its risk assessment, revise affected policies, retrain the relevant population and test the fix. Each step should be dated and owned, so the record shows a sequence rather than a promise.

Self-reporting and cooperation remain significant. Under the Justice Manual, a company that discloses, cooperates and remediates can receive credit that materially affects the outcome. Waiting for a subpoena forfeits most of that credit.

Program updates should also be triggered by external events: a competitor's enforcement action, a new regulation, a change in the company's markets. The guidance asks whether the program is a living system or a document from a past era.

Applying the criteria to a mid-sized U.S. company's ethics program

Consider a 600-employee industrial supplier headquartered in Illinois, with sales offices in Texas and Florida and a small distribution operation in California. It is private, not public, and it sells to government contractors and to buyers in Mexico.

Its risk profile includes FCPA exposure through the Mexico sales channel, OSHA obligations at two plants, EPA issues around waste handling, and government contracting rules. None of that requires a large compliance department, but all of it requires named owners.

A workable sequence looks like this:

The company should also revisit its code of conduct as part of this work, because a code that cannot guide a decision under pressure will not satisfy the Chapter 8 standards element. Our Codes of conduct checklist covers the items prosecutors expect to see, including speak-up provisions and consequences.

Keep a decision log. The log should show the date, the decision, the owner, the reason and the follow-up:

Review the log each quarter alongside the latest control test.

Checklist for aligning an ethics program with DOJ compliance guidance

Use this as a working list. Each item should have an owner and a date.

Two habits keep the list honest. First, test one control each quarter rather than reviewing the whole program once a year. Second, keep a decision log, because the reasoning behind a hard call is often the best evidence of good faith.

Common questions