Guides
Washington, D.C. regulators, a checklist for corporate ethics compliance
Corporate ethics compliance in Washington, D.C. means meeting DOJ, SEC, FEC and OSHA expectations. Here is the checklist regulators actually test.
What to take away
- Corporate ethics programs are judged less on written policies than on evidence that they work in practice, and Washington, D.C. regulators now ask for that evidence by name.
- DOJ enforcement priorities reward programs that get resources, data access and a seat at the business table, not programs that exist only on paper.
- SEC compliance expectations for issuers center on disclosure controls, internal accounting controls and cooperation during Enforcement investigations.
- FEC reporting rules govern corporate political activity through separate segregated funds, contribution limits and regular filing with the Commission.
- OSHA obligations cover workplace safety standards plus anti-retaliation protection for employees who report hazards.
- Documentation is the thread that runs through all fourdated decisions, reasons and follow-up records are what counsel can hand a regulator.
DOJ enforcement priorities and what they mean for ethics programs
The Department of Justice Criminal Division, Fraud Section, sets the tone other agencies follow. Its written guidance asks three questions: is the program well designed, is it adequately resourced and empowered, and does it work in practice.
That third question is the one that catches companies out. Prosecutors want to see that compliance staff can access relevant data and personnel, that the function has standing inside the business, and that misconduct is actually detected and remediated rather than absorbed.
The DOJ baseline expectations for effective ethics and compliance programs are set out in the Evaluation of Corporate Compliance Programs (updated guidance), and they are updated periodically, so programs built to a five-year-old memo may already be behind. Read the current version before an incident forces you to.
Under the U.S. Sentencing Commission Guidelines Manual, Chapter 8, an effective program can reduce a fine after conviction. That is the financial argument for the same work prosecutors describe.
Personal exposure is part of the picture. Compliance officers can be named in enforcement actions where they ignored red flags or signed off on controls they knew were hollow. The dynamics of Compliance Officer Personal Liability are worth understanding before you certify anything.
What prosecutors actually look for
- A compliance function with its own budget and direct access to the board or audit committee
- Risk assessments refreshed on a schedule, not only after a scandal
- Policies employees can follow and apply to real decisions
- Training that is tested for effect, not just completion
- A confidential reporting channel with a documented triage process
- Disciplinary outcomes applied consistently, including to senior staff
- Remediation steps tracked to closure after every incident
SEC compliance expectations for issuers in Washington, D.C.
The SEC's Division of Enforcement investigates and prosecutes violations of the federal securities laws, and its process shapes what issuers must be ready to show. Cases often begin with a formal order of investigation, followed by document requests, testimony and, in many matters, a settlement or civil action.
For public companies, the practical exposure sits in two places: disclosure controls and procedures, and internal accounting controls. If a company cannot show who reviewed a disclosure and why, that gap becomes the story.
Cooperation matters. Enforcement staff credit companies that self-report, preserve evidence and remediate quickly, and they treat obstruction or slow production as an aggravating factor.
Whistleblower reports reach the Commission directly, which means an internal complaint can become an external file before management hears about it. A credible internal reporting route is a defensive asset.
Corporate political spending sits inside this disclosure perimeter for many issuers, and the gaps shareholders can still see are mapped in Corporate Political Spending Disclosure.
Preparing for an SEC inquiry
- Identify a single point of contact for document requests and testimony.
- Issue a litigation hold the day you learn of a possible violation.
- Map which controls touch the conduct at issue and who owns each one.
- Preserve drafts, emails and chat records in their native format.
- Prepare witnesses with facts, not scripts.
FEC rules for corporate political activity and reporting
The Federal Election Commission regulates how corporations may participate in federal elections. Direct corporate contributions to candidates and party committees are prohibited. Corporate money moves through a separate segregated fund, commonly called a PAC, or through independent expenditures made without coordination.
The FEC publishes Help for candidates and committees, covering registration, recordkeeping and filing schedules for corporate political contributions and reporting. Reports are filed on fixed deadlines, and late or amended filings are visible to anyone who checks.
For compliance officers, the risk is rarely a single large gift. It is a pattern of small, poorly documented disbursements routed through state or local intermediaries, or employees reimbursed for personal contributions, which is unlawful.
Board oversight of this activity belongs with a committee that has a written mandate, a point covered in Board Ethics Committee guidance on the audit committee relationship.
FEC compliance basics
- Confirm no corporate treasury funds go directly to federal candidates
- Register and maintain the separate segregated fund properly
- Track contribution limits and source restrictions per donor
- Keep solicitation records for the required retention period
- File reports on time and reconcile them to internal ledgers
OSHA obligations for workplace safety and whistleblower protection
The Occupational Safety and Health Administration sets and enforces workplace safety standards. Laws and Regulations from OSHA cover hazard communication, recordkeeping of injuries and illnesses, training, and inspection procedures.
Most corporate ethics programs touch OSHA through two doors. The first is the general duty to provide a workplace free of recognized hazards. The second is anti-retaliation: employees who report injuries, hazards or violations are protected, and retaliation claims can survive even when the underlying safety complaint does not.
Recordkeeping is where many companies fail quietly. Injury logs must be complete and posted as required, and underreporting discovered during an inspection is treated as a serious finding.
A safety concern raised through an ethics hotline should reach someone with authority to stop work. If it lands in a queue with no owner, the company has an OSHA problem and an ethics problem at once.
OSHA readiness steps
- Review current standards for each site and each job category.
- Verify injury and illness logs against payroll and workers compensation data.
- Train supervisors on anti-retaliation rules, not just hazard rules.
- Document every hazard report, response and closure.
- Run a mock inspection with someone outside the safety function.
A practical compliance checklist for corporate ethics programs
This is the working checklist. It combines the DOJ, SEC, FEC and OSHA expectations above into one set of items a compliance officer can assign and track.
- Current risk assessment covering bribery, fraud, sanctions, political activity and safety
- Written code of conduct owned by a named executive, reviewed on a set cycle
- Codes of conduct checklist items mapped to your own code gaps
- Training assigned by role and risk, with completion and comprehension data retained
- Third-party due diligence before onboarding agents, consultants and intermediaries
- Gifts, hospitality and travel register with thresholds and approvals
- Political activity register reconciled to FEC and state filings
- Confidential reporting channel with a documented case management log
- Investigation protocol with timelines, owners and escalation triggers
- Disciplinary matrix applied consistently across seniority levels
- Board reporting on compliance metrics at least twice a year
- Annual program review with written findings and a remediation plan
Training deserves its own attention because it is the item regulators test first and companies update last. Building ethics training programs that change behavior means measuring decisions, not attendance.
Documenting decisions to satisfy D.C. regulators
Regulators in Washington, D.C. read documents the way auditors read ledgers. A decision with no date, no author and no stated reason looks like a decision nobody made.
The DOJ publishes its guidance documents, including compliance program guidance, and those texts reward companies that can show contemporaneous reasoning. Write the memo when the question is live, not when the subpoena arrives.
A simple record for each material ethics decision should capture the question, the facts known at the time, the options considered, the person who decided, and the follow-up date. One page is usually enough.
Keep the record where it will survive turnover. Shared drives with no owner lose files, and departing employees take context with them.
When you cannot document a control, assume a regulator will treat it as absent. That assumption is harsh, but it is the one that produces useful files.
