DOJ Updates Evaluation of Corporate Compliance Programs

The US Department of Justice’s Criminal Division released its updated Evaluation of Corporate Compliance Programs (ECCP) on September 23, 2024. According to an article by attorneys at Morrison Foerster, this document introduces key revisions in three primary areas: managing AI and emerging technology risks, promoting whistleblower protections, and ensuring compliance personnel have access to sufficient data. These updates reflect the DOJ’s increasing focus on emerging technologies and whistleblower support, building on prior guidance from March 2023.

The September 2024 ECCP includes guiding questions to assess corporate use of AI, urging companies to integrate AI risk management into broader strategies and establish safeguards against misuse. It emphasizes accountability, monitoring, and ensuring AI is trustworthy and aligned with legal standards. The article notes that this reflects Deputy Attorney General Lisa Monaco’s 2024 focus on AI’s potential risks and the need for stronger sentencing in AI-enabled crimes.

Following the launch of the Corporate Whistleblower Awards Pilot Program in August 2024, the Evaluation of Corporate Compliance Programs strengthens guidance on anti-retaliation measures and incentivizes companies to foster reporting of misconduct. Prosecutors will assess how companies treat whistleblowers and enforce anti-retaliation policies.

Additionally, the ECCP highlights the importance of giving compliance personnel access to data and recommends that companies leverage data analytics tools for efficiency and accuracy in compliance operations. The update also addresses industry peers’ lessons, mergers and acquisitions compliance, and third-party risk management.

According to the article, the 2024 revisions underscore the need for companies to proactively address emerging compliance risks, particularly around AI, maintain robust whistleblower protections, and invest equally in compliance technologies as they do in business growth.