The DOJ Guidance (also known as the Evaluation of Corporate Compliance Programs or ECCP) is the framework prosecutors use to grade a compliance program and determine penalties when a company gets in trouble. Compliance programs are graded on three main criteria: (1) is the program well designed? (2) is it applied earnestly and in good faith? and (3) does it work in practice? Underneath these criteria are more than a hundred specific questions that the DOJ looks at. Meeting the criteria is the sign of an adequate compliance program, not necessarily an innovative one.

Going deeper: this entry defines the ECCP. For a walkthrough of how to run your own program against it, read the DOJ ECCP as a self-assessment tool.

What are the ECCP's three criteria?

The Criminal Division's Evaluation of Corporate Compliance Programs, updated September 2024, tells prosecutors to ask three fundamental questions. The wording below is the document's.

#The question the ECCP asks prosecutors to poseWhat the document groups under it
1"Is the corporation's compliance program well designed?"Risk assessment, policies and procedures, training and communications, confidential reporting and investigation, third-party management, and mergers and acquisitions
2"Is the program being applied earnestly and in good faith?"Commitment by senior and middle management, autonomy and resources, and compensation structures and consequence management
3"Does the corporation's compliance program work in practice?"Continuous improvement, periodic testing and review, investigation of misconduct, and analysis and remediation of underlying misconduct

What does the ECCP decide?

The September 2024 ECCP says prosecutors evaluate a compliance program for purposes of determining the appropriate "(1) form of any resolution or prosecution; (2) monetary penalty, if any; and (3) compliance obligations contained in any corporate criminal resolution (e.g., monitorship or reporting obligations)."

That third one is the practical stake. A monitorship is the most expensive outcome short of a conviction, and it lands on programs that look good on paper and thin in operation.

Is the ECCP a checklist?

No, and the document says so. The September 2024 ECCP states that the Criminal Division "does not use any rigid formula to assess the effectiveness of corporate compliance programs," and that "[t]he sample topics and questions below form neither a checklist nor a formula." It also tells prosecutors that the topics and questions set out in it may not all be relevant to a given company. Program design is expected to follow the company's own risk profile, which is why a real compliance risk assessment is upstream of everything else the ECCP asks about.

How does the ECCP relate to the Sentencing Guidelines?

The seven elements of an effective compliance program come from the US Sentencing Guidelines at USSG 8B2.1(b), which sets out the minimum steps an organization takes to exercise due diligence and promote an organizational culture that encourages ethical conduct and compliance with the law. The ECCP is the prosecutor-facing companion. The Guidelines set the structure. The ECCP asks whether that structure does anything.

FAQ

Which version of the ECCP is current?

The current version is dated September 2024. A revision inside twelve months is plausible, so check the Criminal Division's policy materials before relying on a specific passage.

Where can I read the ECCP?

The September 2024 version is published at justice.gov/media/1160391/dl.

Does the ECCP apply only to FCPA cases?

No. The September 2024 document describes itself as guidance for Criminal Division prosecutors evaluating corporate compliance programs, and it operates under the Justice Manual's principles for the prosecution of business organizations rather than under an FCPA-specific instruction.

Is following the ECCP legally required?

The ECCP is a Criminal Division guidance document for prosecutors. It isn't a statute or a regulation, and it doesn't purport to create obligations on companies. What's on offer is better treatment if something goes wrong.