2 0 2 4 E C C P U P D A T E
Key Highlights

In the following section, read about the key changes within the update, along with expert insights, data, and resources to enable you to position your program for success.

Key Highlights

Speak-Up Culture and Anti-Retaliation

New Technology and Artificial Intelligence

Staffing, Stature, and Resources

SPEAK-UP CULTURE AND ANTI-RETALIATION

The Guidance

In the September 2024 update, companies are expected to do the following to foster a speak-up culture:

Encourage and incentivize employees to speak up, and conversely, look to see if there is anything discouraging employees from speaking up
Measure employee willingness to report and train employees on internal and external reporting channels
Ensure an anti-retaliation policy is in place
Train employees on both internal and external anti-retaliation and whistleblower protection policies, procedures, and laws
Determine if employees who reported misconduct are treated differently than the employees who were involved in misconduct but did not report it

Insights

This focus on speak up is not new; the DOJ has been discussing building a strong speak-up culture to support voluntary disclosure for some time now.

The language used, though, especially around both internal AND external mechanisms to raise concerns, is amplified compared to prior iterations of the ECCP.

Some of the language around external reporting mirrors what we have seen in the human rights sector, with a focus on listing external channels in your discussion around raising concerns.

Given the breadth of the DOJ’s remit, however, this expansion is notable.

Peer Practices

74% of World’s Most Ethical Companies honorees measure their ethical culture through a standalone ethical culture or compliance program perception survey

For those using employee engagement surveys, that number jumps to 92%

82% World’s Most Ethical Companies honorees incentivize their employees to act ethically through formal recognitions and a communication of the recognition or award

51% of World’s Most Ethical Companies honorees follow up with reporters to see if they felt retaliation

93% of employees say they would report workplace misconduct if they witnessed it. But when the moment of truth arrives, only 50% actually report. The most common reasons cited are fear of retaliation and professional harm.

RISK ASSESSMENTS

The Guidance

In the 2024 guidance, risk assessment figures prominently:

Risk identification and assessment should account for emerging internal and external risks, and mitigating factors
If the company is using new and emerging technologies, they should conduct a risk assessment for its use and implement controls to mitigate the associated risks
Determine if the risk management process is reactive or proactive and how does it inform the compliance program
Allocate compliance resources based on risk, with greater scrutiny given to higher-risk areas
Periodically review the risk assessment using continuous access to operational data and information
Based on the review, make updates in policies, procedures, and controls

Insights

The 2024 ECCP asks if companies periodically review their risk assessment and whether they have a process for incorporating lessons learned from their own risk management issues or from those of other companies operating within the same industry and/or geographical region.

It is clear from the text of the document that a risk assessment must be an ongoing process and not a one-and-done; arguably even an annual process should be augmented by periodic check-ins as the business evolves and lessons are learned.

The increased emphasis on a dynamic risk assessment process that informs the continued improvement of the compliance program requires a close look at your existing processes to ensure best practices. Ignoring these updates could lead to increased regulatory risk, fines, or even reputational damage.

Peer Practices

90% of World’s Most Ethical Companies honorees have an organization-wide risk assessment focusing on ethics and compliance

51% of World’s Most Ethical Companies honorees assess their ethics and compliance risks annually

55% of World’s Most Ethical Companies honorees conduct due diligence before entering into any third-party relationship, regardless of risk level

NEW TECHNOLOGY & ARTIFICIAL INTELLIGENCE (AI)

The Guidance

The DOJ is interested in mitigating risks that arise from new technologies like artificial intelligence (AI). Guidance includes:

An assessment of the impact of new technology to comply with the law
Management of risks around emerging technologies are built into the broader enterprise risk management strategy
Negative/unintended consequences are curbed and deliberate misuse is mitigated
Monitor use of new technologies to ensure its compliance with laws and the company’s Code of Conduct
Controls are in place to ensure technology is used for its intended purposes
Assess the new technology with a determined human-baseline
Train employees on new technologies
Emphasis on reporting and communication lines as a general factor for whether a program is well designed and integrated into the company’s operations and workforce

Insights

This is one of the most detailed sections of the update with a total of 10 questions that ask companies how they identify and manage risks with potential compliance implications, especially around the use of AI within the business.

Like all of us, the DOJ is clearly grappling with how to navigate this new technology. The emphasis is on both the risks and opportunities AI presents and sets a clear expectation around the extent your organization is using AI in its products, and if those products cause harm, the compliance team’s involvement in vetting those products will be subject to scrutiny.

Peer Practices

35% of employees are intentionally using AI monthly or more often to assist with their work

Only 18% reported knowing that their employer has an official policy about acceptable uses of AI

50% of employees say their employers have no such policy on AI, and 32% said they were unsure

Source: American Psychological Association 2024 Work in America Survey

STAFFING, STATURE AND RESOURCES

The Guidance

The people responsible for compliance should have the sufficient qualifications, seniority, and stature (both actual and perceived)
Companies should measure the commercial value of their investments into compliance and risk management
Compliance personnel should have knowledge of and access to relevant data when they need it
Data analytics should be used to streamline processes and measure program effectiveness, manage data quality, and measure the accuracy, precision, and recall of data analytic models
How do the assets, resources, and technology available to the compliance and risk management functions compare to others in the company?
Is there a balance between the use of technology and resources for identifying and capturing market opportunities vs. detecting and mitigating risk?

Insights

It is a huge boost to the function, with expectations that E&C teams have ‘sufficient qualifications, seniority, and stature (both actual and perceived)’ within the organization and the data, resources and technology needed to mitigate risk.

The DOJ emphasized that any delta in technology investments for revenue generating activities compared to compliance/risk will be looked at carefully and with a jaded eye. If you’re fighting to get dashboards like sales has, this is a useful addition.

Additionally, in Section 2: “Does the company have a mechanism to measure the commercial value of investments in compliance and risk management?” This emphasizes how you’re managing risk within your organization matters. The Guidance now asks about the actual and perceived stature of the people running the program. This is significant.

Peer Practices

Of the World's Most Ethical Companies, the job title held by the person responsible for the E&C program:

Ethics and/or Compliance Officer: 43%
Chief Ethics and/or Compliance Officer: 34%

Backgrounds of individuals in E&C:

Attorney: 99%
Investigations: 95%
Auditor: 88%
Data Analytics: 76%

Annual Compliance Budgets

Click on the image to zoom in.

Source: The Sphere

CONTINUOUS IMPROVEMENT

The Guidance

Companies should be rewarded for updating and improving their programs based on their response to misconduct and how they addressed reports of misconduct over time
Policies should reflect lessons learned (either the company’s own, or those of similar companies) and address the use of emerging technologies
Training and communications should be tailored to the needs, interests, and values of employees and should address and incorporate lessons learned by the company or similar companies
Companies should have access to data and information to identify potential misconduct or deficiencies in the compliance program
Reviews of vendors should be timely and vendor risks should be evaluated over the course of the relationship

Insights

In addition to inquiring into how and how often a company is measuring its culture of compliance, the 2024 update added the same “how and how often” question to the measurement of compliance program effectiveness. You have to measure both culture and program effectiveness, show how frequently you do so, and the methods by which you measure.

This is a massive opportunity for ethics and compliance leaders to use these ECCP updates to say: “Yes, I understand we hope to never be in front of the government, but on the off chance we are, the government is very clear about what it's looking for, and here is our opportunity to position our program for success.”

It’s also important to note the emphasis on improvements based on lessons learned—both from internal or peer examples.

Peer Practices

42% of World’s Most Ethical Companies honorees review access metrics for their policies on a quarterly basis

55% of World’s Most Ethical Companies honorees conduct due diligence before entering into any third-party relationship, regardless of risk level