The Department of Justice (DOJ) has introduced a significant change in how it evaluates corporate compliance programs, focusing on compensation structures. This shift emphasizes the importance of tying executive pay to compliance outcomes.
In March 2023, Deputy Attorney General Lisa Monaco announced a three-year Pilot Program on Compensation Initiatives and Clawbacks. This program offers measurable fine reductions to companies that recover compensation from executives involved in misconduct. It's a practical enforcement tool that links your compliance program's credibility to your willingness to reclaim funds from those who break the rules.
What Changed
The DOJ has updated its evaluation criteria for corporate compliance programs with three major developments:
Compensation requirements are now mandatory. Companies entering into a corporate resolution with the Criminal Division must include compliance-promoting criteria in their compensation and bonus systems. These criteria should be tailored to your existing structure.
Clawback enforcement offers financial incentives. Companies that cooperate with DOJ investigations and pursue compensation recovery from individuals involved in misconduct can reduce their fines by the amount they're seeking to claw back. Even if you don't succeed in recovering funds, pursuing clawbacks in good faith can still lead to a fine reduction.
Consequence management is now data-driven. Prosecutors will track data on disciplinary actions across your organization and evaluate whether you've communicated transparently about those consequences. They're looking for patterns, not isolated incidents.
The DOJ has also added 25 new prosecutors to corporate criminal enforcement, indicating increased scrutiny alongside these new incentives.
Key Findings
Dynamic compliance programs are essential. The guidance asks whether your risk assessment is "current and subject to periodic review" or "limited to a snapshot in time." Prosecutors want to see continuous access to operational data across functions, not just annual reviews. Your program should incorporate lessons learned from your own issues and from other companies in your industry and region.
Voluntary self-disclosure policies are standardized. New policies clarify the requirements for companies to self-disclose misconduct and outline the benefits, including a presumption against a guilty plea if you've fully cooperated and taken appropriate action, and no requirement for a DOJ monitor if you've already implemented an effective compliance program.
Whistleblowing systems must extend beyond employees. The guidance strengthens expectations around Confidential Reporting mechanisms, asking whether you've made the system available to third parties and whether you've tested its effectiveness. Studies show that 59% of reporters choose to report anonymously when the option is available, and companies with specialized channels receive more reports overall.
Access and tracking matter more than policy volume. Prosecutors ask whether your policies are published in a searchable format, whether you've addressed linguistic barriers for foreign employees, and whether you track which policies attract attention from relevant employees. Accessibility is now a compliance metric.
Training must be interactive and behavior-focused. The guidance highlights "shorter, more targeted training sessions" and asks whether employees can ask questions during or after training, how you handle employees who fail portions of training, and whether training impacts actual behavior or operations.
What This Means for Your Team
If your compensation structure doesn't currently include compliance criteria, your program may be seen as incomplete by the DOJ. The pilot program makes it clear that financial consequences for misconduct are baseline expectations.
The clawback incentive presents a strategic question: can your organization pursue compensation recovery quickly and effectively enough to reduce your fine exposure? This requires legal infrastructure, board support, and employment agreements that anticipate clawback scenarios before misconduct occurs.
The emphasis on tracking and data shifts compliance from a qualitative exercise to a quantitative one. You need systems that capture who accessed which policies, who completed which training modules, what disciplinary actions were taken, and whether those actions were communicated transparently. Prosecutors will ask for this data.
Action Items by Priority
Immediate (next 30 days):
Audit your executive and management compensation structures. Identify where compliance criteria could be integrated into bonus calculations, equity awards, or incentive plans. If your agreements don't include clawback provisions, flag this for legal and board review.
Review your current disciplinary action tracking. Can you produce data showing patterns of enforcement across business units, roles, and violation types? If you're relying on spreadsheets or memory, you need a case management system.
Short-term (next 90 days):
Test your Confidential Reporting mechanism by tracking a hypothetical report from submission to resolution. Document every handoff, delay, and decision point. Identify where the process breaks down or becomes opaque.
Evaluate whether your risk assessment process is continuous or periodic. If you're conducting annual reviews, consider how you could integrate real-time data feeds from HR, finance, legal, and operations to identify emerging risks as they develop.
Assess policy accessibility. Run a simple test: can a non-English-speaking employee in a foreign subsidiary find and understand your anti-corruption policy in under two minutes? If not, you have a gap prosecutors will notice.
Long-term (next 12 months):
Design a lessons-learned process that captures insights from your own incidents, near-misses, and enforcement actions against peer companies. Build this into your periodic risk assessment so it informs updates to policies, procedures, and controls.
Develop a compensation clawback playbook that outlines triggers, approval processes, legal requirements, and communication protocols. This isn't just a contract clause; it's an operational capability you need to execute under pressure.
Expand your whistleblowing system to third parties if you haven't already. Publicize the mechanism beyond your employee handbook and test whether external stakeholders know it exists and trust it enough to use it.
