美国司法部发布新版企业合规指南——《企业合规程序评估》

作者：刘相文 王德昌 Graham·Adria 王晶涛

新版指南加入更多关于如何满足美国司法部对企业合规的要求，但并未对政府评估企业合规程序的政策进行重大修改。更值得注意的是，新版指南是由美国司法部刑事局发布的，因此仅对该局有约束力，对其他负责起诉公司犯罪的部门并无约束力。尽管如此，新版指南依然对在美营商的中国企业建立全面合规体系或评估现有合规体系的有效性有重大意义，也可以以此为标准确保其合规体系符合全球优秀合规实践。

Beyond providing greater insight into the DOJ’s expectations, the 2019 Corporate Compliance Guidance does not signal any major policy changes regarding the evaluation of compliance programs. It also worth highlighting that this was published by the Criminal Division of the DOJ and is therefore only binding within its division.[3] It is not binding on the U.S. Attorney’s offices who can also prosecute corporate crimes. Regardless, 2019 Corporate Compliance Guidance is a useful tool for anyone involved in reviewing or building compliance programs for Chinese companies operating under U.S. jurisdiction or looking for best practices that can be used elsewhere.  

新版指南旨在帮助检察官在办案中更好地判断“在犯罪发生时，企业的合规管理是否有效”，继而决定相关问题，比如：

The 2019 Corporate Compliance Guidance was written to assist American prosecutors “in making informed decisions as to whether… the corporation’s compliance program was effective at the time of [a criminal] offense.” The effectiveness of a compliance program is necessary for determining the:

然而，新版指南并不是审查企业合规程序时的清单或公式，因为司法部要求联邦检察官针对特定企业的风险特点和防控方式做出个案分析。新版指南回答了检察官在评估企业合规有效性时会遇到的3个基本问题：

The Corporate Compliance Guidance, however, is neither a checklist nor a formula for evaluating a corporate compliance system because the DOJ requires federal prosecutors to make individualized assessments that takes into a specific corporation’s risk profile and solutions to mitigate risks. Rather, the Corporate Compliance Guidance answers three “fundamental questions” that a federal prosecutor will ask when evaluating a corporate compliance program:

这三项大问题涵盖了司法部在分析企业合规程序时所遇到的不同问题。

This question framework categorizes the various topics that the DOJ has found relevant when analyzing corporate compliance programs.

联邦检察官在办案中提出的第一个基本问题是企业的合规程序是否完备。完备的合规程序的标志有：风险评估机制，有效的政策和程序，良好的培训和沟通机制，匿名报告机制和调查程序，第三方交易伙伴管理和并购合规管控。检察官审查以下方面：

The first fundamental question to be asked by federal prosecutors is whether the company’s compliance program is well designed. The “hallmarks” of a well-design compliance program involve risk assessment, policies and procedures, training and communications, confidential reporting structure and investigation process, third-party management, and mergers and acquisitions. To determine if a corporation’s compliance program is well designed, prosecutors will look at the following:

检察官在确定一个企业是否有完备的合规程序时重点关注的是“一个企业是否有设计良好的合规程序来从商业角度理解企业的经营，企业如何发现、评估、定义其风险范围,以及企业是否就其风险充分审查并投入资源。”检察官“应当考虑公司是否分析并处理了因经营地点、经营范围、竞争能力、监管主体、潜在客户和合作伙伴、第三方伙伴、礼物、差旅、娱乐开销、慈善捐赠和政治献金所带来的风险。”

A critical aspect for a prosecutor determining whether a compliance is well designed is “whether a company has a well-designed compliance program is to understand the company’s business from a commercial perspective, how the company has identified, assessed, and defined its risk profile, and the degree to which the program devotes appropriate scrutiny and resources to the spectrum of risks.” Prosecutors “should consider whether the company has analyzed and addressed… risks presented by… the location of its operations, the industry sector, the competitiveness, the regulatory landscape, potential clients and business partners, transactions with foreign governments, payments to foreign officials, use of third parties, gifts, travel, and entertainment expenses, and charitable and political donations.”

值得注意的是，检察官可能会对有效的“以风险为导向的，就高风险交易投入了适当注意和资源的合规程序”予以“肯定”，“即使该项目未能涵盖一些低风险领域的违规行为。”在评估中，检察官应考量企业的风控流程，风险导向的资源分配，以及合规程序的更新和修改。

Notably, prosecutors may “credit” an effective “risk-based compliance program that devotes appropriate attention and resources to high-risk transactions, even if it fails to prevent an infraction in a low-risk area.” To determine this, prosecutors should consider the risk management process, risk-tailored resource allocation; and any updates and revisions.

新版指南强调了司法部的意见，即一个“设计良好的合规程序应具备……用以降低公司在风险识别过程中所发现风险的政策和流程。”检察官在评估一个公司的政策和流程时应考虑以下5点：设计良好、内容全面、易于理解、融入运营、责任把关。

The 2019 Corporate Compliance Guidance reiterates the DOJ’s position that a “well-designed compliance program entails policies and procedures that…aim to reduce risks identified by the company as part of its risk assessment process.” There are five areas that prosecutors should consider when assessing a corporation’s policies and procedures: design, comprehensiveness, accessibility, responsibility for operational integration, and gatekeepers.

新版指南认为“一个设计良好的合规程序的另一个特点是适宜于公司培训和沟通机制。”在评估中，检察官应当“审查合规程序是否在工作中向员工广泛传播且能够为员工理解。”四个重要的评估内容为：风险导线的培训，培训的形式、内容和有效性，对于不当行为的沟通和获取相关指导的难易程度。

The 2019 Corporate Compliance Guidance observes that “another hallmark of a well-designed compliance program is appropriately tailored training and communications.”  To determine this, Prosecutors should “examine whether the compliance program is being disseminated to, and understood by, employees in practice.” The four key areas for training and communications are: risk-based training; form/content/effectiveness of training; communications about misconduct; and availability of guidance.

新版指南指出“一个设计良好的合规程序的另一个特点是建立有效的、值得信赖的机制来保证员工可以匿名或秘密报告任何其发现的不当行为或违规行为。”重要的是，新版指南强调了“秘密报告机制在证明‘公司是否建立了可以有效检测和预防违规的公司治理机制’时有很强的说明力。”检察官会着重审查4个方面：举报机制的有效性、划定合理调查范围并由具备相关资质人员调查、调查的反馈、调查结果的消息源和追踪渠道。

The 2019 Corporate Compliance Guidance identifies that “[a]nother hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations” of misconduct or breaches of the company’s policies. Importantly, the 2019 Corporate Compliance Guidance highlights that “[c]onfidential reporting mechanisms are highly probative of whether a company has ‘established corporate governance mechanisms that can effectively detect and prevent misconduct.’” The four key areas that prosecutors will look at to determine whether there is an effective reporting structure and investigation process are: effectiveness of the reporting mechanism; properly scoped investigations by qualified personnel; investigation response; and resources and tracking of results.

新版指南建议公司在着手建立“有效合规程序时应对第三方合作伙伴进行以风险为基准的尽调。”联邦检察官应当评估“该公司对于其第三方合作伙伴，包括经纪人，顾问和经销商的资质和关系的了解程度，”以及“公司是否知道其第三方合作伙伴的声誉和各项关系。”此项调查中，检察官主要关注4个方向：基于风险的全面尽调流程、适当的管控措施、对于关系的管理、具体的措施和结果。

The 2019 Corporate Compliance Guidance suggests that companies looking to implement “well-designed compliance program should apply risk-based due diligence to its third-party relationships.” Federal prosecutors should assess “the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors” and “whether the company knows its third-party partners’ reputations and relationships.” When assessing third party management, prosecutors will look for the following four things: risk-based and integrated processes; appropriate controls; management of relationships; and real actions and consequences.

新版指南建议“一项完善的合规程序应当对于其收购对象进行完善的尽调。”指导意见指出“错误的或不完善的尽调会使得目标公司现有的不当行为继续存在。”这会对企业的商业利益和声誉带来影响，也会使其面临民事或刑事责任的风险。在分析并购收购的合规程序时，检察官应当研究尽调的程序，并购收购过程的完整性，以及将尽调结果付诸实践的程序。

The 2019 Corporate Compliance Guidance advises that “a well-designed compliance program should include comprehensive due diligence of acquisition targets.” It observes that “[f]lawed or incomplete due diligence can allow misconduct to continue at the target company” which can result in harm to a business profit and reputation and put them at risk of civil and criminal liability. For evaluating M&A compliance procedures, prosecutors should examine the due diligence process; integration in the M&A process; and process connecting due diligence to implementation.

新版指南中的第二个基本问题是该合规程序中是否被认真地执行了。检察官的职责是检查合规程序是仅停留在纸面上还是得到了有效执行。此外，检查官也应当考量一家公司是否有合规培训和合规文化让员工“充分利用企业在合规方面努力的成果。”新版指南指出，“即使是设计精良的合规程序，如果在执行中不够严格或有效也是失败的。”在评估企业的合规程序是否得到有效执行时，检察官关注以下几点：

The second fundamental question included in the 2019 Corporate Compliance Guidance is whether the compliance program is being implemented effectively. Prosecutors are tasked with determining whether a compliance program is a “paper program” or one that has been effectively implemented. In addition to the question mentioned before, prosecutors should also consider that if the corporation has the training and culture of compliance that would enable staff to “utilize the results of the corporation’s compliance efforts.” The 2019 Corporate Compliance Guidance notes that “even a well-designed compliance program may be unsuccessful in practice if implementation is lax or ineffective.” To determine if a corporation’s compliance program is being implemented effectively, prosecutors look at the following:

有效执行一项合规程序的重要方面是创造培养一种明德守法的企业文化。这种企业文化应当高层领导的承诺并自上而下地推行。新版指南表明，检察官应当“评估企业高级管理层明确表述公司的道德标准、清晰无误地广为传达，并且以身作则严格合规的程度。”指南也提出了企业中层在合规方面的角色，指出检察官应当“评估中层在强调合规标准和鼓励员工遵守方面表现如何。”在分析高层和中层的重视程度时，检察官应当着重检查中高层本身的行为，对于合规共同的承诺和如何监督。

A critical aspect of implementing effective compliance program is creating and fostering “a culture of ethics and compliance with the law” that comes from a “high-level commitment by company leadership to implement a culture of compliance from the top.” The 2019 Corporate Compliance Guidance states that prosecutors should “examine the extent to which senior management have clearly articulated the company’s ethical standards, conveyed and disseminated them in clear and unambiguous terms, and demonstrated rigorous adherence by example.”  It also highlights the role of middle management in compliance, stating that prosecutors should “examine how middle management have reinforced those standards and encouraged employees to abide by them.” In analyzing the commitment of senior and middle management, prosecutors will look at: conduct at the top; shared commitment; and oversight.

有效执行企业合规制度的另一个方面是“确保日常监督合规程序执行的管理人员有足够的权力和地位。”检察官会检查企业合规人员“（1）在企业内是否有足够高的级别；（2）是否有足够的资源，如是否有足够的人手执行必要的审计、文件审查和分析；（3）管理层是否赋予足够的自主权，例如可以直接与董事会和董事会审计委员会汇报的渠道。”在调查中，检察官会评估“是否有足以确保其独立性和准确性的层级来负责内审，”这也是合规人员是否足够有权的一个标志。

Another aspect of effective implementation is ensuring “those charged with a compliance program’s day-to-day oversight to act with adequate authority and stature.” Prosecutors will look at whether those responsible for corporate compliance have:  “(1) sufficient seniority within the organization; (2) sufficient resources, namely, staff to effectively undertake the requisite auditing, documentation, and analysis; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” To ensure that this is the case, prosecutors will evaluate whether “internal audit functions [are] conducted at a level sufficient to ensure their independence and accuracy,” as this is an indictor of whether compliance personnel are actually empowered.

合规程序是否得到有效执行的最后一个标志是对合规行为的激励和对违规行为的惩戒。重要的是，惩戒程序应该在公司内部得到公正地执行，“无论违规者的职务高低。”在审查一个合规程序的激励和惩戒机制时，检察官应当检查人力资源管理的程序，制度执行是否公平，以及是否有奖励机制。

The final hallmark of a well-implemented compliance program is the “establishment of incentives for compliance and disincentives for non-compliance.” Importantly, disciplinary procedures should be applied consistently across the company and “regardless of the position or title of the employee who engages in [unethical] conduct.” When looking at a compliance program’s incentives and disciplinary measures, prosecutors should examine: the human resources process; whether there is consistent application of rules; and is there an incentive system.

新版指南中第三个也是最后一个基本问题是合规程序在日常工作中是否真的有效。联邦商业机构刑事诉讼原则要求检察官在两个时间节点上考虑这一问题：一是违规发生时，二是提起指控或处理方案时。值得注意的是，“存在违规行为本身并不意味着合规程序在当时没有起作用或者无效，”并且“司法部也认可，没有任何合规程序可以完全避免职员犯罪。”

The third and final fundamental question asked in the 2019 Corporate Compliance Guidance is whether the compliance program actually works “in practice.” The Principles of Federal Prosecution of Business Organizations require that prosecutors determine this at the time of the misconduct that led an investigation and again at the time of a charging decision or resolution. It’s important to note “the existence of misconduct does not, by itself, mean that a compliance program did not work or was ineffective at the time of the offense” and that the “[t]he [DOJ] recognizes that no compliance program can ever prevent all criminal activity by a corporation's employees.”

在评估违规行为发生时合规程序是否有效这一问题上，检察官会考虑“违规如何被发现；公司动用了何种资源进行调查；以及公司的调查是否彻底。”在起诉或处理方案决定作出的时候，检察官会审查“该合规程序是否会根据现存的或变化的合规风险进行相应的升级”以及公司是否会充分、诚实地分析“违规行为发生的原因以及需要什么程度的补救措施来预防未来类似事件的发生。”在做出评估时，检察官会观察以下几方面：

In determining whether a compliance program was effective at the time of the misconduct, prosecutors will consider “whether and how the misconduct was detected, what investigation resources were in place to investigate suspected misconduct, and the nature and thoroughness” of the company’s response. At the time of a charging decision or resolution, prosecutors will look at whether the “program evolved over time to address existing and changing compliance risks” and whether the company adequately and honestly analyzed “what contributed to the misconduct and the degree of remediation needed to prevent similar events in the future.” In making these assessments, prosecutors look at the following:

在评估合规程序是否有效时，新版指南要求检察官“考虑公司是否对其合规程序做出有意义的审查以保证合规程序不过时。”指导意见建议公司主动出击，例如对员工进行访谈以评价企业合规文化并评估监控的强度，和/或进行阶段性的审计以确保管控的有效性。这些措施在应对调查时非常重要，检察官可能认定其为补救措施或者降低罚款数额。在评估持续改进、阶段性内测和审查的过程中，检察官会评估内部审计、管控测试、合规程序是否更新以及企业是否建立了合规文化。

In determining whether compliance programs work in practice, the 2019 Corporate Compliance Guidance asks that prosecutors to “consider whether the company has engaged in meaningful efforts to review its compliance program and ensure that it is not stale.” It suggests that companies undertake proactive activities such as “survey employees to gauge the compliance culture and evaluate the strength of controls, and/or conduct periodic audits to ensure that controls are functioning well.” These proactive activities are important as prosecutors may reward them with remediation credit or a lower fine range. In analyzing continuous improvement, periodic testing, and review, prosecutors will look at the following: internal audits; control testing; whether there are evolving updates; and is there a culture of compliance.

有效的合规程序的另一个特点是“有一套运行良好且资金充足的机制来针对公司、公司雇员或代理人的任何指控或可疑行为进行及时、彻底的调查。”公司也应当“有存档机制来记录公司的应对，包括采取的任何惩罚或补救措施。”检察官会检查公司是否指派合格的人员来进行范围适当的调查以及对调查作出何种反馈。

A hallmark of whether a compliance program works in practice is “the existence of a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents.” There should also be an “established means of documenting the company’s response, including any disciplinary or remediation measures taken.” Prosecutors will be look at the following: whether there was a properly scoped investigation by qualified personnel; and what was the response to investigations.

新版调查意见最后总结：有效的合规程序的还有一个特点，即公司有能力“对违规行为产生的根源进行彻底的分析”并且有能力“对其根源开展及时、适当的补救措施。”检察官通常会审查公司对于违规原因的分析；之前的缺点是什么；公司使用什么支付系统；不当行为是否有征兆；是否采取措施进行补救以及如何问责。

The 2019 Corporate Compliance Guidance concludes by observing that a hallmark of a compliance program that is working effectively in practice is the ability of a company “to conduct a thoughtful root cause analysis of misconduct” and be able to “timely and appropriately remediate to address the root causes.” In examining a company’s analysis and remediation actions, prosecutors will look at the company’s root cause analysis; what were the prior weaknesses; what payment systems were used; were there prior indications of misconduct; have there been any remediation steps; and what kind of accountability has there been.

助理司法部长Benczkowski在其声明中表示：“一家企业的合规程序是预防过错发生的第一道防线。如果每一步都执行的完美，可以帮助企业免遭执法部门的关注。”

As Assistant Attorney General Benczkowski remarked in his release announcement, “a company’s compliance program is the first line of defense that prevents the misconduct from happening in the first place. And if done right, it has the ability to keep the company off our radar screen entirely.” [4]

如果一家中国企业希望可以做到这些，新版指南对其审核自身合规程序将是极其有用的。指南就美国司法部的审查重点为企业提供了详尽的指导，为企业建立或优化其合规程序提供了详实的路线图。与此同时，指南通俗易懂，即便不是合规方面的专家，也能迅速掌握要领。

For Chinese companies wishing to do just that, the Corporate Compliance Guidance is a valuable tool for conducting a review of their compliance program. It provides a more detailed and specific look on what is expected by the DOJs. It’s a solid roadmap for companies looking to implement or improve their compliance programs. At the same time, it is a very accessible document so even non-compliance specialists can grasp what is expected of them.

有鉴于此，中国企业在美国营商时，应当考虑全面审查自身合规体系。对于尚未建立合规体系的企业，新指南的发布为企业着手建设合规体系提供了良好契机。

With this in mind, Chinese companies operating under the jurisdiction of the United States should considering undertaking a thorough review of their compliance program. For companies that have yet to implement a comprehensive compliance program, this new Corporate Compliance Guidance is a perfect time to take that step.

【注] 

[1]https://www.justice.gov/criminal-fraud/page/file/937501/download

[2]Assistant Attorney General Brian A. Benczkowski Delivers Keynote Address at the Ethics and Compliance Initiative (ECI) 2019 Annual Impact Conference (April 30, 2019) https://www.justice.gov/opa/speech/assistant-attorney-general-brian-benczkowski-delivers-keynote-address-ethics-and

[3] This includes the Fraud Section, the Money Laundering and Asset Recovery Section, the Public Integrity Section and the Computer Crime and Intellectual Property Section

[4] Assistant Attorney General Brian A. Benczkowski Delivers Keynote Address at the Ethics and Compliance Initiative (ECI) 2019 Annual Impact Conference (April 30, 2019) https://www.justice.gov/opa/speech/assistant-attorney-general-brian-benczkowski-delivers-keynote-address-ethics-and

《美国法院判令：中资银行不得援引国内法拒绝提供交易信息》

《美国长臂管辖规则及其适用之解读》

《方圆之道 | 如何全面构建符合中央企业特色的合规体系？》