Bridging the Gap in Training and Communications: From DOJ Guidance to Implementation

The ECCP update has generated buzz, a critical question arises: what happens when organizations return to their existing compliance initiatives?

The Department of Justice served us a live surprise at the 2024 Society of Corporate Compliance and Ethics Institute this past Monday when Principal Deputy Assistant Attorney General Nicole Argentieri announced updates to the Evaluation of Corporate Compliance Programs (ECCP). This document, first published in March 2017, is designed to assist prosecutors in making informed decisions about the effectiveness of a compliance program at the time of misconduct, at the time of a charging decision or resolution, and for determining any resulting compliance obligations.

Between the March 2023 update and the September 2024 version, significant changes were made—72 items were replaced, 31 were added, and 4 were deleted. The most significant areas of change include risk assessment, speaking up, and compliance autonomy and resources.

While this update has generated buzz, a critical question arises: what happens when organizations return to their existing compliance initiatives? Aligning a program with the ECCP can be daunting. When we consider the technical and interpersonal challenges, it’s easy to be drawn to flashy solutions. Attractive marketing often makes us feel empowered and that we are making progress.

Whether you focus on a specific aspect of the ECCP or oversee the entire compliance program, it’s natural to feel overwhelmed. This is why we must work smarter—not harder—and not be easily distracted by additions not fit for purpose.

Some practitioners may undervalue the ECCP, but I see it as akin to receiving the questions for a final exam in advance—provided by the professor! Why aren’t we all excited about this?

What’s New in the Training and Communications Section

The updated guidance asks: Are the company’s training and communications tailored to the particular needs, interests, and values of relevant employees? One-on-one training can be costly and time consuming, but at Learning Pool, we utilize our adaptive authoring platform to tailor to each individual’s needs in a single course. We do this by asking self-identifier questions that guide employees to the course content that best suits their roles, then the adaptive framework remediates and accelerates that course based on real-time performance.

Another question to consider is: Has the training addressed lessons learned from compliance issues faced by other companies operating in the same industry and/or geographical region? To stay informed, set up news alerts for your competitors and industry developments, and monitor enforcement actions from key agencies. Delegate this task to someone on your team who understands compliance risks. (Remember, news outlets often write in layman’s terms, so headlines won’t be written with “compliance risks” in bright red letters.) Then, provide timely communications that are relevant to your staff. There’s no need to roll out a new course for everyone—sometimes, less is more.

What’s Changed in the Training and Communications Section

The updated guidance now asks: Has the company provided tailored training for high-risk and control employees, including training that addresses risks in the area(s) where misconduct occurred? This update is largely for clarification, but emphasizes that employees’ everyday actions may intersect with multiple risk areas. For example, a finance employee may pay invoices from sales intermediaries that include bribes to government officials and fraudulent charges for services not delivered.

Additionally, the question has evolved from Have employees been tested on what they have learned? to Has the company evaluated the employees’ engagement with the training session and whether they have learned the covered subject matter? This shift underscores that end-of-course quizzes aren’t sufficient for assessing compliance. Engagement with the material—particularly when it’s tailored and relevant—should take precedence. At Learning Pool, I’m proud to share that our employees achieve 100% topic mastery in simulation. We do this by delivering our adaptive compliance courses and serving employees the coaching and guidance they need to understand how to navigate compliance challenges in scenarios they’re likely to encounter in their jobs. By analyzing behavioral insights post-training deployments, we can identify gaps and strengths, adapt our compliance program strategy, and deliver additional guidance to the right people at the right moments.

Closing Thoughts

As compliance practitioners, it is essential to bridge the gap between acknowledging the updated DOJ guidance and actively implementing them in your programs. By focusing on tailored training, leveraging behavioral insights, and maintaining engagement, organizations can not only enhance their compliance programs but also foster a culture of accountability. The ECCP offers a roadmap for improvement—let’s ensure we don’t just admire the guidance but put it into action.