Elements of a Compliance Program

1. How to Tell
If You Have An
Effective Compliance Program
By Danforth Newcomb
Shearman & Sterling LLP
Goals
• Achieve Company Business Goals without Violations of Law
• Provide Benefits that Outweigh Costs
• Create a Culture that Values Compliance
Assumptions
• Limited Compliance Resources
• Challenging Compliance Environment
Elements
• Design
• Implementation
• Enforcement
Starting Points
• Comprehensive Risk Assessment
• Industry’s Compliance Problems
• Current Enforcement Trends
• Company’s Compliance History
– Prior Problems
– Complaints
– Subpoenas & Inquiries
• Sentencing Guidelines
Seven Steps
• Standards & Procedures
• Assign Compliance Responsibility
• Diligence in Delegation
• Communicate Effectively
• Monitor & Audit
• Disciplinary Mechanism
• Respond Appropriately

2. Standards
• Clear & Concise
• Law and Ethics
• Apparent Senior Buy-In
Procedures
• Not the Law First
• Front Line Business is Your Client
• Industry Standards
• Updated Frequently
• Compliance Involved in New Products
Assign Compliance Responsibility
• Direct & Regular Access to the Board
• Participates in Training Programs
• Credible with the Businesses
• Credible with Regulators
• Sufficient Resources
• Ranks with Auditor & Counsel
Diligence What
• Negative and Positive Diligence
• Periodic Updates
• Events
• Elapsed time
• Written Reports
• Independent Review and Approval
Diligence Who
• Employees
• New Hires
• Long Time People
• Agents, Sales Reps., Distributors
• Suppliers, Service Providers
• Partners, Joint Venture Parties

3. Communicate Effectively
• Use Several Media
• Written References & Manuals
• Videos
• Interactive, Role Playing, Board Games
• On Demand Communication
• Hot lines
• Help Desks
• On line
• Effective Training Personnel
• Recurrent Training
• When responsibility changes
• When Standards Change
• Periodic updates
• Document Participation in Training
Compliance Monitoring
• Documentation Complete
• Procedures Up to Date
• Training Received
• Testing
• Certification
Non Compliance Monitoring
• Look for Exceptions & Work Arounds
• Assume Intentional Non Compliance by a Few
• Centralize Complaints & Subpoenas
• Encourage & Protect Whistle Blowers
Auditing
• Different People
• Well Defined Work Program
• Existing Procedures
• Developed with Compliance Function
• Limit Auditor’s Interpretation of Standards
• Resolve Audit Findings

4. Disciplinary Mechanisms
• Design with Human Resources
• A Graduated Range
• Apply Consistently to All Levels
• Tabulate and Report to Board on Discipline
Respond Appropriately
• Have a Crisis Response Team & Plan
• Avoid Premature Assurances
• Investigate the Facts
• Use Disinterested Investigators
• Protect the Privilege
• Make Timely Disclosure
• Regulators
• Shareholders
• Customers
• Local community
• Employees
• Document Lessons Learned
• Make Appropriate Program Modifications
• No Program can Prevent or Detect All Offenses

5. A Self Audit Checklist
• Comprehensive Risk Assessment in the Last Two Years
• Clear & Concise Standards
• Senior Sponsorship of Standards
• Procedures in Business Terms
• Chief Compliance Officer within 3 levels of the Board of Directors
• Compliance Officer Known by Name to Top Regulators
• Employees (& Others) Vetted for Compliance Conduct in Writing
• Compliance Training Materials in Several Media
• Recurring Compliance Training
• Compliance Hot Line
• On Line Compliance Procedures
• Compliance Training Documented
• Compliance Understanding Tested
• Annual Compliance Monitoring
• Centralized Complaints & Subpoenas
• Whistle Blowers Call Frequently
• Audit Work Program Developed with Compliance Function
• Crisis Team Identified by Name
• Crisis Plan in Writing
• Documented Compliance Lessons Learned
• Compliance Program Modified from Lessons Learned
© Shearman & Sterling LLP 2009

6. A Self Audit Checklist
• Comprehensive Risk Assessment in the Last Two Years
• Clear & Concise Standards
• Senior Sponsorship of Standards
• Procedures in Business Terms
• Chief Compliance Officer within 3 levels of the Board of Directors
• Compliance Officer Known by Name to Top Regulators
• Employees (& Others) Vetted for Compliance Conduct in Writing
• Compliance Training Materials in Several Media
• Recurring Compliance Training
• Compliance Hot Line
• On Line Compliance Procedures
• Compliance Training Documented
• Compliance Understanding Tested
• Annual Compliance Monitoring
• Centralized Complaints & Subpoenas
• Whistle Blowers Call Frequently
• Audit Work Program Developed with Compliance Function
• Crisis Team Identified by Name
• Crisis Plan in Writing
• Documented Compliance Lessons Learned
• Compliance Program Modified from Lessons Learned
© Shearman & Sterling LLP 2009