Subscriptions to CCQ are $50.00 for four issues. Back issues are available for $15.00 per issue. Please make checks payable to: Rutgers, the State University of New Jersey. Send your subscription information or back issue requests to:
By Joseph E. Murphy
"[Compliance] reviews will rarely, if ever, be curtailed simply because they may be subject to discovery." With this remarkable ipse dixit, the Ninth Circuit Court of Appeals brushed aside pleas from those conducting routine safety reviews, for some degree of protection from the maw of the U.S. litigation system. (Dowling v. American Hawaii Cruises, Inc., 971 F.2d 423, 426 (9th Cir. 1992). The Dowling court did not dispute the need for such protection for after-the-fact investigations, but its position on continuing compliance efforts mirrors the view of several courts that have resisted the self-evaluative privilege as an unwarranted threat to litigation processes.
Do courts really doubt that discovery hurts compliance efforts? Do they believe that there are now enough companies with full-fledged compliance programs, including rigorous compliance audits? Or do they perhaps believe that the repeated statements by corporate counsel and others who conduct compliance efforts that they are seriously limited in their work by the excesses of discovery should just be ignored; after all, if these compliance spokespersons were right, the litigation system would have caused them to completely stop compliance work and therefore they would not be in court, complaining about the excesses of discovery (See J. Heller, Catch-22 (1961)).
Litigation risk is certainly one reason why compliance audits and other high-risk compliance efforts are not more common today. But less visible to the courts is the day-to-day injury to compliance programs that result from the courts' failure to understand the dynamics of corporate control. Perhaps a few concrete examples will shed more light on this. Here is just one perspective on this impact - a picture of what some compliance work looks like in a "chilled" envi- ronment threatened by litigation, and a comparison with what could be done in a freer environment under a strong compliance protection (see 1 CCQ 8 (Winter 1991)). This latter phase would be an "interactive" system.
Chilled - Compliance audits are conducted by lawyers only upon formal written request of a senior manager, in order to assert attorney-client privilege. There will only be as many reviews as there are opportunities to explain the background at senior management level.
Interactive - Every manager has the responsibility for checking compliance. Internal auditing, security, and/or legal are called upon to investigate immediately based on the request of the manager closest to the facts. Routine reviews are conducted even in the absence of requests for investigation. Such reviews may occur at any level of the business.
Chilled - Only lawyers are permitted to do compliance audits and reviews. internal auditors are trained to leave the "legal matters" to the lawyers and refer such sensitive matters to legal (orally, "no memos, please"). The few auditors permitted to do this work must work only for lawyers and be drilled on the intricacies of the Upjohn case. They are instructed to take only minimal notes, shred workpapers, and to report orally to counsel.
Interactive - Serious effort is devoted to instructing managers, including auditing and security, on looking for key indicators of prohibited conduct. Auditors are trained to consult with counsel for advice, but to be aggressive on reviews. Written, pointed, detailed reports are the expected product.
Chilled - An outside litigation lawyer is assigned, between cases, to review files randomly drawn from a business unit. The outside lawyer finds no indications of wrongdoing.
Interactive - An inhouse compliance lawyer, familiar with the business and its compliance policies, works in tandem with internal auditing and pricing experts, to review bidding patterns in the most profitable sales offices, on a routine basis. This lawyer discovers and reports on violations of the company's policy limiting discussions with competitors.
Chilled - During interviews in audits, interviewees are instructed to take no notes, because these may be discoverable.
Interactive - Interviewees are advised to take notes of follow-up issues, questions to check, and points to remember.
Chilled - Auditors are sternly warned: Never transcribe interviewee comments or have the person read or sign the notes, because this weakens privilege claims.
Interactive - Auditors transcribe interview notes and have the interviewee review and sign. This increases the accuracy and credibility of the information for investigatory and disciplinary purposes.
Chilled - Following Upjohn, instruct employees to communicate only on things "within the scope of their duties," and spend a considerable amount of time explaining this arcane legal concept.
Interactive - Ask open-ended interview questions and elicit any information, including grapevine sources, that may be useful for compliance purposes.
Chilled - Do not issue a report on a compliance audit until all questions are resolved. There should be no opinions or details about questionable conduct. Six months after the review, the only report issued states: "All units are generally in compliance."
Interactive - The report details what was wrong and why. It explains why this was or could lead to a violation. The report recommends specific disciplinary and remedial action, and names names. It states: "This matter must be addressed without delay. The possibility of similar violations must also be acted upon immediately."
Chilled - An environmental report says: "The audit reviewed a number of storage tanks and found them generally in compliance with the law and the staff committed to compliance with the law. Certain enhancements are now being implemented."
Interactive - "We reviewed 13 tanks in the Los Angeles area. Six had not been checked in 2 years, although company rules require annual inspections. Three had weakened structures and were near collapse. The staff was unaware of company inspection and reporting requirements. We recommend immediate repair, and discipline of the area manager including removal from his current assignment. Similar reviews must be undertaken throughout California to assure compliance. Failure to institute action on this recommendation within 10 days will require us to take this issue directly to the Compliance Officer and the Audit Committee. "
Chilled - Another report reads: "We have discussed control mechanisms with management and recommended steps to enhance this system."
Interactive - "We have expressed serious concerns about weaknesses in the compliance program, such as the limited number of auditors assigned and the absence of an effective followup system to monitor results. We have requested detailed responses on the status of compliance audits and hotline investigations. Replies are due in 10 business days, with a copy to the compliance officer."
Chilled - Compliance audit reports are to have no underlining, no red ink, and no exclamation marks. Avoid judgments or conclusions. Write as if it would be read by a hostile jury.
Interactive - Write to get immediate attention and action. Point out the risks of noncompliance.
Chilled - There will be one readout of the audit results to one or two senior managers. To protect privilege this should be legal advice only, and not management recommendations. The discussion must be strictly confidential, with no junior members present, and no notetaking by the client.
Interactive - The readout is designed for the maximum impact, to reach the largest number of employees responsible for the operation under review. The report will focus on how to enhance the compliance program, and will be treated as important business information. Notetaking is encouraged.
Chilled - There will be only one original of the audit report in the lawyer's locked cabinet, with no copies and no notes by anyone else.
Interactive - The audit report will be used as a learning tool for all managers, and given appropriate circulation to those who could benefit from it.
Chilled - Because of the need for a tight Upjohn circle, a problem detected in one business unit is not communicated across the company as a whole. As a result, preventable violations subsequently occur in three other business units.
Interactive - Regularly circulated reports alert managers in other business units to newly-identified risks of violations, prompting early detection and resolution.
Chilled - In giving a quiz in compliance training, collect and shred all copies of the quiz after the seminar so that no wrong answers show up in an employee's files in discovery.
Interactive - Leave corrected copies of the quiz with employees as a reminder and for use to cover new employees.
Chilled - Avoid using lists of "do's and don'ts" because they may be used against you before a jury.
Interactive - Use pointed, memorable do's and don'ts and leave copies with employees as an easy reminder. Do not rely on technically correct but boring treatises on the law.
Chilled - An EEO compliance seminar is an antiseptic recitation of the law. There is no drama and no notes.
Interactive - The EEO training is designed to surface and address stereotypes. The program uses roleplaying to alter biases and to leave a memorable impression. Discussion and notetaking are encouraged.
Chilled - In an antitrust compliance seminar, slides repeat the exact language of the Sherman Act and quote 50-year old antitrust cases, in order to avoid the risk of misstatements that could be used against the company in litigation.
Interactive - The seminar slides show documents from the employees' own files, so they see their own errors and learn from them. The trainer knows that people learn better from personal experience and real world cases.
Chilled - The company elects to use mass lectures on legal compliance, to avoid the risks of small group interactions and notetaking. This also increases the number of employees "covered" in one quick shot. There are no tests conducted to determine effectiveness, because these might document weaknesses that could be used against the company. Compliance audits are done by the book, by lawyers under tight control.
Interactive - Management wants to know what is going on. Audits are a first priority, with training geared to correct audit findings. Training is always in small groups to generate discussions and to surface problems. Ongoing audits include tests of the effectiveness of the training. No mass lectures are ever used, because they do not have enough impact.
Chilled - Employee evaluation forms have no place for discussion of the employee's commitment to compliance, or only permit bland comments such as "meets requirements."
Interactive - No manager can advance without strong performance in integrity and compliance. All assessments in this category must give specific examples, and spell out a plan for improvement for unsatisfactory performance.
Chilled - Supervisors concerned about their employees' commitment to compliance or integrity are instructed to call the legal department only. There is to be no independent checking by managers to be sure people know what is right and are doing the right thing. The manager arranges for one lawyer to visit the facility for one afternoon in a two year period.
Interactive - The supervisor routinely reviews files with employees and tests their understanding of the rules. He checks pricing activities, meetings with competitors, and accuracy of records on government contracts. He consults counsel regularly by phone. Counsel's visits are targeted on the areas identified by the manager as the highest risk.
Chilled - Managers are warned repeatedly about violating the company rules against circulating or discussing compliance audit review reports. Managers are harangued for subjecting the company to undue risk for alarmist documents which suggest there may be risk of legal violations or unsafe conditions.
Interactive - Managers are warned about the risk of not taking initiative and responsibility for assuring compliance with law and safe working conditions. Managers are rewarded for alerting others to potential violations. Managers hear sobering stories about companies that tried to cover up violations and that therefore lost the benefits of the self-evaluative privilege and were subjected to years of costly litigation.
Chilled - An energetic company lawyer tries to sell her client on an interactive compliance program, with hotlines, audits, investigations, and interactive training. She must first itemize the long list of risks associated with compliance program documentation in litigation and the substantial costs of using lawyers for every step. She must explain the details of following the Upjohn procedures (although this does not protect the company in 20% of the states), and the fact that the program must be conducted only for the purpose of providing legal advice and must be under a lawyer's direct control. She explains that there must be strong limits on the role of other managers in the compliance work, such as auditing and security. Local managers must be accountable for compliance, but they must not initiate anything because any paper generated might be used against them in litigation.
Interactive - The compliance lawyer introduces her recommendation as a step that is just good management. It will minimize the legal risks and help the business; the only real risk is in not having a program. She recruits an active role for auditing, security and all managers, with the advice of counsel. The compliance program, she explains, is a natural extension of the quality management program, using the best management techniques.
Chilled - A reluctant management accepts the need for a compliance program. Counsel's advice is to do only those things that have been done before and accepted by the courts. If some court accepted it, then we will do that and nothing else. The test is, "will it look good to a judge or jury?"
Interactive - Management wants to manage the compliance program effectively, with counsel's advice. The marching orders are, "do what works." Try new methods and test their impact through compliance audits. if a method reaches more employees and they remember it longer, then use that method. Try interactive videos, ethics games, scared straight presentations, innovative auditing techniques. The test is, "will it keep employees on the straight and narrow?"
Is the "chilled" environment the work of unscrupulous or irresponsible lawyers and managers, who should be coerced into more upright conduct by angry courts? Not in the least. In the current legal environment, the chilled scenario represents the work of lawyers and managers acting in good faith, but with a wary eye on the litigation monster. As a practical matter, company counsel will often not take the complete "chilled" or litigation-sensitive path because of the need to drive the compliance lesson home, but they will still not be able to bring to bear all of the compliance tools that they know would have great impact on their clients, because of this conflict.
In the litigation environment, company compliance lawyers intend to do right, and do devote substantial time and effort to educating their clients and preventing violations, but it would be irresponsible and unprofessional for a lawyer to fail to advise a client how to minimize litigation risks. As the Supreme court reminded us in Hickman v. Taylor, one party does not have the right to rely on the legal handiwork of the other party's lawyer. So a compliance lawyer, in this environment, has a professional obligation to advise the client of the risks and to take steps to minimize those risks. To maximize protection, lawyers must be in charge. They must edit, if not rewrite, every key document as if it were a trial exhibit. Of course this will slow down the program. But without protection, there is no choice.
In an interactive system, by contrast, compliance is the manager's responsibility, with lawyers acting as catalysts and advisors. Other compliance constituencies auditors, safety engineers, security, hotline offices - are empowered to execute this policy. Indeed, it is as much a part of managers' jobs as production and sales.
Returning to the original question, does the risk of discovery, criminal prosecution, and treble and punitive damages, "chill" compliance activities? Only a person who has not played a role in implementing such a program could seriously ask this question.
Mr. Murpby is a Senior Attorney at Bell Atlantic. The author gratefully acknowledges review and comments by Ann Bushmiller and David Buentes of Sidley & Austin (who contributed the "Upjohn circle" example), Professor Richard Gruner of Whittier College School of Law, and Christine Wardell, Senior Counsel, Pacific Telesis Group.
©Copyright 1996 Corporate Conduct Quarterly,, Rutgers, the State University of New Jersey. All rights reserved.