Toolkit · Corporate

The Corporate Compliance Toolkit

15 U.S.C. §§ 78

Type
Toolkit
Jurisdiction
National
Date
2026-09-15
Topic
Corporate

This toolkit is the front door to corporate compliance on UpLaw. It explains why a compliance program is a legal defense rather than a cost center — the culpability-score credit under Chapter 8 of the U.S. Sentencing Guidelines, the charging discount under the DOJ's Evaluation of Corporate Compliance Programs, and the personal exposure of directors under Caremark and Marchand — and then maps the program pillar by pillar. It walks risk assessment, the substantive risk domains (anti-corruption, antitrust, securities and insider trading, trade and sanctions, healthcare fraud and abuse, privacy and AI, employment, environmental and product safety, and consumer protection), and then the machinery that makes a program real: policies, training, third-party diligence, hotlines and internal investigations, monitoring and testing, discipline and incentives, the self-disclosure decision, and board reporting. Each pillar gives you plain-English doctrine, the anchor authority, the traps, and a link into UpLaw's deeper guides and checklists. A running example follows Kestrel Dynamics, a fictional multinational building a program from scratch after a near-miss. Use it as a research map: skim the landscape, jump to the pillar you need, and follow the links down into the detail.

The Corporate Compliance Toolkit

Corporate > Compliance | Published 15 September 2026 - Updated 13 October 2026 | UpLaw - uplaw.us

A compliance program is not overhead. It is the single asset that decides whether a bad act by one employee becomes a footnote or an indictment — and whether the directors who never saw it coming pay for it personally. This toolkit is the map.

Keywords: corporate compliance program, DOJ ECCP, Organizational Sentencing Guidelines, Caremark, Marchand, FCPA, antitrust compliance, insider trading, export controls, OFAC, False Claims Act, internal investigations, self-disclosure, clawbacks, board oversight

How to read this toolkit

Corporate compliance is not one subject. It is a chassis — risk assessment, policies, training, diligence, reporting channels, investigations, testing, discipline, and board oversight — bolted onto a dozen substantive legal regimes that each have their own statute, their own regulator, and their own way of hurting you. The chassis is what the Department of Justice and the Sentencing Commission actually grade. The substantive regimes are what you are being graded on.

This toolkit walks both. It is a research map, not a treatise. Each pillar gives you the plain-English doctrine, the anchor authority, the classic failure mode, and a link into UpLaw's deeper guide, checklist, or toolkit where the real detail lives. Read it end to end once to build the mental model. Then jump to the pillar you need. The consolidated gated checklist near the end works as a standalone program audit.

A running example keeps it concrete. Meet Kestrel Dynamics, Inc., a fictional industrial-sensor manufacturer: 4,000 employees, U.S.-listed, plants in Ohio and Malaysia, distributors in Brazil and the Gulf, a hardware product sold into hospitals and utilities, and a new machine-learning product line. Kestrel has just survived a near-miss — a regional sales director in São Paulo was caught routing "consulting fees" to a customs broker, and the audit committee discovered it from a local newspaper rather than from its own controls. The board has asked one question: what would have caught this, and what do we build now? Everything below is Kestrel's answer.

Why compliance is a legal defense, not a cost center

Start with the doctrine that makes the whole enterprise rational, because it is the part most executives get backwards.

Under respondeat superior, a corporation is criminally liable for crimes its employees commit within the scope of their employment and at least in part to benefit the corporation. That rule is startlingly broad: it reaches the rogue employee, the mid-level manager, the person who was expressly told not to do it. Having a policy against the conduct does not defeat corporate criminal liability in federal court. This is the foundational point developed in White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide.

So if a program does not defeat liability, what does it buy? Three things, and they are worth enormous money.

First, sentencing credit. Chapter 8 of the United States Sentencing Guidelines — the Organizational Sentencing Guidelines — computes an organization's fine from a "culpability score." Under U.S.S.G. § 8C2.5(f), having "an effective compliance and ethics program" at the time of the offense subtracts three points from that score, and under § 8C2.5(g) self-reporting, cooperation, and acceptance of responsibility subtract up to five more. Because the culpability score drives a multiplier applied to the base fine, those points routinely swing the fine range by an order of magnitude. U.S.S.G. § 8B2.1 then defines what "effective" means — the seven elements that every modern program is built around. Note two catches in § 8C2.5(f) itself: the credit is generally unavailable if high-level personnel participated in or willfully ignored the offense, and it is unavailable if the organization unreasonably delayed reporting after discovery.

Second, charging discretion. The DOJ's Principles of Federal Prosecution of Business Organizations (Justice Manual 9-28.000) tell line prosecutors to weigh "the adequacy and effectiveness of the corporation's compliance program at the time of the offense, as well as at the time of a charging decision." The Criminal Division's Evaluation of Corporate Compliance Programs (the "ECCP") is the grading rubric prosecutors actually use, organized around three questions: Is the program well designed? Is it adequately resourced and empowered to function effectively? Does it work in practice? Those three questions are the best table of contents ever written for a compliance department. Whether the outcome is a declination, a deferred-prosecution agreement, a monitor, or an indictment turns substantially on the answers. Note that DOJ charging policy is policy, not statute — it is revised across administrations, so confirm the current version of the ECCP and the Corporate Enforcement Policy before you rely on any specific term.

Third — and this is the one that reaches directors personally — oversight liability. In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), held that directors have a duty to make a good-faith effort to implement and monitor an information-and-reporting system. Stone v. Ritter, 911 A.2d 362 (Del. 2006), formalized the claim as a species of bad faith — a breach of the duty of loyalty, meaning it is not exculpable under a Delaware charter provision adopted pursuant to DGCL § 102(b)(7) and generally not indemnifiable. For two decades Caremark claims were called "possibly the most difficult theory in corporation law upon which a plaintiff might hope to win a judgment." Then came Marchand v. Barnhill, 212 A.3d 805 (Del. 2019) — the Blue Bell listeria case — where the Delaware Supreme Court sustained a Caremark claim because the board of a monoline ice-cream company had no board-level committee, no regular board reporting, and no protocol for food safety, the company's most essential compliance risk. Later Chancery decisions, including the Boeing 737 MAX derivative litigation, have followed suit where the board had no structure for a mission-critical risk. The lesson is precise: Marchand is not about whether the board caught the problem. It is about whether the board built a system designed to be told. Kestrel's audit committee learning about São Paulo from a newspaper is exactly the fact pattern that pleads a Caremark claim.

One accuracy caveat that matters: Caremark, Stone, and Marchand are Delaware law. Delaware is the reference point because a majority of large U.S. public companies are incorporated there, and most states have adopted or track its oversight framework — but the internal affairs doctrine means the state of incorporation controls. Confirm your own state's articulation. The directors' duties framework is developed in Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers.

Foundation — the authorities that reward (and punish) your program

Three instruments do almost all the work, and every pillar below is ultimately graded against them.

U.S.S.G. § 8B2.1 — the seven elements. The Sentencing Guidelines define an "effective compliance and ethics program" functionally, not formally. Stripped to their bones, the elements are: (1) written standards and procedures to prevent and detect criminal conduct; (2) knowledge and oversight by the governing authority, with a high-level individual assigned overall responsibility and a specific individual given day-to-day operational responsibility, adequate resources, and appropriate authority; (3) reasonable efforts not to place in substantial authority anyone the organization knew or should have known had engaged in illegal activities; (4) periodic training and communication at every level, including the board and agents; (5) monitoring and auditing, periodic evaluation of effectiveness, and a reporting system — including an anonymous or confidential channel — that permits reporting without fear of retaliation; (6) consistent promotion and enforcement through incentives and appropriate disciplinary measures; and (7) reasonable response to detected conduct, including remediation and any necessary program modification. Section 8B2.1(c) layers on the obligation to periodically assess risk and adjust the program accordingly. That is the skeleton. Everything else in this toolkit is muscle hung on it.

The ECCP — the three questions. DOJ's Evaluation of Corporate Compliance Programs translates the elements into the questions a prosecutor actually asks: Is the program well designed? Is it adequately resourced and empowered to function effectively? Does it work in practice? The third question is where paper programs die. Note that the ECCP, the Justice Manual, and the Corporate Enforcement Policy are policy documents, not statutes — they are rewritten across administrations and even within them. Confirm the current version before you rely on any specific term, metric, or safe harbor.

Caremark/Marchand — the personal layer. The Guidelines and the ECCP price corporate exposure. Delaware oversight doctrine prices director exposure, and it is not covered by an exculpation charter provision. That asymmetry is why compliance is a board agenda item and not merely a budget line.

A useful way to hold the three together: the Guidelines tell you what to build, the ECCP tells you how it will be graded, and Caremark tells you who pays if you never built it at all.

The compliance landscape at a glance

The pillars, in the order this toolkit walks them:

  1. Risk assessment — the risk map that justifies every other resourcing decision. (ECCP; U.S.S.G. § 8B2.1(c))
  2. Anti-corruption — bribery, books and records, internal accounting controls. (FCPA, 15 U.S.C. §§ 78dd-1 to 78dd-3, 78m(b))
  3. Antitrust — price fixing, bid rigging, market allocation, information exchange. (Sherman Act §§ 1–2)
  4. Securities, disclosure, and insider trading — MNPI, trading windows, Reg FD, certifications. (Exchange Act § 10(b); SOX §§ 302, 404)
  5. Trade, export controls, and sanctions — EAR, ITAR, OFAC; strict liability and screening.
  6. Healthcare fraud and abuse — kickbacks, Stark, the False Claims Act, HIPAA. (If you touch federal healthcare dollars.)
  7. Privacy, data security, and AI governance — data mapping, breach notification, model risk.
  8. Employment and workplace conduct — harassment, discrimination, wage-and-hour, classification.
  9. Environmental and product safety — permits, releases, recalls, reporting deadlines.
  10. Consumer protection and advertising — substantiation, deception, dark patterns.
  11. Policies, training, and communications — the program's written and spoken surface.
  12. Third parties and the supply chain — where most enforcement actually originates.
  13. Hotlines, whistleblowers, and internal investigations — the nervous system.
  14. Monitoring, auditing, and testing — proving the program works in practice.
  15. Discipline, incentives, and clawbacks — consequences, in both directions.
  16. The self-disclosure decision — the highest-stakes call the GC ever makes.
  17. Board oversight and reporting — the Marchand pillar.

Pillar 1 — Risk assessment and the compliance risk map

Everything downstream is a resourcing decision, and a resourcing decision you cannot justify is a resourcing decision a prosecutor will call arbitrary. The ECCP asks whether the program is "appropriately tailored" — and the tailoring evidence is the risk assessment. U.S.S.G. § 8B2.1(c) says the organization "shall periodically assess the risk of criminal conduct" and modify the program accordingly.

Build the map on four axes: geography (where do you operate, and what is the local corruption and sanctions profile?), business model (government customers? distributors? cash? licensing?), regulatory footprint (which regimes actually apply?), and history (what has gone wrong here, or at your peers?). Score each risk on inherent likelihood and severity, subtract the controls you actually have, and rank the residual. Then — this is the step everyone skips — document that the ranking drove the budget. Kestrel's map instantly surfaces what its old program buried: a distributor-heavy sales model in high-corruption markets, dual-use sensors with export classification questions, a hospital customer base that pulls in the Anti-Kickback Statute, and a new AI line with no governance at all.

Refresh the map annually and on any trigger event — an acquisition, a new market, a new product line, an enforcement action against a competitor. A stale risk assessment is worse than none: it is documentary proof that you knew how to look and stopped looking.

Pillar 2 — Anti-corruption and the FCPA

The Foreign Corrupt Practices Act has two halves, and the second is the one that bites.

The anti-bribery provisions (15 U.S.C. §§ 78dd-1, 78dd-2, 78dd-3) prohibit corruptly offering or giving anything of value to a foreign official to obtain or retain business. "Anything of value" is broad — cash, travel, internships for a minister's child, charitable donations steered to an official's foundation. Liability reaches payments made through third parties where the company knew or was aware of a high probability that the payment would be passed on; conscious avoidance is knowledge.

The accounting provisions (15 U.S.C. § 78m(b)(2)) apply to issuers and require (A) books and records that accurately and fairly reflect transactions in reasonable detail, and (B) a system of internal accounting controls sufficient to provide reasonable assurances that transactions are executed and recorded as authorized. These are civil, they carry no quid pro quo requirement, and they are how the SEC resolves most FCPA matters. A "consulting fee" to a customs broker with no deliverable is a books-and-records violation whether or not anyone can prove a bribe. That is Kestrel's real exposure in São Paulo — the payment is already a false record, and the fact that a regional director could authorize it alone is already a controls failure.

Practical controls: third-party diligence tied to red flags (see Pillar 12), pre-approval and dollar thresholds for gifts, travel, hospitality, and charitable and political contributions; local-language training for sales; a books-and-records regime that requires a written deliverable for every commission and consulting payment; and pre-closing anti-corruption diligence on acquisitions — the framework in Conducting Merger and Acquisition Due Diligence: A Practical Checklist is where successor liability gets caught before it is inherited.

Pillar 3 — Antitrust and competition

Section 1 of the Sherman Act (15 U.S.C. § 1) condemns contracts, combinations, and conspiracies in restraint of trade; Section 2 (15 U.S.C. § 2) condemns monopolization and attempted monopolization. A narrow set of horizontal restraints — price fixing, bid rigging, market and customer allocation — are per se unlawful, meaning no defense of reasonableness, no proof of market power, and no need to show effects. United States v. Socony-Vacuum Oil Co., 310 U.S. 150 (1940), is the anchor. These are also criminal felonies, and DOJ has for years charged individuals, not just corporations.

The compliance problem is that antitrust risk lives in ordinary commercial life: a trade-association hallway, a benchmarking survey, a competitor call about "irrational pricing," a no-poach understanding between HR departments, a hiring conversation at a conference. Train the sales and HR functions on what may never be discussed with a competitor — price, output, terms, bids, customers, territories, wages — and on what to do when the conversation starts anyway (state your objection, leave, document, report). Pair that with merger clearance discipline (Hart-Scott-Rodino, 15 U.S.C. § 18a) and with a document-hygiene program, because antitrust cases are won and lost on stray internal emails. The HSR reporting thresholds, filing-fee tiers, and the content of the notification form are revised — the size-of-transaction threshold is adjusted annually, and the form itself was substantially expanded in recent rulemaking. Never rely on a remembered dollar figure or a prior filing's exhibits; pull the current thresholds and the current form before you conclude a deal is non-reportable. The doctrine is developed in Antitrust Law: A Comprehensive Guide to the Sherman, Clayton, and FTC Acts; the operational build-out is Antitrust Compliance: A Practical Checklist and The Antitrust and Competition Toolkit.

The one uniquely antitrust feature worth internalizing: leniency is a race. Under the DOJ Antitrust Division's Leniency Program, the first conspirator to self-report a cartel and cooperate can receive a full pass from criminal prosecution — and the second gets nothing comparable. That structure means an antitrust discovery is the one compliance event where hours genuinely matter.

Pillar 4 — Securities, disclosure, and insider trading

For a public company, the compliance surface is disclosure itself. Section 10(b) of the Exchange Act (15 U.S.C. § 78j(b)) and Rule 10b-5 (17 C.F.R. § 240.10b-5) reach material misstatements and omissions in connection with the purchase or sale of a security. Sarbanes-Oxley § 302 requires the CEO and CFO to certify the accuracy of periodic reports and the effectiveness of disclosure controls; § 404 requires management's assessment of internal control over financial reporting, with auditor attestation for larger filers. Regulation FD (17 C.F.R. §§ 243.100–243.103) bars selective disclosure of material nonpublic information to analysts and holders.

Insider trading is judge-made law grafted onto Rule 10b-5. The classical theory reaches corporate insiders trading on material nonpublic information; Dirks v. SEC, 463 U.S. 646 (1983), extends it to tippees who know the tipper breached a duty for a personal benefit; United States v. O'Hagan, 521 U.S. 642 (1997), adopted the misappropriation theory, reaching outsiders who trade on information entrusted to them. Salman v. United States (2016) confirmed that a gift of confidential information to a trading relative or friend can itself supply the personal benefit.

The operational answers are a written insider-trading policy, defined blackout windows, pre-clearance for insiders, an MNPI list, and Rule 10b5-1 plans (17 C.F.R. § 240.10b5-1) as the affirmative defense — subject to the SEC's amended conditions, which added mandatory cooling-off periods, director and officer certifications, and limits on overlapping plans. The specific cooling-off day counts and plan limits have changed and may change again: confirm the current text of Rule 10b5-1(c) before relying on any figure. Start with Insider Trading Compliance and Rule 10b5-1 Plans: A Practical Checklist and Public Company Disclosure and Reporting: A Practical Checklist. If the SEC is already asking, go straight to Responding to an SEC Investigation and Wells Notice: A Practical Checklist and The Securities Litigation and Enforcement Toolkit. Private issuers raising capital should route through Raising Capital: A Startup Securities Toolkit.

Pillar 5 — Trade, export controls, and sanctions

This is the pillar most companies discover too late, because it applies to things that do not feel like exports.

The Export Administration Regulations (15 C.F.R. Parts 730–774) govern dual-use items by Export Control Classification Number, destination, end user, and end use. The International Traffic in Arms Regulations (22 C.F.R. Parts 120–130) govern defense articles and services on the U.S. Munitions List. OFAC sanctions (administered under IEEPA, 50 U.S.C. § 1701 et seq., and codified at 31 C.F.R. Chapter V) prohibit dealings with blocked persons and embargoed jurisdictions. Three traps recur: a deemed export — releasing controlled technology to a foreign national inside the United States, including your own engineer on a visa — is an export requiring a license; OFAC civil liability is effectively strict, meaning good faith does not save you; and the "50 Percent Rule" blocks entities majority-owned in the aggregate by blocked persons even when the entity itself is not on the SDN List.

Customs sits alongside this: classification under the Harmonized Tariff Schedule, valuation, country-of-origin marking, free-trade-agreement claims, and the reasonable-care duty owed to CBP under 19 U.S.C. § 1484.

A currency warning that cannot be overstated for this pillar. Nothing in trade compliance is stable. Sanctions and restricted-party lists (SDN, Entity List, Denied Persons, Unverified, debarment) change on no fixed schedule — sometimes weekly, sometimes daily. Tariff rates, Section 301 and Section 232 actions, exclusions, and de minimis treatment change by executive action and can change overnight. Export Control Classification Numbers and license-exception availability are amended by rule. Every figure, list, and classification in this area must be pulled fresh from the current official source at the time of the transaction. Screen against live lists, never a cached copy or a spreadsheet exported last quarter; re-screen counterparties continuously, not only at onboarding, because a clean party today can be designated tomorrow and your open purchase order becomes a violation without anyone at your company doing anything at all.

Kestrel's sensors are exactly the profile: potentially dual-use, sold to utilities in the Gulf, with a Malaysian plant and foreign-national engineers in Ohio. Its build is classification, restricted-party screening at onboarding and at transaction, end-use certifications, deemed-export controls on the engineering network, and a documented licensing file. See Export Controls and Economic Sanctions: A Comprehensive Guide to the EAR, ITAR, and OFAC, the operational Export Control and Sanctions Compliance: A Practical Checklist, International Trade Law: A Comprehensive Guide to Customs, Tariffs, and Trade Remedies for the customs and tariff side, and The International Trade and Sanctions Toolkit.

Pillar 6 — Healthcare fraud and abuse (if applicable)

If any revenue touches Medicare, Medicaid, TRICARE, or a federal health program — including as a device or software vendor — three statutes attach. The Anti-Kickback Statute (42 U.S.C. § 1320a-7b(b)) is a criminal, intent-based prohibition on remuneration to induce referrals or the purchase of reimbursable items; it is broad, and it is why speaker fees, consulting arrangements, and educational grants require fair-market-value substantiation and a safe-harbor analysis. Stark (42 U.S.C. § 1395nn) is a strict-liability self-referral prohibition for physician financial relationships — no intent element, so an expired lease or an unsigned amendment is itself a violation. The False Claims Act (31 U.S.C. §§ 3729–3733) is the enforcement engine, with treble damages, per-claim penalties, and qui tam relators; Universal Health Services, Inc. v. United States ex rel. Escobar, 579 U.S. 176 (2016), endorsed implied false certification while imposing a "rigorous" and "demanding" materiality standard. Layer HIPAA on top for the data. The deep dive is Healthcare Compliance: A Comprehensive Guide to HIPAA, Stark, and the Anti-Kickback Statute, with the operational HIPAA Compliance: A Practical Checklist.

Pillar 7 — Privacy, data security, and AI governance

Privacy is a patchwork, not a statute: a sectoral federal layer (HIPAA, GLBA, FCRA, COPPA, the FTC Act), a fast-moving state comprehensive layer led by the CCPA as amended by the CPRA (Cal. Civ. Code § 1798.100 et seq.), all fifty states' breach-notification statutes, and the GDPR (Regulation (EU) 2016/679) if you touch the EU. The number of state comprehensive privacy laws is changing every legislative session — confirm the current list rather than relying on any count. Build from the data map outward: know what you collect, why, where it sits, who you share it with, and how long you keep it. Then layer notice, rights fulfillment, vendor terms, security controls, and an incident-response plan with the notification clocks pre-computed.

Use The Privacy and Data Protection Toolkit: Building and Operating a Compliance Program as the sub-map, Building a Privacy Compliance Program: Governance, Data Mapping, and the Legal Patchwork for the doctrine, Standing Up a Privacy Compliance Program: A Practical Checklist for the build, and Data Breach Notification Law: A Comprehensive Guide for the clocks.

AI governance is now a compliance pillar in its own right, and it is the newest place Marchand logic will land: if an AI system is mission-critical to your product, a board with no reporting line on it is exposed. The EU AI Act (Regulation (EU) 2024/1689) phases in obligations by risk tier; U.S. states are legislating; and existing law — discrimination, consumer protection, product liability — already applies to model outputs. The NIST AI Risk Management Framework is the practical scaffolding. See AI Governance and Compliance: A Comprehensive Guide and Deploying an AI System: An AI Governance and Risk Checklist. Kestrel's new ML line goes into the risk map at high severity precisely because nobody in the company can currently say who approved it.

Pillar 8 — Employment and workplace conduct

Title VII (42 U.S.C. § 2000e et seq.), the ADA, the ADEA, the FLSA (29 U.S.C. § 201 et seq.), and the OSH Act's general duty clause (29 U.S.C. § 654(a)(1)) form the core, with state law frequently more protective. The compliance leverage point is the Faragher/Ellerth affirmative defense: under Faragher v. City of Boca Raton, 524 U.S. 775 (1998), and Burlington Industries, Inc. v. Ellerth, 524 U.S. 742 (1998), an employer facing a supervisor-harassment claim with no tangible employment action may defend by showing it exercised reasonable care to prevent and promptly correct harassment and that the employee unreasonably failed to use the employer's complaint procedure. That is a compliance program written directly into a legal defense — a policy, a channel, an investigation, and a remedy.

The library's map is The Employment Law Toolkit: From Hiring to Separation, with Employment Discrimination Law: A Comprehensive Guide for doctrine, Drafting an Employee Handbook That Holds Up: A Practical Checklist for the written surface, Classifying Workers: Employee or Independent Contractor — A Practical Checklist for the misclassification exposure, and Conducting a Workplace Investigation: A Practical Checklist for what happens after a complaint lands.

Pillar 9 — Environmental and product safety

If you manufacture, you have a permit portfolio and a set of reporting clocks. CERCLA (42 U.S.C. § 9601 et seq.) imposes strict, joint and several, and retroactive liability on owners, operators, arrangers, and transporters for hazardous-substance releases — the single most punitive liability scheme in American regulatory law, and one you can inherit by buying a building. RCRA (42 U.S.C. § 6901 et seq.) governs hazardous waste cradle to grave. The Clean Air Act (42 U.S.C. § 7401 et seq.) and Clean Water Act (33 U.S.C. § 1251 et seq.) run on permits, monitoring, and self-reported exceedances — and self-reported data is the government's evidence, which makes the accuracy of your own environmental reporting a compliance function, not an engineering one.

On the product side, the Consumer Product Safety Act (15 U.S.C. § 2064(b)) requires reporting of a substantial product hazard within 24 hours of obtaining reportable information, and the analogous FDA, NHTSA, and USDA regimes have their own clocks. The gap between "engineering thinks it might be a problem" and "the clock started" is where companies get destroyed.

Critical framing: the regulatory clocks are federal, but the liability is state law. Reporting duties come from federal statutes and agencies. The lawsuit that follows a defective product is a state-law tort claim, and there is no single nationwide products-liability rule to comply with. States genuinely diverge on the questions that decide cases: some apply a consumer-expectations test to design defect, others a risk-utility or reasonable-alternative-design test along the lines of the Restatement (Third) of Torts: Products Liability, and some blend them; states split on comparative fault versus the shrinking minority of contributory-negligence jurisdictions; failure-to-warn standards, the sophisticated-user and learned-intermediary doctrines, statutes of repose, and punitive-damages caps all vary by state. The same is true of tort law generally. Do not build a "products compliance" program around a rule you read once — build it around the law of the states where you actually sell, and confirm each one. The framework, and the places states part company, is developed in Products Liability: A Comprehensive Guide to Design Defect, Manufacturing Defect, and Failure to Warn and Tort Law: A Comprehensive Guide to Negligence, Intentional Torts, and Strict Liability, with the defense posture in Defending a Products Liability Claim: A Practical Checklist and the map in The Tort and Products Liability Toolkit.

For the environmental and recall machinery, see Environmental Law: A Comprehensive Guide to CERCLA, RCRA, the Clean Air Act, and the Clean Water Act, The Environmental Law Toolkit, and Managing a Product Recall: A Practical Checklist. If your footprint includes facilities or development, note that land use and zoning is likewise state and local law — permitting, variances, and entitlements are creatures of a municipal code, not a national one; see Land Use and Zoning Law: A Comprehensive Guide.

Pillar 10 — Consumer protection and advertising

Section 5 of the FTC Act (15 U.S.C. § 45) prohibits unfair or deceptive acts or practices; Lanham Act § 43(a) (15 U.S.C. § 1125(a)) gives competitors a private false-advertising claim; the TCPA (47 U.S.C. § 227) and FCRA (15 U.S.C. § 1681 et seq.) create statutory-damages exposure that scales terrifyingly in a class action; and every state has a UDAP statute. The compliance rule is simple and constantly violated: every objective claim needs substantiation in hand before it runs. "Reduces downtime by 40%" is a claim that must have a study behind it on the day it publishes, not the day the CID arrives. See Advertising Law: A Comprehensive Guide to the FTC Act and Lanham Act, Substantiating Advertising Claims: A Practical Checklist, and Consumer Protection Law: A Comprehensive Guide to the FDCPA, FCRA, TCPA, and State UDAP Statutes. Because consumer claims aggregate, read the exposure through Class Action Litigation: A Comprehensive Guide to Rule 23.

Pillar 11 — Policies, training, and communications

U.S.S.G. § 8B2.1(b)(1) requires "standards and procedures to prevent and detect criminal conduct"; § 8B2.1(b)(4) requires training and periodic communication. But the ECCP's question is sharper than "do you have a policy": is it accessible, is it in the language of the people who need it, is it risk-tailored, and has it been updated after failures?

Three tests separate real policy work from paper. Findability: can a plant supervisor in Malaysia locate the gifts policy in under a minute, in Malay? Specificity: does the policy give a dollar threshold and a pre-approval path, or does it say "use good judgment"? Metabolism: after the São Paulo incident, did the policy change, and can you show the redline? Root-cause analysis feeding a documented policy revision is one of the highest-value artifacts a program can produce, because it directly answers the ECCP's "does it work in practice" prong. Train by risk, not by roster: forty minutes of general e-learning for everyone plus three hours of live, scenario-based training for the sales, procurement, and finance populations beats four hours of e-learning for all.

Pillar 12 — Third-party and supply-chain due diligence

Most enforcement originates outside the company. Distributors, agents, customs brokers, freight forwarders, joint-venture partners, and resellers act in your name and, in the FCPA's terms, expose you to liability where you knew or consciously avoided knowing what they were doing. Build a risk-tiered program: screen every counterparty against sanctions and debarment lists at onboarding and continuously; run enhanced diligence (ownership, government connections, adverse media, references) on high-risk intermediaries; document a business justification for each intermediary and a rationale for the commission rate; and put audit rights, anti-corruption and sanctions representations, and termination rights into the contract — and then actually exercise the audit right at least once, because an unexercised audit right is a paper control.

Kestrel's São Paulo failure was a third-party failure. The customs broker was onboarded by the sales team with no diligence, paid on an invoice with no deliverable, and never screened. Every one of those is a control that costs almost nothing and would have caught it.

Pillar 13 — Hotlines, whistleblowers, and internal investigations

U.S.S.G. § 8B2.1(b)(5)(C) requires a mechanism for anonymous or confidential reporting without fear of retaliation. Do not treat it as a phone line — treat it as the nervous system, and instrument it: track volume, category, source, time-to-close, and substantiation rate. A hotline with almost no reports is not a sign of a clean company; it is a sign of a distrusted channel, and sophisticated prosecutors read it that way.

Two doctrines govern what happens next. Privilege: an internal investigation conducted by counsel for the purpose of providing legal advice can be privileged under Upjohn Co. v. United States, 449 U.S. 383 (1981), which extended the corporate privilege beyond the "control group" — and the D.C. Circuit's Kellogg Brown & Root decision confirmed that a compliance-driven investigation does not lose privilege merely because it was also required by regulation or corporate policy. The privilege belongs to the company, not the employee, which is why every witness interview opens with an Upjohn warning. Retaliation: Sarbanes-Oxley § 806 and the Dodd-Frank bounty and anti-retaliation provisions (15 U.S.C. § 78u-6) protect whistleblowers, and the SEC has repeatedly charged companies for severance and confidentiality agreements that impede reporting to the Commission. Note that Digital Realty Trust, Inc. v. Somers (U.S. 2018) held that Dodd-Frank's anti-retaliation protection requires a report to the SEC — but that is a narrow holding about one statute, and SOX and state law protect internal reporters. Never draft an NDA or severance release that could be read to bar a report to a regulator.

The operational playbooks: Conducting a Workplace Investigation: A Practical Checklist for conduct matters, Responding to a Government Subpoena or Investigation: A Practical Checklist once the government is involved, and Issuing a Litigation Hold and Preserving ESI: A Practical Checklist — which should be triggered by the credible allegation, not by the subpoena. Coverage questions (D&O, E&O, cyber, and whether defense costs for an investigation are even covered) belong to Insurance Coverage Law: A Comprehensive Guide for Policyholders, and they should be answered before you need the answer — with the caveat that insurance coverage is state law. Whether a government investigation is a "claim," when a duty to defend is triggered, how the "final adjudication" language in a fraud exclusion is read, whether disgorgement is insurable, and how allocation between covered and uncovered parties works are all questions on which states reach different answers. Read the policy, then read the law of the state whose law governs it; do not assume a coverage rule you learned in one jurisdiction travels.

Pillar 14 — Monitoring, auditing, and testing the program

U.S.S.G. § 8B2.1(b)(5)(A) requires monitoring and auditing to detect criminal conduct. The ECCP's third prong — does it work in practice? — is answered here or nowhere.

Distinguish three activities. Continuous monitoring is automated: transaction testing against thresholds, duplicate-vendor detection, screening hits, expense anomalies, trade-surveillance alerts. Periodic audits are targeted and risk-driven: pull twenty distributor files in the highest-risk market and see whether the diligence was actually done. Program testing asks whether the controls themselves function: send a test report through the hotline; try to onboard a fictitious vendor and see if screening catches it; interview employees and ask whether they know how to report. Measure and report the results. A program that has never found anything has not proved it is clean; it has proved it is not looking.

Pillar 15 — Discipline, incentives, and compensation clawbacks

U.S.S.G. § 8B2.1(b)(6) requires consistent enforcement through appropriate disciplinary measures, and the ECCP asks pointedly whether discipline is applied consistently across seniority levels. One terminated junior employee and one quietly retained vice president is a finding, not a personnel decision — and it is the single most common way a program is judged a sham.

Incentives run the other direction. Bake compliance into performance reviews and bonus criteria. On the recovery side, Exchange Act § 10D and Rule 10D-1 — implemented through NYSE and Nasdaq listing standards — require listed issuers to maintain a policy recovering erroneously awarded incentive compensation from executive officers following an accounting restatement, on a no-fault basis, and SOX § 304 (15 U.S.C. § 7243) separately allows recovery of CEO and CFO bonuses and profits after a misconduct-driven restatement. DOJ has also pressed companies to adopt misconduct-based clawback and compensation-withholding policies as a condition of resolution credit; those DOJ programs are policy and evolve, so confirm the current terms.

Pillar 16 — The self-disclosure decision

This is the hardest call in the field, and it is made under time pressure with incomplete facts.

The structure of the incentive is clear enough. Chapter 8 gives self-reporting a culpability-score reduction, and the DOJ's Corporate Enforcement Policy offers a presumption of declination for companies that voluntarily self-disclose promptly, cooperate fully, and remediate appropriately, absent aggravating circumstances — typically with disgorgement rather than a criminal penalty. Aggravators (executive involvement, recidivism, significant profit, pervasiveness) can defeat the presumption. OFAC, BIS, and the Antitrust Division each run their own disclosure regimes with different math, and antitrust leniency is a winner-take-all race.

But disclosure is irrevocable, and the countervailing costs are real: waiver pressure on privilege, employee exposure, derivative suits, follow-on class actions, debarment, and foreign regulators who read the U.S. resolution and open their own file. The disciplined process is: (1) stop the conduct and preserve; (2) scope it — is this one broker or a practice?; (3) get privileged, independent facts fast, because the clock on "prompt" is running from discovery, not from certainty; (4) model both paths, including the probability the government learns from a whistleblower anyway (assume it is high); and (5) decide at the board or audit-committee level, with the decision and its reasons documented. Do not make this call without experienced white-collar counsel. The framing is in White-Collar Crime and Corporate Criminal Liability: A Comprehensive Guide; if a regulator is already moving, The Administrative Law Toolkit maps the agency-action and judicial-review side of the fight.

Kestrel's board, advised that the São Paulo scheme was one broker but that the same control gap existed in three other markets, disclosed — and spent the following ninety days remediating so that the remediation, not the misconduct, was the story counsel could tell.

Pillar 17 — Board oversight and reporting

Return to Marchand. The board does not have to be right. It has to have built a system designed to inform it, and it has to have used it. That means: a charter assigning compliance oversight to a named committee (audit, or a standalone compliance committee); the CCO with a direct, unfiltered reporting line to that committee and a regular executive session without management present; a standing agenda item — not an "other business" mention; a dashboard of the risk map, hotline metrics, audit findings, training completion, and remediation status; and minutes that reflect the discussion, because in a derivative suit the minutes are the record of whether oversight existed.

The ECCP asks whether the compliance function has autonomy, resources, and stature. Those are budget questions with legal consequences: a CCO who reports to the General Counsel who reports to the CEO whose bonus depends on the revenue at issue is a structural finding waiting to be made. Build the reporting hygiene with Board Governance, Minutes, and Corporate Formalities: A Practical Checklist, and read it against Corporate Governance and Fiduciary Duties: A Comprehensive Guide for Directors and Officers. Smaller and private companies should scale the same architecture down through The Small Business Legal Toolkit — the Caremark duty does not begin at a revenue threshold.

Cross-cutting: how much weight does agency guidance actually carry?

Compliance programs are built substantially out of agency material — FAQs, guidance documents, advisory opinions, enforcement releases, interpretive rules. It is worth being precise about what that material is legally worth, because the answer has changed.

Chevron deference is no longer good law. In Loper Bright Enterprises v. Raimondo, 603 U.S. 369 (2024), the Supreme Court overruled Chevron U.S.A. Inc. v. Natural Resources Defense Council. Courts no longer defer to an agency's reasonable interpretation of an ambiguous statute; under the APA, courts now exercise independent judgment and decide the best reading of the statute themselves, giving an agency's view only the persuasive weight it earns — the Skidmore-style respect owed to an interpretation with the power to persuade. Anything you read that describes "Chevron step two" as the operative test is out of date. Related current doctrine matters too: the major questions framework treats assertions of vast economic and political significance with skepticism absent clear congressional authorization; SEC v. Jarkesy (2024) held that a defendant facing SEC civil penalties for securities fraud has a Seventh Amendment right to a jury trial in an Article III court, constraining in-house adjudication; Corner Post, Inc. v. Board of Governors (2024) held that an APA claim accrues when the plaintiff is injured, meaning long-settled rules are more exposed to challenge; and Ohio v. EPA (2024) underscored hard-edged arbitrary-and-capricious review of an agency's failure to address significant comments.

What this means operationally is genuinely two-sided, and it is easy to draw the wrong lesson. Do not read it as license to ignore guidance. For the compliance officer, agency guidance remains the best available forecast of what the enforcer will do, and being right about a statute after four years of litigation is a poor substitute for not being charged. Deference doctrine governs how a court reviews an agency; it does not lower your risk of investigation, subpoena, reputational damage, or a resolution you cannot afford to litigate. What changed is the strength of your hand when you decide to contest a rule: a regulation or interpretation that reaches past its statutory authority is now materially more vulnerable, and preserving that argument — in comments, in the administrative record, in your response to a proposed penalty — is worth doing deliberately rather than as an afterthought. The judicial-review side of the fight is mapped in Administrative Law: A Comprehensive Guide to Agency Action and Judicial Review, Challenging Agency Action Under the APA: A Practical Checklist, and The Administrative Law Toolkit.

The same lesson applies to DOJ's own compliance material. The ECCP and the Corporate Enforcement Policy are internal policy, not law: they bind no court, they confer no enforceable rights, and they are rewritten. Build to them anyway — they are the rubric — but date-stamp your reliance and re-verify.

The program as a working checklist

Gate 1 — Foundation

  • [ ] A named CCO with autonomy, budget, stature, and a direct line to the audit committee.
  • [ ] Board committee charter expressly assigning compliance oversight; standing agenda item; executive sessions.
  • [ ] Written code of conduct, approved by the board, accessible in every operating language.

Gate 2 — Risk

  • [ ] Documented risk assessment across geography, business model, regulation, and history; refreshed annually and on trigger events.
  • [ ] Residual-risk ranking demonstrably driving budget, training, audit, and diligence priorities.

Gate 3 — Substantive controls

  • [ ] Anti-corruption: gift/travel/hospitality thresholds, pre-approval, deliverable-backed payments, books-and-records discipline.
  • [ ] Antitrust: competitor-contact rules, trade-association protocol, document hygiene, HSR discipline.
  • [ ] Securities: insider-trading policy, windows, pre-clearance, MNPI list, compliant 10b5-1 plans, disclosure controls.
  • [ ] Trade: classification, restricted-party screening (onboarding and transaction), end-use certifications, deemed-export controls.
  • [ ] Healthcare (if applicable): AKS/Stark analysis, fair-market-value substantiation, signed and current arrangements.
  • [ ] Privacy and AI: data map, notices, rights process, vendor terms, incident-response plan with clocks, AI inventory and approval gate.
  • [ ] Employment: handbook, harassment policy and channel, classification audit, wage-and-hour review.
  • [ ] Environmental and product: permit calendar, reporting clocks pre-computed, recall decision tree.
  • [ ] Advertising: substantiation in hand before every objective claim publishes.

Gate 4 — Machinery

  • [ ] Risk-tiered third-party diligence with continuous screening, contractual audit rights — and at least one audit actually exercised.
  • [ ] Hotline: anonymous, multilingual, non-retaliatory, with tracked metrics and closure times.
  • [ ] Investigation protocol with Upjohn warnings, privilege discipline, and litigation-hold triggers.
  • [ ] Monitoring, targeted audits, and affirmative testing of the controls themselves.
  • [ ] Consistent discipline across seniority levels; compliance in performance and bonus criteria; a compliant clawback policy.
  • [ ] No agreement anywhere — NDA, severance, employment — that could be read to impede reporting to a regulator.

Gate 5 — Proof

  • [ ] Root-cause analysis after every substantiated incident, feeding a documented policy or control revision.
  • [ ] Annual program effectiveness review, benchmarked against the current ECCP and U.S.S.G. § 8B2.1.
  • [ ] Currency discipline: sanctions and restricted-party lists screened live (never cached); tariff rates, HSR thresholds, and ECCNs re-verified at the time of use; state-by-state confirmation for the state-law domains (tort and products liability, land use, insurance coverage) in every state where you sell or operate.
  • [ ] Board minutes that actually reflect the compliance discussion.

Primary Authority

Secondary Sources

  • The ABA's compliance and white-collar materials
  • OECD Convention on Combating Bribery of Foreign Public Officials and its good-practice guidance on internal controls, ethics, and compliance
  • NIST AI Risk Management Framework 1.0
  • Restatement (Third) of Agency (scope-of-employment and apparent-authority questions that drive respondeat superior)
  • Restatement (Second) of Torts; Restatement (Third) of Torts: Products Liability (state-law tort and product frameworks)

Related UpLaw Resources

Related Guides & Articles

Related Checklists

Related Toolkits

This toolkit is general legal information from UpLaw (uplaw.us), not legal advice, and does not create an attorney-client relationship. Laws vary by state and change over time; DOJ and SEC compliance policies are revised frequently; verify current requirements and consult qualified counsel before acting.