U.S. DOJ Evaluation of Corporate Compliance Programs (ECCP)

Why does it matter?

The ECCP decides how much credit a company's compliance program earns when the Criminal Division chooses whether to charge, what form a resolution takes, how large the penalty is and whether a monitor is imposed (Introduction). Because the questions are public and specific, boards and compliance officers use them as the design standard for programs in the United States and for multinationals within U.S. jurisdiction. A company that cannot show the risk assessment behind its program, data on how its hotline and investigations perform, or evidence that controls were tested and revised after lessons learned answers the prosecutor's questions badly.

Key benefits include:

• The prosecutor's own questions

Each topic in Parts I to III lists the questions the Division has found relevant, so a program can be tested against the same text prosecutors read.

• Credit in a resolution

The Introduction ties the assessment to the form of resolution, the monetary penalty and compliance obligations such as a monitorship.

• Proof that the program works

Part III asks for periodic testing, review, investigation data and root-cause remediation rather than policies alone.

• New technology and data

Part I.A asks how the company assesses the risks of new technologies such as artificial intelligence; Part II.B asks whether compliance has timely access to relevant data sources.

• Alignment with the Sentencing Guidelines

The document cites U.S.S.G. § 8B2.1 throughout, so the same evidence serves the ECCP and the organizational sentencing standard.

How does it work?

Part I, Is the Corporation's Compliance Program Well Designed, has six topics. A. Risk Assessment asks for the methodology used to identify, analyze and address the company's risks, risk-tailored resource allocation, periodic updates, lessons learned and, since the September 2024 edition, an assessment of new technologies such as artificial intelligence, including whether AI risk is integrated into enterprise risk management. B. Policies and Procedures, C. Training and Communications, D. Confidential Reporting Structure and Investigation Process (including a commitment to whistleblower protection and anti-retaliation), E. Third Party Management and F. Mergers and Acquisitions complete the design questions.

Part II, on whether the program is adequately resourced and able to function effectively, probes whether a program is a paper program (JM 9-28.800). A. Commitment by Senior and Middle Management covers conduct at the top and shared commitment. B. Autonomy and Resources covers structure, seniority and stature, experience and qualifications, funding and resources, data resources and access (whether compliance personnel have sufficient direct or indirect access to relevant data sources for timely monitoring and testing), proportionate resource allocation and outsourced compliance functions. C. Compensation Structures and Consequence Management covers consistent discipline, incentives and tracking of disciplinary data.

Part III, Does the Corporation's Compliance Program Work in Practice, has three topics. A. Continuous Improvement, Periodic Testing, and Review asks about internal audit, control testing, evolving updates, gap analysis, lessons learned from the company's own misconduct and that of other companies facing similar risks, monitoring and testing of AI and other new technologies, measurement and culture of compliance. B. Investigation of Misconduct asks for a properly scoped, independent and documented investigation function. C. Analysis and Remediation of Any Underlying Misconduct asks for root cause analysis, prior weaknesses, payment systems, vendor management and accountability for misconduct.

Key Elements

• Risk Assessment (Part I.A)

The methodology for identifying, analyzing and addressing the company's particular risks, risk-tailored resource allocation, periodic updates and the assessment of new technologies such as AI.

• Policies, procedures, training and communications (Parts I.B and I.C)

A code of conduct and policies that address identified risks, accessible to employees and third parties, with risk-based training and communications about misconduct and discipline.

• Confidential reporting and investigations (Part I.D)

An anonymous or confidential reporting mechanism that employees trust, whistleblower protection and anti-retaliation training, and properly scoped investigations by qualified personnel.

• Third parties and acquisitions (Parts I.E and I.F)

Risk-based due diligence and monitoring of third parties, and due diligence and integration of acquired entities into the compliance program.

• Management commitment, autonomy and resources (Parts II.A and II.B)

Conduct at the top, the compliance function's seniority and stature, funding, data resources and access, and proportionate resource allocation.

• Consequence management, testing and remediation (Parts II.C and III.A to III.C)

Consistent discipline and incentives, periodic testing and review, lessons learned, investigation of misconduct and root cause remediation.

What does it cover?

The ECCP applies to any corporation whose compliance program the Criminal Division evaluates in an investigation, charging decision or resolution, including foreign companies within U.S. federal criminal jurisdiction. It addresses the whole compliance program rather than a single law, and the Introduction states that the Division considers the company's size, industry, geographic footprint, regulatory landscape and other internal and external factors in an individualized determination. Footnote 3 of the document also points prosecutors evaluating anti-money laundering programs to the Money Laundering and Asset Recovery Section and the FFIEC BSA/AML Examination Manual.

What are its objectives?

The Introduction states that the document is meant to assist prosecutors in making informed decisions about whether, and to what extent, a corporation's compliance program was effective; for companies it is the statement of what an effective program looks like.

Assess whether the program was effective at the time of the offense and is effective at the time of the charging decision or resolution.

Inform the form of any resolution or prosecution, the monetary penalty and the compliance obligations in a corporate criminal resolution.

Apply the Justice Manual factors (JM 9-28.300, 9-28.800) and the Sentencing Guidelines (U.S.S.G. § 8B2.1) consistently.

Answer the three fundamental questions: well designed, adequately resourced and able to function effectively, and working in practice.

Credit risk-tailored programs that devote attention and resources to high-risk transactions, even when a program fails to prevent an infraction (Part I.A).

Framework in Context

The ECCP is the Criminal Division's implementation of the Justice Manual's compliance factors and of U.S.S.G. § 8B2.1, and the Department's corporate enforcement policies read alongside it; the Division's compliance page lists it with the May 2025 Memorandum on Selection of Monitors in Criminal Division Matters and the FCPA Resource Guide of July 2020. Its topics correspond to the compliance management system requirements of ISO 37301:2021, the anti-bribery management system of ISO 37001:2016 and the six principles of the UK Bribery Act 2010 guidance, which is why one program design and one evidence base can serve a U.S. resolution and those standards.

Common Framework Mappings

Compliance teams map the ECCP's topics to the laws, standards and control frameworks their program already answers to so that one set of evidence serves prosecutors, auditors and regulators.

Mapped frameworks include:

USSG §8B2.1

FCPA

UK Bribery Act 2010

COSO IC 2013

COSO ERM 2017

SOX

IIA Three Lines Model

OCEG Red Book 3.5

ISO 31000:2018

ISO 42001

ISO 37301:2021

ISO 37001:2016