New DOJ Compliance Chief Signals Increased Compliance Program Scrutiny

DOJ’s Historic Approach to Compliance Expertise

DOJ internal guidance requires federal prosecutors to consider certain factors when making decisions about whether to criminally charge companies. Two of those factors require prosecutors to evaluate companies’ compliance programs: “the existence and effectiveness of the corporation’s pre-existing compliance program” and “the corporation’s remedial actions, including any efforts to implement an effective corporate compliance program or to improve an existing one, to replace responsible management, to discipline or terminate wrongdoers, to pay restitution, and to cooperate with the relevant government agencies.”¹

To assist prosecutors in evaluating these factors, DOJ created the role of Compliance Counsel within its Criminal Division in 2015 and filled it with a former prosecutor who also had private-sector compliance expertise. DOJ’s then-Fraud Section Chief indicated that the Compliance Counsel position was implemented to help create “benchmarks” for corporate compliance with companies across various industries and across prosecutorial offices. The position was designed to allow the Compliance Counsel to parachute into cases and assist prosecutors by providing expertise in corporate compliance when evaluating whether to criminally charge companies.

In 2017, upon the departure of the then-Compliance Counsel, DOJ shifted strategies. Rather than hiring another individual to fill a centralized compliance counsel role, DOJ instead focused on building a well-rounded team of compliance-competent attorneys, including training prosecutors and hiring prosecutors who brought firsthand compliance experience from the private sector.

DOJ’s Increased Transparency on its Compliance Expectations

In addition to DOJ’s focus on compliance expertise within in ranks, DOJ has also increased its transparency to the public on its expectations of corporate compliance programs in recent years. More specifically, first in 2017 and then via two subsequent updates in 2019 and 2020, DOJ’s Fraud Section publicized new guidance, titled “Evaluation of Corporate Compliance Programs” (available here), intended to provide more specific examples of how federal prosecutors would probe companies’ compliance programs in the process of investigating and resolving enforcement matters. The guidance set forth sample questions arranged under a number of topics that prosecutors could ask when evaluating companies’ compliance programs in the context of criminal investigations. The questions are designed to look behind companies’ paper compliance programs to evaluate how the programs had been implemented, updated, and enforced in practice. The guidance indicated the broad-based “pressure testing” of corporate compliance programs that was to take place as part of DOJ’s investigative process.

DOJ’s New Compliance Expert

DOJ’s new compliance expert, Matt Galvin, will use DOJ’s compliance guidance to pressure-test the compliance programs of companies under investigation by DOJ. Although Galvin has not previously worked at DOJ or for the government more generally, he brings with him key private-sector compliance experience as Anheuser-Busch InBev’s global compliance chief. Further, his compliance tenure at Anheuser-Busch includes private-sector experience during an FCPA investigation, which resulted in a multimillion-dollar enforcement action by the Securities and Exchange Commission in 2016.

Galvin will also have the benefit of assisting prosecutors with internal compliance training and by providing private-sector compliance experience. Indeed, Galvin will have company in DOJ’s leadership with compliance expertise, as DOJ’s Assistant Attorney General for the Criminal Division and DOJ’s incoming Fraud Section Chief both previously served as chief compliance officers in the private sector.

Finally, Galvin’s hiring may indicate increased scrutiny on the use of data analytics by companies’ compliance programs. During his time at Anheuser-Busch, Galvin led the development of a data analytic system that used Anheuser-Busch’s data to attempt to identify high-risk business partners and improper payments. He also led an effort to try to get companies to share data for compliance purposes. The use of data analytics for compliance purposes was a topic that DOJ highlighted when it issued its most recent compliance guidance in 2020, in which DOJ indicated that companies should be asking: “Do compliance and control personnel have sufficient direct or indirect access to relevant sources of data to allow for timely and effective monitoring and/or testing of policies, controls, and transactions?” It appears that Galvin’s work at DOJ will also focus on the Fraud Section’s data analytics capabilities.

In light of DOJ’s focus on compliance resources in recent years, Galvin’s hiring is not particularly surprising. Rather, it is another clear signal from DOJ that companies need to prioritize (and enhance) their compliance programs to avoid government investigations and to be able to defend their compliance programs should they become subject to a government investigation. Galvin’s and DOJ’s recent focus on data analytics also suggests that companies would be wise to evaluate their own data-driven compliance efforts.