"As demonstrated within this context, actual enforcement can serve as a powerful motivator of intensified corporate compliance efforts. Companies and individuals often want to do the right thing, but an effective compliance programme entails more than just a pristine ethical mindset. Among other elements discussed in this book, a compliance programme requires the commitment of management at all levels and sufficient resourcing to do the job well. For obvious reasons, the spectre of aggressive enforcement offers a highly persuasive justification for finding religion in this area and making the necessary adjustments and investments."

"Prosecutors also have a valuable role in helping to incentivise companies to implement and maintain effective compliance programmes. Authorities in the region can do evenmore to support the growing compliance culture, including by imposing lower penalties on companies that implement effective programmes or, better yet, by declining altogether under appropriate circumstances from penalising these companies when certain things go wrong. This is especially so when companies are plagued by isolated misconduct of a rogue employee or a small number of employees. While active enforcement undoubtedly breeds greater efforts to comply, enforcement decisions that respect such genuine compliance efforts arguably can do so even more."

An effective compliance programme

Much ink has been spilled over what constitutes an effective compliance programme,including in Latin America. Yet the main ingredients are relatively uncontroversial, withcertain compliance truths remaining generally applicable.For example, as outlined in guidance issued in 2019 by the US Department of Justice,proper evaluation of a corporate compliance programme necessarily involves assessing itsdesign, implementation and effective functioning:

• Design: Proper design begins with a thoughtful risk assessment. This includes evaluatinga company’s compliance risk factors, such as its jurisdictions of operation, industry,government touchpoints and reliance on third parties. Just as no two companies are thesame, a compliance programme cannot be one-size-fits-all but must be tailored to acompany’s risk profile and integrated into its internal controls.
  
  
• Implementation: Even the most brilliantly crafted programme can provide only limitedcomfort if it is not implemented effectively. This requires the commitment of management,autonomy and resourcing of the compliance function, and both incentives forcompliance and disincentives for non-compliance.
  
  
• Functioning: A compliance programme is only as good as it functions in practice. Adequate monitoring, testing and review are necessary to ensure that a programme is working asintended and is refined as needed. Proper functioning also requires the investigation ofpotential misconduct and remediation of any underlying issues. It bears underscoring that risks posed by third parties, in particular, remain many companies’ most significant anti-corruption exposure. Countless examples of recent enforcement in Latin America illustrate this reality: third parties rather than company employees often pay the bribes later subjected to government investigations. Third-party management is therefore a core element of an effective compliance programme and should include risk-based due diligence, written contracts that enshrine compliance obligations and careful oversight of the third parties’ services. In the end, no compliance programme is perfect or can prevent all wrong-doing, even with the best of intentions and efforts. For most companies, the question is not whether a compliance violation one day will occur but how severe and extensive it will be, how early and by what means it will be detected, and how the company ultimately will respond. Companies and their stakeholders must accept this reality while also making judicious use of sometimes limited compliance resources, especially during times of crisis. Prosecutors also have a valuable role in helping to incentivise companies to implementand maintain effective compliance programmes. Authorities in the region can do evenmore to support the growing compliance culture, including by imposing lower penalties on companies that implement effective programmes or, better yet, by declining altogether under appropriate circumstances from penalising these companies when certain things go wrong. This is especially so when companies are plagued by isolated misconduct of a rogue employee or a small number of employees. While active enforcement undoubtedly breeds greater efforts to comply, enforcement decisions that respect such genuine compliance efforts arguably can do so even more."

Chapter 13: A team from QIL+4 Abogados – José Quiñones, Evelyn Rebuli, IgnacioGrazioso, Javier Castellan and Luis Pedro Martínez – addresses the timely question of whether it is worthwhile to obtain an ethics certification. As the authors explain, a certification cannot guarantee that any particular conduct will or will not occur, but can validate the implementation of systems, policies and controls that seek to encourage or discourage such behaviours. The authors also review different types of certifications, the process for obtaining them and potential benefits.