Several jurisdictions have adopted corporate offenses of failing to prevent
misconduct by associated persons, with a defense where the organization had
adequate procedures in place.
Structure. The offense is committed where a person associated with the
organization commits the underlying conduct intending to benefit it. Corporate
intent is not required, which makes prosecution far easier than under
identification doctrines.
Associated persons defined broadly — employees, agents, subsidiaries and
service providers performing services for the organization.
The defense. That the organization had in place procedures proportionate to
its risk, designed to prevent the conduct. The burden is on the organization.
Guidance principles. Proportionate procedures; top-level commitment; risk
assessment; due diligence on associated persons; communication including
training; and monitoring and review.
Extension. These offenses have been extended in some jurisdictions beyond
bribery to tax evasion facilitation and to fraud, with the same defense
structure.
Practical consequence. The compliance program is not merely mitigation; it
is the defense. Documentation of the risk assessment and of the procedures’
operation is what establishes it, and a program that exists on paper without
evidence of operation will not.
