DOJ Evaluation of Corporate Compliance Programs Checklist: How to Assess Whether Your Program Works

The U.S. Department of Justice’s Evaluation of Corporate Compliance Programs, commonly called the ECCP, gives organizations a practical framework for identifying these weaknesses.

The DOJ Criminal Division uses the ECCP when evaluating corporate compliance programs during investigations, charging decisions, and resolutions. The current guidance was updated in September 2024 and remains listed by the DOJ as its operative Criminal Division guidance.

The guidance is organized around three fundamental questions:

1. Is the corporation’s compliance program well designed?
2. Is the program applied earnestly and in good faith, with enough authority and resources to function effectively?
3. Does the compliance program work in practice?

The DOJ makes clear that its questions are not a rigid formula. Program effectiveness must be assessed in the context of the organization’s size, industry, geographic presence, regulatory requirements, business model, and risk profile.

The checklist below converts the DOJ’s evaluation topics into a practical internal assessment. It is not an official DOJ checklist and should not be treated as a predictor of an enforcement decision. It is a structured way for compliance teams to identify gaps, document evidence, assign corrective actions, and prepare for executive, board, auditor, or regulator review.

Why the DOJ compliance program evaluation matters

A written compliance program does not, by itself, protect an organization from liability. The Justice Manual states that the existence of a program is not enough to justify declining prosecution when employees, officers, directors, or agents engage in misconduct.

However, the adequacy and effectiveness of the program can affect:

• Whether the organization is charged
• The form and terms of a resolution
• The monetary penalty
• Whether an independent compliance monitor is required
• The compliance obligations imposed through a resolution

Prosecutors assess the program both at the time misconduct occurred and at the time of the charging decision or resolution. They may consider the extent of the misconduct, who was involved, how long it continued, how it was detected, what disciplinary measures followed, and how the organization changed its program after learning what went wrong.

This creates an important distinction for compliance professionals: having controls is not the same as demonstrating that the controls operate effectively.

An organization should be able to produce evidence showing:

• Why each major compliance control exists
• Which risk the control addresses
• Who owns and performs the control
• Whether it is tested
• What exceptions have been identified
• How failures are escalated
• Whether corrective actions were completed
• Whether the control changed after incidents or lessons learned

A DOJ-aligned assessment should therefore look beyond policy documents and ask whether the organization can prove that its compliance program affects day-to-day decisions.

Question 1: Is the compliance program well designed?

The first part of the DOJ framework examines whether the program is structured around the organization’s actual risks.

A well-designed program should not apply the same level of attention to every activity. It should identify the areas where misconduct is most likely or could cause the greatest harm and apply greater oversight, controls, training, and monitoring to those areas.

1. Risk assessment

Risk assessment is the starting point of the DOJ evaluation.

The organization should have a documented method for identifying, analyzing, prioritizing, and responding to compliance risks. The assessment should consider factors such as business locations, regulatory exposure, customers, transactions, government interactions, third parties, gifts, donations, payments, and emerging technologies.

The DOJ also looks at whether the company updates its risk assessment based on operational information rather than treating it as an annual snapshot. Risk findings should affect policy design, resource allocation, training, monitoring, and controls.

A mature risk assessment process should answer:

• What are our highest compliance risks?
• What data supports that conclusion?
• What controls address each risk?
• Which risks have changed since the last assessment?
• What incidents, audit findings, or external events affected our assessment?
• Are resources concentrated on the areas of greatest exposure?

2. Emerging technology and artificial intelligence

The current ECCP explicitly asks how organizations identify and manage risks created by new technologies, including artificial intelligence.

The DOJ’s questions address both the use of AI in business operations and its use inside the compliance program. Organizations should consider unintended consequences, deliberate misuse, reliability, legal compliance, human oversight, employee training, intended-use controls, and accountability.

A compliance team should therefore know:

• Where AI systems are being used
• What decisions those systems influence
• Who approved each use case
• What data the system receives
• Whether outputs are reviewed by people
• How accuracy and reliability are tested
• What prohibited uses are defined
• How suspected misuse is reported and investigated

An AI policy alone is not sufficient. The organization should be able to show that AI use cases are inventoried, assessed, approved, monitored, and periodically reviewed.

3. Policies and procedures

Policies should translate risk assessments and legal requirements into clear operational expectations.

The DOJ examines how policies are designed, approved, updated, communicated, and integrated into business processes. Policies should be searchable, accessible, understandable, and available in appropriate languages. The organization should also be able to confirm that employees know where to find them.

Key gatekeepers, such as managers with approval authority, procurement teams, finance personnel, and control owners, should receive clear guidance on what warning signs to identify and when to escalate concerns.

A strong policy process includes:

• Assigned policy owners
• Defined review dates
• Legal and operational review
• Formal approval workflows
• Version history
• Employee distribution
• Attestations where appropriate
• Exception handling
• Records of superseded policies
• Evidence that policies are embedded in controls

4. Training and communications

The DOJ expects training to be tailored to the employee’s responsibilities and risk exposure.

General annual training may be appropriate for broad awareness, but higher-risk roles should receive more specific instruction. Training should use practical scenarios, prior incidents, common warning signs, and clear escalation guidance.

Organizations should evaluate whether employees understood the training, not simply whether they completed it. This may include knowledge checks, targeted assessments, employee surveys, reporting trends, manager feedback, and analysis of recurring policy violations.

Effective compliance training should answer three questions for employees:

1. What conduct is expected?
2. What warning signs should I recognize?
3. Where should I go when I need guidance or want to report a concern?

5. Confidential reporting and investigations

Employees and relevant third parties should have access to confidential or anonymous reporting mechanisms.

The DOJ evaluates whether employees know about the reporting system, trust it, use it, and feel protected against retaliation. It also asks whether the company encourages reporting or uses practices that discourage employees from raising concerns.

The organization should train employees on internal reporting systems, anti-retaliation requirements, and relevant external whistleblower programs. Reports should be routed to qualified personnel, investigated objectively, tracked to completion, and analyzed for recurring issues.

A hotline that receives no reports should not automatically be considered successful. It may indicate low misconduct, but it may also indicate poor awareness, fear of retaliation, or lack of trust.

6. Third-party management

A well-designed program applies risk-based due diligence throughout the third-party relationship.

The DOJ looks at whether the organization understands why a third party is needed, what services it will perform, whether compensation is reasonable, whether the work is actually performed, and what risks the relationship creates.

Third-party risk management should not end after onboarding. Organizations should use ongoing monitoring, updated due diligence, certifications, training, audits, contract controls, and red-flag tracking based on the risk involved.

When a vendor fails due diligence or is terminated for compliance reasons, the organization should maintain records to prevent that vendor from being reintroduced through another department or subsidiary.

7. Mergers and acquisitions

Compliance should be involved before and after acquisitions.

Pre-acquisition due diligence may identify legal exposure, control weaknesses, third-party risks, cultural concerns, or records that require closer review. When full due diligence cannot be completed before closing, the organization should document the limitation and establish a timely post-closing review.

The acquired company should be integrated into the organization’s policies, training, reporting channels, controls, risk assessments, and monitoring processes. Identified gaps should have owners, deadlines, escalation paths, and documented closure.

Question 2: Is the program applied earnestly and in good faith?

A program may be well designed but ineffective because it lacks authority, resources, management support, or consistent enforcement.

The second DOJ question examines whether compliance is genuinely empowered.

8. Management commitment and oversight

Senior leaders and middle managers influence whether employees treat compliance requirements as real operating expectations or administrative exercises.

The DOJ looks at leadership conduct, not only formal statements. Leaders should model ethical behavior, support remediation, give compliance a voice in business decisions, and maintain their commitment when commercial objectives create pressure.

Boards should have access to appropriate compliance expertise and receive useful information about risks, investigations, findings, trends, resources, and corrective actions. Private sessions between the board or audit committee and compliance leaders can also support independent oversight.

Evidence of commitment may include:

• Business decisions changed after compliance review
• Transactions paused or rejected because of unresolved risk
• Leaders held accountable for control failures
• Compliance metrics included in management reviews
• Board minutes reflecting meaningful compliance discussion
• Resources approved in response to identified exposure

9. Autonomy, authority, and resources

The compliance function needs enough authority, experience, funding, technology, staff, and data access to perform its responsibilities.

The DOJ may compare compliance with other strategic functions in areas such as seniority, compensation, reporting lines, access to leadership, staffing, technology, and influence. It also asks whether compliance has direct or indirect access to data needed for monitoring and testing.

The current guidance specifically asks whether there is an imbalance between the resources used to identify commercial opportunities and those used to identify and reduce compliance risks.

Organizations should examine whether compliance can:

• Access relevant operational and transactional data
• Conduct timely monitoring
• Test controls and transactions
• Analyze trends across business units
• Escalate issues without management interference
• Meet privately with the board or audit committee
• Hire or access people with appropriate experience
• Obtain funding based on the organization’s risk profile

Compliance responsibility without access, authority, or funding is not effective empowerment.

10. Incentives and disciplinary measures

Organizations communicate their priorities through compensation, promotion, recognition, and discipline.

The DOJ assesses whether consequences are clearly defined, applied consistently, and proportionate to the violation. It may also consider whether the organization tracks disciplinary outcomes to identify inconsistent treatment across business units, regions, job levels, or employee groups.

Positive incentives matter as well. Ethical leadership, timely escalation, control ownership, and meaningful compliance contributions can be reflected in performance reviews, promotions, bonuses, and recognition programs.

The organization should be able to explain:

• Who participates in disciplinary decisions
• How similar cases are compared
• Whether managers are held accountable for supervision failures
• Whether senior employees receive different treatment
• Whether compensation can be reduced or recovered after misconduct
• Whether compliance performance affects advancement or rewards

Question 3: Does the compliance program work in practice?

The final question tests actual performance.

No compliance program can prevent every instance of misconduct. The DOJ recognizes that detecting misconduct, investigating it, remediating it, and considering self-reporting can show that a program is operating effectively.

The organization should demonstrate that its program changes over time and uses data, incidents, testing, and lessons learned to improve.

11. Continuous improvement, testing, and data

Controls should be monitored and tested rather than assumed to work.

Testing may include:

• Control testing
• Transaction monitoring
• Policy-access data
• Hotline trend analysis
• Employee surveys
• Training assessments
• Third-party reviews
• Internal audits
• Corrective-action validation
• Compliance culture assessments

The organization should identify what the data shows, who reviews it, what thresholds require escalation, and what decisions have resulted from the analysis.

Metrics should not be limited to activity counts such as policies published or training completed. They should help determine whether compliance risks are being detected, reduced, and resolved.

12. Business communications and personal devices

The DOJ also examines policies governing business communications, personal devices, messaging platforms, and ephemeral messaging applications.

Organizations should understand which channels employees use, how business records are preserved, what settings are permitted, how bring-your-own-device programs are controlled, and whether the company can access relevant communications when investigating misconduct.

Policies should reflect the organization’s legal obligations, privacy requirements, business needs, and risk profile. They should also be communicated and consistently enforced.

13. Investigation and remediation

An effective investigation process should be timely, independent, appropriately scoped, properly documented, and led by qualified personnel.

Findings should be used to identify:

• Root causes
• Failed controls
• Management or supervision gaps
• Similar exposure in other departments
• Weaknesses in payment processes
• Vendor-related issues
• Prior missed warning signs
• Required policy or training changes

The DOJ focuses on whether the organization addressed the underlying cause rather than simply closing the individual case. Remediation should include specific actions designed to reduce the risk of recurrence, along with owners, deadlines, evidence, validation, and accountability.

Frequently Asked Questions (FAQs)

1. What is the DOJ Evaluation of Corporate Compliance Programs?

It is guidance used by the U.S. Department of Justice to assess the design, implementation, and effectiveness of a company’s compliance program during investigations and corporate resolutions.

2. What are the three main DOJ evaluation questions?

The DOJ considers whether the compliance program is well designed, whether it is supported with sufficient authority and resources, and whether it works effectively in practice.

3. Is the DOJ checklist mandatory?

No. It is not a certification standard or fixed legal checklist. The DOJ evaluates each organization based on its size, industry, operations, geographic presence, regulatory exposure, and risk profile.

4. How often should the assessment be completed?

A full assessment should generally be completed annually and after major incidents, acquisitions, regulatory changes, business expansion, control failures, or the introduction of new technologies.

5. What evidence should support the assessment?

Evidence may include risk assessments, policies, approval records, training results, attestations, control tests, investigation records, third-party reviews, board reports, corrective actions, and monitoring data.

6. Does having a compliance program prevent prosecution?

No. The existence of a program alone does not prevent prosecution. However, its quality and effectiveness may influence charging decisions, penalties, resolution terms, and monitoring requirements.

7. How does the DOJ evaluate third-party risk management?

The DOJ examines whether third parties are properly selected, risk-assessed, monitored, contractually controlled, and reviewed throughout the relationship, not only during onboarding.

8. What should happen after a weakness is identified?

The organization should document the gap, assign an owner, define corrective actions and deadlines, collect supporting evidence, escalate delays, and validate that the issue is resolved before closure.