Johnson & Johnson's "Enhanced Compliance Obligations"

Last month, Johnson & Johnson (J&J) settled an FCPA enforcement action focused on voluntary disclosed conduct in Greece, Poland, Romania involving various health care providers. See here for the prior post. [The enforcement action also involved conduct in connection with the U.N. Oil for Food Program in Iraq - conduct that was not voluntarily disclosed].

The enforcement action was resolved via a deferred prosecution agreement (DPA) and in the DPA (here) the DOJ specifically states as follows: "J&J had a pre-existing compliance and ethics program that was effective and the majority of problematic operations globally resulted from insufficient implementation of the J&J compliance and ethics program in acquired companies." (emphasis added).

The J&J enforcement action is thus a rare instance of the DOJ finding a company's pre-existing compliance and ethics program "effective" notwithstanding the fact that conduct allegedly violating the FCPA took place within the overall organization.

The J&J DPA contains the standard compliance metrics found in typical DPAs and non-prosecution agreements (Attachment C of the J&J DPA) that the company must abide by during the three year term of the DPA.

However, the DPA also contains (see Attachment D) "Enhanced Compliance Obligations" that J&J must abide by during the term of the DPA. These "enhanced compliance obligations" are unusual and surprising given the DOJ's conclusion that J&J already generally had "effective" policies and procedures.

Even though the DPA states that J&J, as part of the voluntary disclosure and cooperation process, "conducted an extensive, global review of all of its operations to determine if there were problems elsewhere and [...] reported on any area of concerns to the Department and the SEC," the "enhanced compliance obligations" nevertheless require J&J to "conduct risk assessments of markets where J&J has government customers and/or other anticorruption compliance risks on a staggered, periodic basis."

In what seems like a "full employment act" for some, the DPA requires J&J to "identify no less than five operating companies that are high risk for corruption because of their sector and location and [...] conduct FCPA Audits of those operating companies at least once every three years." According to the DPA, "FCPA Audits of other operating companies that pose corruption risk shall occur no less than once every five years."

Pursuant to the DPA, "each FCPA Audit shall include" the following.

"a. On-site visits by an audit team comprised of qualified auditors who have received FCPA and anticorruption training;

b. Where appropriate, participation in the on-site visits by personnel from the compliance and legal functions;

c. Review of a statistically representative sample appropriately adjusted for the risks of the market, of contracts with and payments to individual health care providers;

d. Creation of action plans resulting from issues identified during audits; these action plans will be shared with appropriate senior management, including the Chief Compliance Officer, and will contain mandatory undertakings designed to enhance anticorruption compliance, repair process weaknesses, and deter violations; and

e. Where appropriate, feasible, and permissible under local law, review of the books and records of distributors which, in the view of the audit team, may present corruption risk."

Such "enhanced compliance obligations" seem wholly inappropriate given the DOJ's conclusion that J&J already had "effective" compliance policies and procedures and given that J&J, prior to resolving the enforcement action, already "conducted an extensive, global review of all of its operations to determine if there were problems elsewhere...".

Remediation and effective compliance policies and procedures are good.

But if the "enhanced compliance obligations" found in the J&J DPA are a new norm, how long will corporate defendants tolerate being required by the government (under the risk of prosecution for failure to do so) to engage in fishing expeditions (when the company already went fishing) just for the sake of going fishing again?