KPMG Deferred Prosecution Agreement -- Part II

The KPMG Deferred Prosecution Agreement (DPA) also has a section devoted entirely to what it calls “The Compliance and Ethics Program.”  Note that “compliance and ethics program” is the same phrase used by the United States Sentencing Guidelines for organizations.  This section of the DPA provides as follows:

16.    In addition to the remedial actions that KPMG has taken to date, KPMG shall implement and maintain an effective compliance and ethics program that fully comports with the criteria set forth in Section 8B2.1 of the United States Sentencing Guidelines (the “Compliance and Ethics Program”).  As part of the Compliance and Ethics Program, KPMG shall maintain a permanent compliance office and a permanent educational and training program relating to the laws and ethics governing the work of KPMG’s partners and employees, paying particular attention to practice areas that pose high risks, including the determination whether transactions in which KPMG and its clients are involved constitute “reportable transactions” within the meaning of 26 C.F.R. section 1,6011-4(b), and the determination of whether the appropriate level for opinions and advice set forth in paragraph 6(I) of this Agreement and all applicable laws have been satisfied.  KPMG agrees that all KPMG professionals and any employees of KPMG shall receive appropriate training pursuant to the Compliance and Ethics Program within one year of execution of this Agreement, and shall be given such training on a regular basis but in any event no less than annually for the tax practice and no less than every two years for other practices at KPMG.  Also as part of the Compliance & Ethics Program, KPMG shall (I) ensure that an effective program be maintained to punish violators of laws, policies, and standards, and reward those who report such violators; (II) ensure that no partner, employee, agent, or consultant of KPMG is penalized in any way for providing information relating to KPMG’s compliance or noncompliance with law, policies, and standards to any KPMG official, government agency, compliance officer, or the Monitor appointed pursuant to paragraph 18; and (III) ensure that all KPMG partners and employees have access to a hot-line or other means to provide information to KPMG’s compliance office relating to KPMG’s compliance or noncompliance with laws, policies, and standards.  KPMG shall take steps to audit the Compliance and Ethics Program to ensure it is carrying out the duties and responsibilities set out in this Agreement.

17.    KPMG shall take such reasonable additional personnel actions for wrongdoing as are warranted.

A few observations here.

1.  Note that the DOJ requires that the “compliance and ethics program” must “fully comport[]” with the sentencing guidelines.  This is powerful proof that the sentencing guidelines are the current gold standard for compliance program criteria.

2.  Also, the DPA shows once again that compliance can either be on an organization’s own terms and timeline, or (if a legal violation intervenes) at the government’s direction.

3.    The DPA not only specifies types of compliance measures, but also requires (in a separate section) that an independent monitor review KPMG’s progress in implementing and complying with the DPA.  So, not only might the government tell you how to design and implement a compliance program, you might have to do so under the watchful eye of a monitor, who will then tell the whole world.

4.  By directing that KPMG “pay[] particular attention to practice areas that pose high risks,” the DPA effectively requires KPMG to conduct a thorough enterprise-wide risk assessment. 

5.  The DPA’s required compliance and ethics program appears to apply to all risks throughout the organization.  So, wrongdoing in one part of the organization involving one risk could lead to government oversight of the entire organization’s compliance and ethics program.

In the end, the scope and terms of each DPA are tailored to the precise wrongdoing and culpability of each organization.  So, one cannot draw universal lessons from and individual DPA.  That said, the above agreement certainly outlines some sobering possibilities for organizations that find themselves in hot legal water.