by: Bruce A. Ortwine, Class of 1981
Many large law firms offer highly specialized practice areas dealing with various compliance requirements in specific and discrete areas of the law, including tax, securities, anti-trust and, lately, anti-corruption. In recent years, in-house counsel have been required to respond to rapidly increasing legal and regulatory burdens imposed on their organizations and by necessity have become experts in a more generalized universe of compliance-related requirements. By developing and sustaining a comprehensive program of legal and ethical compliance standards, they can better ensure that their organizations will satisfy their obligations to comply with all applicable laws and regulations; they also provide a viable defense to an organization if a rogue employee fails to comply. The in-house counsel’s efforts as “compliance generalist” in all areas of the law that affect his or her organization are vital to the organization’s success, as much so as any other legal practice area, and they constitute an area of the legal practice that is and should be formally recognized and appreciated as such.
Recent events have required attorneys to focus a greater portion of their practice on compliance with increasingly complex, comprehensive laws. Sometimes enacted with undue haste in reaction to adverse events, many such laws take the form of so-called “enabling legislation,” in which the Congress essentially directs one or more relevant agencies of the executive branch to enact comprehensive, often confusing and even contradictory regulations. Examples over the past 10 years include the USA Patriot Act of 2001, the Sarbanes Oxley Act of 2002 and, in 2010, the so-called “Obama Care” Healthcare Reform and the Dodd-Frank Act.
The implementation of these and other acts have resulted in increasingly aggressive governmentally directed civil proceedings and criminal prosecutions arising out of alleged noncompliance with any of the array of requirements these acts impose.
Given the increasing importance of enabling legislation in the U.S., including the ever-increasing expansion of regulatory requirements and other statutes imposing civil and/or criminal penalties and the increasingly aggressive use of governmentally brought civil proceedings and criminal prosecutions alleging noncompliance with specific and sometimes obscure legal and regulatory requirements, few legal practice areas in the commercial realm are more relevant to both organizations and their employees than compliance.
Challenges to the In-house Attorney
Compliance with the current legal and regulatory framework is a requisite for today’s in-house counsel to avoid the severe reputational and financial risks that might otherwise result. For the in-house counsel, the scope of compliance-related concerns cannot be limited to only those laws that directly affect his or her organization’s business activities. Rather, an entire universe of laws — federal, state and local —impacts the organization and must be complied with. For this reason, the compliance-related knowledge of the in-house counsel cannot be specialized, as is the case with the law firm “compliance specialist,” but rather must be more generalized and encompass the entire scope of legal risks that face his or her organization.
An in-house counsel practicing legal and regulatory compliance must incorporate many facets of the practice of law into his or her efforts as compliance generalist. He or she must thoroughly research, analyze and accurately interpret the complex, sometimes confusing, and at times inconsistent provisions of both the laws and regulations that apply to his or her organization, as well as the sometimes-unanticipated interpretations of the law and regulations, either by a regulatory agency established as a part of the underlying statute or by a prosecuting attorney. He or she must then counsel the organizational client on these requirements and how the organization should comply with them. These are all traditional aspects of the practice of law.
This requires the in-house attorney to ask the question: What is the universe of laws and regulations that apply or potentially apply to the organization? He or she must then expand the universe as necessary to factor in the interpretation of seemingly inapplicable laws and regulations by the regulatory agencies charged with their interpretation and enforcement or by prosecuting attorneys who have creatively applied the wording of a criminal statute to a situation that might not have been reasonably expected.
Successfully interpreting and reconciling the laws, the regulations and the regulatory agency or criminal prosecutor interpretation or “spin” of the laws and regulations can tax even the most capable of attorneys. To do so, the in-house counsel must employ such traditional legal techniques as legal research and analysis and must effectively counsel his or her client on how to conduct its business affairs in such a way that can both facilitate its business objectives and avoid potential civil or even criminal punishment and resulting reputational and financial loss. In many respects, therefore, an increasingly important component of the in-house counsel’s job description is to keep his or her corporate client “out of trouble.”
Compliance Generalist versus Compliance Officer
It is important to distinguish the role and functioning of an attorney engaged in the legal practice as compliance generalist versus that of the so-called compliance officer. The attorney engaged in legal and regulatory compliance researches and analyzes the relevant legal and regulatory requirements. He or she then applies those requirements to his or her client by developing the overall framework of a program that contains the necessary components to ensure to the extent possible both compliance with the legal and regulatory requirements and ethical behavior and conduct by the organization, its employees and agents. This is generally referred to as a “compliance and ethics program” or “compliance program.” Once established, the compliance program is carried out on a day-to-day basis by the compliance officer. The specific components of the compliance program will depend on the particular laws and resulting regulations that must be complied with.
In essence, within an organization, the in-house counsel is the architect of the company’s compliance program; he or she determines the relevant legal and regulatory requirements, prioritizes their potential impact on the organization and then designs a compliance program intended to comply with those requirements in a manner that both satisfies the legal and regulatory requirements and ethical standards while at the same time being least disruptive to the business activities and objectives of the organization.
The compliance officer, on the other hand, is the actual builder who constructs the specifics of the compliance program that the in-house counsel has designed. In turn, the in-house counsel is charged with additional responsibilities to help ensure the success of the compliance officer’s efforts. These include ensuring that the compliance officer remains independent of senior management (i.e., senior management is not able to impede or adversely affect or influence the activities of the compliance officer) and that the compliance officer has adequate resources to be able to fulfill his or her responsibilities (i.e., senior management allocates sufficient financial and human resources to the compliance officer’s compliance function).
The “compliance partnership” between the in-house counsel and the compliance officer is critical in successfully achieving an organization’s compliance objectives. A key element of this partnership is maintaining a strict separation between the very different roles of the two partners, so that their respective roles do not become confused.
Compliance and Attorney-Client Privilege
Nowhere is the distinction between the in-house compliance generalist and the compliance officer more important than in the realm of attorney-client privilege, which enables the in-house counsel to receive information from the corporate client without being under a legal obligation to disclose it to the legal authorities. Since the privilege belongs to the client and not the attorney, it is the client’s privilege to waive and not the attorney’s.
Within an organization, communications between the in-house counsel and management may be subject to the attorney-client privilege, depending on such factors as the nature of the communication (legal advice versus business advice) and whether the interests of the particular manager are aligned with those of the organization (after all, the in-house counsel’s client is the organization and not its management).
The attorney-client privilege is important in many respects, including maintaining the in-house counsel’s role as a “trusted advisor,” with whom communications can be had in a confidential and privileged manner.
By contrast, however, no privilege attaches to any communications with a compliance officer, even if the compliance officer happens to be an attorney. That is because the compliance officer’s function is not that of an attorney providing legal advice but, rather, to implement and enforce the components of the organization’s compliance program and to monitor, investigate, uncover and report (to the in-house attorney, in which case the communication is privileged) any potential wrong-doing.
In sum, the attorney’s responsibility is to inform the organization what it must do to comply with applicable legal requirements; it is not to test, monitor or audit actual policies, procedures or practices to determine whether the organization is complying with the legal and regulatory requirements.
Legal and regulatory compliance requirements have grown significantly in recent years and the trend will no doubt continue. More high-profile criminal prosecutions brought under the proliferation of enabling legislation and various criminal laws are a safe prediction for those organizations that do not have effective compliance programs. The legal expertise of the in-house counsel, supplemented by the operational expertise of the compliance officer, will determine the contents and effectiveness of an organization’s compliance program. For these reasons, fully understanding the universe of legal and regulatory compliance requirements as compliance generalist have become and will continue to be an ever more essential practice area for the in-house counsel and should be formally recognized and appreciated as such.