Compliance Programs:
3. The organization must have used due care not to delegate substantial discretionary authority to individuals whom the organization knew, or should have known through the exercise of due diligence, had a propensity to engage in illegal activities.
4. The organization must have taken steps to communicate effectively its standards and procedures to all employees and other agents, for example, by requiring participation in training programs or by disseminating publications that explain in a practical manner what is required.
5. The organization must have taken reasonable steps to achieve compliance with its standards, for example, by utilizing monitoring and auditing systems reasonably designed to detect criminal conduct by its employees and other agents and by having in place and publicizing
a reporting system whereby employees and other agents could report criminal conduct by others within the organization without fear of retribution.
6. The standards must have been consistently enforced through appropriate disciplinary mechanisms, including, as appropriate, discipline of individuals responsible for the failure to detect an offense. Adequate discipline of individuals responsible for an offense is a necessary component of enforcement; however, the form of discipline that will be appropriate will be case specific.
7. After an offense has been detected, the organization must have taken all reasonable steps to respond appropriately to the offense and to prevent further similar offenses, including any necessary modifications to its program to prevent and detect violations of law.
