What does the DOJ expect of compliance training in a corporate compliance program?

The DOJ's expectations come from prosecutorial guidance, not from a statute that mandates training. For readers outside the United States: the DOJ is the federal prosecutor. When it investigates a company, its prosecutors follow the Justice Manual, whose Principles of Federal Prosecution of Business Organizations (JM 9-28.000) list factors for deciding whether to charge a company and how to resolve a case. One factor is the adequacy and effectiveness of the company's compliance program at the time of the offense and at the time of the charging decision.

The Criminal Division's Evaluation of Corporate Compliance Programs (ECCP) turns that factor into sample questions. It says it assists prosecutors in deciding the form of any resolution, the monetary penalty, and compliance obligations such as a monitorship or reporting. The ECCP also points to the United States Sentencing Guidelines, which consider whether a company had an effective compliance program when calculating an organizational criminal fine (U.S.S.G. sections 8B2.1, 8C2.5(f) and 8C2.8(11)).

As at September 2026, the DOJ's Criminal Division compliance page lists the September 2024 ECCP as the current version. The ECCP is explicit that its topics "form neither a checklist nor a formula" and that each company is assessed on its own size, industry, geographic footprint and risk profile.

The ECCP organizes its questions around three fundamental questions taken from the Justice Manual (JM 9-28.800). Training appears most directly under the first, but evidence about training also answers the second and third.

The ECCP calls "appropriately tailored training and communications" a hallmark of a well-designed program. Prosecutors assess whether policies have been integrated into the organization through periodic training and certification for all directors, officers, relevant employees and, where appropriate, agents and business partners.

The section then sets out four groups of sample questions. They are worth reading in full, but their substance is summarized below.

• Risk-based training. What training have employees in control functions received? Is there tailored training for high-risk and control employees, including on the risks where misconduct occurred? Do supervisors get different or supplementary training? What analysis decided who is trained on what?
• Form, content and effectiveness. Is training offered in the form and language suited to the audience? Is it online, in person or both, and why? Does it address lessons learned from the company's own incidents and from other companies in the same industry or region? Can employees ask questions? How is effectiveness measured, how are employees who fail testing handled, and has training affected behavior or operations?
• Communications about misconduct. What has senior management done to tell employees the company's position on misconduct, including anonymized descriptions of conduct that led to discipline?
• Availability of guidance. What resources help employees with compliance questions, and how does the company know employees would seek advice?

Elsewhere in the ECCP, training questions appear for gatekeepers (people with approval or certification authority: do they know what misconduct to look for and when to escalate?) and for policy accessibility, including whether the company tracks which policies employees actually open.

The September 2024 update added training expectations in two areas: emerging technology and speaking up. Both are now standard questions a prosecutor may ask.

On technology, the risk assessment section asks how the company assesses the impact of new technologies such as artificial intelligence (AI) on its ability to comply with criminal laws, how it governs AI in its business and its compliance program, and directly: "How does the company train its employees on the use of emerging technologies such as AI?" The testing section asks whether the company monitors AI it uses so it can detect and correct decisions inconsistent with its code of conduct.

On speaking up, the confidential reporting section asks whether the company trains employees on both internal anti-retaliation policies and external anti-retaliation and whistleblower protection laws, and on internal reporting systems as well as external whistleblower programs and regulatory regimes. The ECCP also asks whether lessons learned from other companies in the same industry or region feed into training.

The 2025 and 2026 policy changes left the ECCP in place and raised the value of having an effective program when misconduct is found. On May 12, 2025, the Head of the Criminal Division issued the memorandum Focus, Fairness, and Efficiency in the Fight Against White-Collar Crime, which tells prosecutors to set the term of a corporate resolution in light of factors including the effectiveness of the company's compliance program at the time of resolution, and announced a new monitor selection memorandum. That memorandum says independent compliance monitors should be imposed only when necessary, for example when a company cannot be expected to implement an effective compliance program.

In March 2026 the DOJ published a Department-wide Corporate Enforcement and Voluntary Self-Disclosure Policy (CEP), listed on the Criminal Division's corporate enforcement page. It applies to all corporate criminal matters handled by the Department except antitrust violations under 15 U.S.C. sections 1 to 38. To receive credit for timely and appropriate remediation, a company must, among other things, have implemented an effective compliance and ethics program. The CEP's criteria include awareness among employees that criminal conduct will not be tolerated, a risk-tailored program, and testing of the program to assure its effectiveness.

Treat each ECCP question as an evidence requirement and decide in advance what record answers it. The table below is illustrative; it is not DOJ guidance and must be adapted to each company's risk profile.

This is the same discipline described in how to map training to compliance obligations. For methods of proving effectiveness, see how to evidence training effectiveness to a regulator and the difference between completion tracking and competency verification.

A company should be able to show, from records created at the time, that its training was designed from its risks, delivered to the right people, tested, and improved. The checklist below follows the order of the ECCP's questions.

1. A current risk assessment and a documented rationale for which roles receive which training.
2. Role-specific modules for control functions, gatekeepers, supervisors, and high-risk business units, including third parties where appropriate.
3. Training in the languages and formats employees actually use, with a recorded reason for online, in-person or blended delivery.
4. A change log linking content updates to incidents, investigations, industry cases, and regulatory changes.
5. Assessment data beyond completion: scores, failures, remediation, and retesting.
6. Measures of behavior and culture, such as speak-up survey results and use of advice channels.
7. Coverage of AI and other emerging technology use, anti-retaliation, and internal and external reporting routes.
8. Periodic reporting of training results to senior management and the board, with the actions taken.

An audit trail that ties each of these to dates and versions matters because prosecutors assess the program both at the time of the offense and at the time of the charging decision. Board reporting is covered in how to report training compliance to the board.

The ECCP applies whenever the DOJ is assessing a company's program, and that includes non-US companies whose conduct falls within US federal criminal jurisdiction. The ECCP asks specifically whether foreign subsidiaries face linguistic or other barriers to accessing policies, so global training programs are in scope.

The ECCP's questions also overlap with other regimes. Companies preparing an adequate procedures defense elsewhere, such as the Australian failure to prevent foreign bribery offense, will find much of the same evidence useful. The broader design approach is in how to design a compliance training program.

Knowledge Foundry records each compliance risk, policy and ECCP question as part of a knowledge framework, then links it to the learning outcomes and assessment points that evidence it. When an incident, policy or regulation changes, the affected training is identified from those links, and each version is kept as audit evidence.