On September 23, 2024, the U.S. Department of Justice (DOJ) Criminal Division released an updated version of its Evaluation of Corporate Compliance Programs (ECCP) guidance. DOJ first published the ECCP in 2017 to provide clear guidance on which factors federal prosecutors will consider when evaluating the strength of a corporation’s compliance programs in the context of an investigation or enforcement action. The ECCP instructs prosecutors on how to evaluate a company’s risk assessment mechanisms, to ensure that the company’s policies and procedures are responsive to the risks that it has identified and communicate those risks, and the established risk mitigations, to the corporation’s stakeholders, such as employees and vendors. The ECCP is a critical resource that companies should consider when developing compliance programs to avoid penalties associated with DOJ enforcement action.