In our introductory chapter we identified a worldwide trend towards a “due diligence” model of corporate liability: corporations are now, not only held liable for the misdeeds of their most senior corporate officers; offenses committed by more junior employees or agents may also be imputed to them – if those offenses were the expression of high-level mismanagement. We observed this development in the conditions and defenses to CCL, as well as in national corporate prosecution and sanctioning guidelines.

“Due diligence” thinking and the related concepts of corporate culture and (dis)organization are also emerging as international standards. The Organization for Economic Cooperation and Development’s Working Group on Bribery in International Business Transactions has recently enacted a “Good Practice Guidance” on corruption.Footnote 1 It foresees the following option as an alternative to strict vicarious liability and liability triggered by the misconduct of senior corporate decision-makers:

A person with the highest level managerial authority fails to prevent a lower level person from bribing a foreign public official, including through a failure to supervise him or her or through a failure to implement adequate internal controls, ethics, and compliance programs or measures.Footnote 2

The broad notion of corporate fault is intimately linked to the OECD’s “Good Practice Guidance on Internal Controls, Ethics, and Compliance”.Footnote 3 It clarifies what adequate internal controls, ethics, and compliance mean, in particular, in preventing and responding to corruption at the level of the individual corporation. The guidance contains three pages of details that have emerged from the practice of the United States Department of Justice in applying the federal guidelines on sentencing and corporate prosecutions, as well as in the cases pursued and decided by the US Security and Exchange Commission. The text also reflects the international standards elaborated by the International Chamber of Commerce and other private bodies active in this area, such as the World Economic Forum and Transparency International.

Although state parties to the Convention on Combating Bribery of Foreign Public Officials in International Business Transactions are the primary addressees of the Good Practice Guidance, corporations around the world have reason to heed the “due diligence” message in relation to all sorts of corporate risk. This new notion of corporate fault is apparent in international responses to other economic crimesFootnote 4 and to other types of “corporate” risk altogether.Footnote 5 Moreover, compliance systems also obviously touch on corporate involvement in illegal trusts, environmental hazards, illegal or unsafe employment practices, and breaches of embargos and export restrictions.

But, if notions of “corporate social responsibility”, corporate criminal liability, and corporate compliance are increasingly generic, the duties and risk profiles of particular corporate actors are not. In practice, the nature of a corporation’s activities and “culture”, in conjunction with its susceptibility to regulation by different states, determines which crimes it could commit and how, and the preventative measures it should take. So, whilst regional banks may concentrate on preventing money laundering and participation in the financing of terrorism, international chemical companies and mining conglomerates need to focus on protecting the environment and the health and safety of their employees and host communities in any one of a number of jurisdictions.

According to the emerging liability model, there is a direct link between risk and compliance system, and between compliance system and CCL. To “keep out of trouble”, in effect, every company has to define its particular regulatory risk profile and determine its tailor-made compliance system to meet the needs it has identified.