Four Keys to Compliance Leadership

One of the most divisive moments in American history occurred on this date in 1868. On this day the US Senate voted against impeaching President Andrew Johnson thereby acquitting him of having committed “high crimes and misdemeanors” as required under the US Constitution. After all the arguments had been presented for and against him, Johnson waited for his fate, which hung on one swing vote, as there is a Constitutional requirement that requires a vote of 2/3rds of the Senate for impeachment. The vote was one short, at 35-19. Johnson was acquitted and finished out his term. If Johnson had been impeached, it surely would have led to a very different political development in the US, where not liking the sitting President could have become a constitutional basis for impeachment.

The Radical Republicans who ran the Congress immediately after the conclusion of the Civil War certainly did not think much of President Johnson’s leadership style. So what about you as a compliance officer? Certainly part of your leadership is implementing and enhancing policies and procedures? In many ways it is the human element, which President Johnson sorely lacked, that you may well need to devote most of your time focusing on. I recently read an excellent article it the Corner Office section of the New York Times (NYT), entitled “We’re Family Yes, but We’re Still Accountable”, in which Adam Bryant reported on his interview with Brooke Denihan Barrett, the co-Chief Executive Officer (co-CEO) of the Denihan Hospitality Group (Denihan), a 50-year old family business which focuses on the hospitality business.

Training

One of the things that Barrett has learned is how to train people. She explained that “I thought the way you got things done was by telling people what to do. That’s where I learned what not to do. I spent a good portion of my time telling people what they did wrong instead of really encouraging them about what they did right.” She came to realize that was perhaps not the best way to manage people and “learned to cut people some slack.” She said that she found “that you get a lot more with the carrot routine than the stick routine. I also realized that you really needed to explain the “why” of things. You need to give people a little bit of space to come around, and say, “Yeah, that makes sense,” before you really engage them in what needed to be done.”

I found that her final point may be critical for compliance training. By explaining the why of compliance, employees can better understand what the company is trying to accomplish. So if your goal is to do business in an ethical manner, then explain this and how the company’s compliance program will help to accomplish this goal through its policies and procedures.

Accountability

One of the things that Barrett emphasized was the erroneous perception that because her company was a family business there was no accountability. She made clear that “You have to set certain standards that you want people to live up to. And if people need help, then we want to help them along the way.” However, accountability is a two-way street. Just as the employee must be held accountable, so must the company in terms of providing support to allow employees who want to do the right thing and to do their job well. Barrett said, “Sometimes organizations can fall down if they don’t also ask: How do you give people the tools they need to be successful? How do you get that person to understand what change needs to happen, and how do you help them along the way? Because people can’t always figure it out on their own, and nor should you expect them to.”

Listening

Many of the CEOs that Bryant interviews for his Corner Office section speak about the need for listening skills. Barrett was no exception. But as CEO she found that employees were sometimes reluctant to speak openly and candidly with her. So she began to meet with employees in small groups of 10 to 12 people. At Denihan they call them ‘Roundtables’. Barrett said that she will say to them ““Tell me something I don’t know.” And I’ll get comments like: “Oh, but you know everything. You’re the C.E.O.” It’s just a reminder of the perceptions that people have of the head of the company. But every time I ask that question, I learn something new.” Imagine as a compliance officer if you were to ask that question in a roundtable, what do you think you might hear back from your company’s employees?

Barrett also spoke about how to have a ‘difficult conversation’. She said that if there is a mistake made she views it as an opportunity for learning and professional growth. At Denihan, they call them ‘lessons learned conversations’ and they may occur with a group where a problem has arisen. Barrett related, “we might bring people together in a room who were involved in a project and ask: What were the things that worked? What were the things that didn’t? What could we have done differently? And we’ve had some very spirited and cathartic conversations. You have to be able to let people put something on the table without actually pointing the finger. It allows things to come out in more of a non-accusatory manner.”

Hiring and Promotion

These are two key areas in compliance that are finally beginning to receive the attention that they deserve. Barrett’s thoughts on how she views these in the context of her interviewing are instructive. She acknowledged that by the “time somebody meets me, you can assume that the skills are there. So what I interview for is fit. And I’m always very curious to know, what is it about our company that appeals to that person?” She asks specifically about culture, requesting the candidate define it and how do you think that culture is special. She also asks candidates to talk about a failure and what lessons that they learned from the experience and how they dealt with the experience. I would suggest that both of those lines of inquiries should be used when evaluating a candidate for hire or promotion.

Barrett’s interview provided some interesting insights on leadership. Moreover, her experience in professional growth has shown there are different styles and techniques that you can successfully use in your company’s compliance program. Train people on the reasons why your company is doing compliance so that they will understand how to do it. Make them accountable but also provide them with the compliance tools and support to do business the right way. If there is a problem or issue, use it as a lesson learned so that employees can profit from the experience. Lastly, make a discussion of culture a cornerstone in your hiring interview or promotion interview process.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

What is Your Compliance Strategy?

Do you have a strategy? The Houston Astros claim to have a strategy that involves being the worst team in baseball for up to the next five years and then magically they will become a winner. I suppose that having the worst record in baseball demonstrates that they are on the right path. Another three game series, another three game sweep by the visiting team, thus ending three games of some of the most pathetic baseball I have ever seen. However, even the ever-optimistic Astros manager, Bo Porter, admitted in an interview to the Houston Chronicle last week that “He has no idea if the Astros’ rebuilding plan will work.”

Now suppose you are in management, though not in the Houston Astros where you are implementing a strategy to set the all-time season record for losses, but a successful compliance program. How can you go about it? While most companies have compliance programs, they do not have a compliance strategy. To endure, a compliance strategy must address the interests of all stakeholders: investors, employees, customers, governments, NGOs, and society at large. A compliance strategy should increase shareholder value while at the same time improve the firm’s performance on environmental, social, and governance (ESG) dimensions. These concepts were recently explored in an article on sustainability in the May issue of the Harvard Business Review (HBR), article entitled “The Performance Frontier”. I found the concepts that the authors Robert G. Eccles and George Serafeim put forth, translate into the compliance arena as well.

The basic posit is that corporate investments in compliance do not necessarily require trade-offs in financial performance. Instead, if a company will focus on the issues that are the most relevant to both risk and shareholder value, a company should be able to boost both financial value and compliance performance. The authors believe that to do so, companies should focus on four areas.

1.      Identify Material Compliance Issues

While the overall list of compliance issues may be long and broad, the key is to determine the material issues to your company. In the context of sustainability, the authors suggest you can use a “Which Issues Matter Most” data map. They also phrased it in another manner by stating, “Evidence of economic impact is determined by evaluating both anecdotal reports and quantitative studies to gauge whether management (or mismanagement) of the issue will affect traditional corporate valuation parameters: revenue growth, return on capital, risk management, and management quality.” In the compliance arena, this would correspond to a risk assessment.

2.      Quantify the Relationship Between Financial and Compliance Performance

After you understand your company’s material compliance issues, assess the impact that improvements in each would have on financial performance. Compliance performance has many dimensions and depending on the company’s compliance strategy and the issue being considered, the most important dimension could be cost reduction, revenue growth, or gross margin defense. In the sustainability area, the authors state that a “host of factors complicate evaluations of the relationship between ESG and financial performance. Not the least of them are limitations on the ability to precisely measure ESG performance—a challenge that SASB and others are working to address.” However, even with this difficulty, I believe that a company can make an informed estimate of the slope of the performance-frontier curve for any pair of compliance and financial variables by determining whether each incremental improvement in compliance performance causes a corresponding positive or negative change in financial results – or has no impact.

3.      Innovate Products, Processes and Business Models

As with any strategy, it should be informed by your analysis. Once you determine the compliance issues to focus on, you should benchmark your industry peers on these issues. If your company’s performance falls short of industry benchmarks in a particular risk parameter, getting it up above par is the first priority. Within the sustainability context, the authors state that “At the very least it will mitigate your risks, since stakeholders tend to focus on industry laggards in campaigns aimed at increasing corporate ESG performance. Many improvements, such as reducing manufacturing waste, involve minor or moderate innovations that can enhance efficiency and, therefore, financial performance. Those sorts of innovations are increasingly necessary (but not sufficient) to ensure competitiveness.”

In the compliance arena, there are many resources available to you for benchmarking. The first place to start is the Department of Justice (DOJ)/Securities and Exchange Commission (SEC) Foreign Corrupt Practices Act (FCPA) Guidance released last November. The “Hallmarks of Effective Compliance Programs” set forth in the Guidance is an excellent compilation of where we are and what you need in place to go forward. I recommend this as a good a starting point to evaluate the state of an ongoing compliance regime so assess your company’s risks and use these hallmarks as a basis to move forward.

4.      Communicate the Company’s Innovations to Stakeholders

This may be one area of a typical compliance strategy that a company does not normally take into account. A company’s compliance function cannot assume that shareholders and other stakeholders will understand how its innovations have improved both compliance and financial performance – and how the two interrelate – unless such information is communicated effectively. As the authors state in the framework of sustainability “This is more than a matter of public relations; major innovations often require substantial investments whose benefits will not be seen for years to come. If a company expects shareholders to commit for the long term in order to receive those benefits, it needs to provide them with information that justifies their investments.” The authors call this “integrated reporting” and I believe that this is also true in the area of compliance.

As a communications tool, integrated reporting involves more than posting a PDF version of the Code of Conduct on a company’s website. As with almost all reporting, the most effective reporting is as much about listening as talking, and it serves as a key platform for stakeholder engagement. The authors believe that integrated reporting is a “way to establish a conversation that considers a company’s performance in a holistic way, identifies the tough trade-offs, and builds a case for innovation and the benefits it can generate. This engagement is also central to eliciting feedback on how well the company is meeting expectations, the quality of its communications, and what it can do to improve them.”

On the final point, the authors state something that I believe is often overlooked as a part of any compliance strategy. It is that “integrated reporting enhances discipline. It forces management and employees to think about both the financial and the ESG implications of their decisions and helps spur innovation as they seek to improve both kinds of performance.” The FCPA Guidance speaks to Incentives and Disciplinary Measures, which is generally considered to be both the carrot and the stick. The stick to demonstrate that there should be appropriate discipline in place and administered for any violation of the FCPA or a company’s compliance program. The carrot as the DOJ and SEC recognize that positive incentives can also drive compliant behavior. This would dovetail with the authors’ observation that integrated reporting enhances discipline.

Eccles and Serafeim discuss in their article the corporate benefits of having a sustainability strategy. I think their ideas are applicable to the compliance field and give you new ways to think about old problems. As for the Astros, maybe they could develop a winning strategy.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

In the Limelight-the Theater, Lady Gaga and Compliance

What is your favorite Canadian group? For my money it is the band Rush. My favorite Rush song is probably “Limelight”. How many times have you heard about ‘being in the limelight’? The phrase comes from the British theater where lights in the theater used quicklime. Although long since replaced, lighting in the British theater is still called ‘limes’.

I thought about Rush and their hit song when I recently read a couple of articles on leadership in the theater. I found that some of the insights in these articles could be applied in a compliance program for a multi-national company. In an article in the New York Times (NYT) Corner Office Section, entitled “First, Make Sure Your Idea Works On a Small Stage”, reporter Adam Bryant interviewed Francesca Zambello who is both the general and artistic director of the Glimmerglass Festival and the artistic director of the Washington National Opera.

Think Small

Zambello had a very interesting point that I do not consider often. She said that one of the most memorable lessons that she ever learned from a mentor was to make sure that your creative idea will work on the small stage. By this she did not mean that you cannot have a big idea or large concept. Instead “The most important thing he ever taught me was that if you don’t make sure the show is right in a small room, it will never be right in a big space, on a big stage.”

I found this comment particularly insightful in the context of the Department of Justice (DOJ)/Securities and Exchange Commission (SEC) FCPA Guidance. The FCPA Guidance makes clear that a company should design a compliance program which is appropriate for its size, markets and risks. There is no one standard and the FCPA Guidance states: “DOJ and SEC have no formulaic requirements regarding compliance programs. Rather, they employ a common-sense and pragmatic approach to evaluating compliance programs, making inquiries related to three basic questions: • Is the company’s compliance program well designed? • Is it being applied in good faith? • Does it work?”

I have seen many instances where a company will try and implement a compliance regime which is appropriate for a company many times its size. It becomes a top down exercise but as noted in the Zambello interview, it does not work well in the smaller setting because it is not assessing and managing the risks appropriate to a small company. Here a bottom up approach can be much more effective. Certainly this could be accomplished through a formal risk assessment but it may also come through talking and meeting with your internal business units or partners. Such informal assessments can provide valuable information which may work on a ‘smaller stage’ than a compliance program designed for a multi-billion, multi-national company.

Learn How to Fail

Another insight I garnered from the Zambello interview for the compliance practitioner was what she termed “You have to learn how to fail.” She believes that in any position you are in, that you are going to fail. But the real key is that “if you don’t fail, you are probably not that good.” Lastly, if you fail you have to learn to pick yourself up, “The more you get knocked down, the more you learn to pick yourself up.”

In the context of the FCPA Guidance, “DOJ and SEC understand that “no compliance program can ever prevent all criminal activity by a corporation’s employees,” and they do not hold companies to a standard of perfection. An assessment of a company’s compliance program, including its design and good faith implementation and enforcement, is an important part of the government’s assessment of whether a violation occurred, and if so, what action should be taken.” Clearly how a company handles any Foreign Corrupt Practices Act (FCPA) violation is an important key to any DOJ or SEC analysis regarding enforcement.

However, the other point for the compliance practitioner is that not everything should always go right under your compliance regime. Not every third party business representative you look at should pass muster under your process for approval. If everyone does, your process may not be robust enough. Not all of your employees do everything right all the time. If you have never disciplined an employee for a violation of your company’s Code of Conduct or compliance program, you should look to determine if this area needs to be explored as not every expense report is always correct. Lastly, if there has never been a substantial tip to your anonymous reporting line, this is an area which should also be explored. You may need to conduct more, or better, training so that employees understand that they can report incidents in confidence, without fear of retribution.

Be Courteous

Another interesting topic that Zambello discussed was the following, “I think that good manners matter a lot…Some of those are old fashioned things, but manners don’t cost anything.” Think about it – when was the last time you had a discussion of manners or even courtesy? This point is not something which is discussed much in the compliance arena but I think that courtesy is something that compliance practitioners need to be aware of when involved in a multi-national compliance program. Be sensitive to cultural norms in other countries and be respectful of them. As my very southern grandmother used to say, you are never wrong being courteous. Lastly, do not forget the cost for being courteous, nothing. But the benefits can be quite great.

From Lady Gaga to Compliance

For a different type of theater and how it relates to your compliance program, I recently came across an article in the Financial Times (FT), entitled “In need management tips? Try Lady Gagahttp://www.ft.com/intl/cms/s/2/da6559ce-a289-11e2-9b70-00144feabdc0.html#axzz2Qcpc6zzT”, by reporter Miles Johnson. (While some might suggest that Lady Gaga is a musician, I certainly think she is all about theater so it ties in with the above, really.) Johnson’s article reviews the work of Salvador Lopéz, a marketing and research professor at Spain’s ESADE business school. Lopéz believes that the world of business can learn quite a bit from the Lady Gaga’s of the world and I found that a couple of them apply to the compliance arena.

The first is that Lady Gaga generates emotions in her fans. Lopéz likened this to Steve Jobs who created “an entire style at Apple and made people feel things through his products.” Here I think that this applies to compliance because most employees want to do the right thing and will feel better about themselves if they conduct business in an ethical manner. The key for the compliance professional is not only to provide the processes and procedures for them to do so but to also acknowledge those employees who follow a company’s ethical business values. This can occur through financial incentives such as part of an employee’s discretionary bonus awards; promotion of employees who conduct business in accord with a company’s ethical practices or even something as simple as a companywide acknowledgement. The point is to make people feel that something positive for doing compliance the right way.

The second point that Lopéz gleans from performance artists like Lady Gaga is that they are much better in the use of technology than most companies. There are now a plethora of technological tools available to assist the compliance practitioner. I firmly believe that the DOJ and SEC have communicated that transaction monitoring will become a standard best practice quite soon, but certainly within the next 18 months. There are companies, such as Oversight Systems to name but one, which have technological tools to help move to this standard. But that is only one of many tools available to assist in your compliance program. So take a clue from Lady Gaga and ‘keep it fresh’.

These two articles demonstrate that the compliance practitioner can draw from a wide variety of sources and disciplines for inspiration to incorporate into a FCPA or UK Bribery Act compliance program. Further, the tools are out there to help you. I hope that this article has given you some ideas while drumming your fingers along to Rush or Lady Gaga for that matter.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

How To Demonstrate Ethics and Compliance – Earn It, Re-Earn It and Re-Evaluate It

What should your company do if it finds itself in a situation where some of its senior leadership has engaged in conduct which violates its own ethical standards or external legal standard such as the Foreign Corrupt Practices Act (FCPA)? Assume your company is now in McNulty Maxim No. 3 of “What did you do about it?” as you have investigated the conduct and disciplined the senior management in question. However, you want to go further and try to take steps that will detect and prevent the conduct in the future.

A current example of this is going on in the US military. In reaction to recent scandals involving lapses of personal character, the US military has instituted a series of changes to help military commanders to focus on ethical standards. In an article in the New York Times (NYT), entitled “Conduct at Issue as Military Officers Face a New Review”, Thom Shanker discussed a range of responses that the military will pursue. He reported that “The new effort is being led by Gen. Martin E. Dempsey, the chairman of the Joint Chiefs of Staff, as part of a broad overhaul of training and development programs for generals and admirals. It will include new courses to train the security detail, executive staffs and even the spouses of senior officers.” The article quoted General Dempsey as saying, “Conversely, you can have someone who is intensely competent, who is steeped in the skills of the profession, but doesn’t live a life of character. And that doesn’t do me any good.”

The military has initiated three broad responses. The first is a “regularly scheduled professional reviews would be transformed from top-down assessments to the kind of “360-degree performance evaluation” often seen in corporate settings.” A 360-degree review is one which comes from members of an employee’s immediate work circle. Most often, 360-degree feedback will include direct feedback from an employee’s subordinates, peers, and supervisor(s), as well as a self-evaluation. It can also include, in some cases, feedback from external sources, such as customers and suppliers or other interested stakeholders. The results from a 360-degree evaluation are often used by the person receiving the feedback to plan and map specific paths in their development.

While acknowledging the challenges from that comes from a subordinate review in a top-down hierarchical structure, such as the military, General Dempsey stated that “we’ve developed some bad habits” and that “It’s those bad habits we are seeking to overcome.” The article quoted Richard H. Kohn, a professor emeritus at the University of North Carolina, Chapel Hill, who specializes in military culture who said “he thought the 360-degree evaluation would have a positive effect on the leadership styles of many officers. He also stated that “It will reduce what the military calls ‘toxic leadership,’ elevating those who are highly competent but also fair and less brusque and peremptory.”

The second response was increased training on values. “General Dempsey said the demands of combat deployments in the past decade had prevented officers from attending the academic programs that historically had been integrated into an officer’s career every few years, and he pledged to rebalance that.” I found this quote very fascinating as it showed the extent that the military uses outside resources, I.E. civilian academic programs to supplement training on military values. Due to the increased deployments since 9/11, these traditional academic rotations have been less ongoing. Dr. Kohn found that these new training programs are a good enhancement to military training as “most officers need to be reminded of the rules and regulations on a routine basis.” But this training will go past simply the senior officers as “new programs will be instituted to ensure that a commander’s staff, and a spouse, are fully aware of military regulations.”

The third component will be more internal audits. The articled noted that “Under General Dempsey’s plan teams of inspectors will observe and review the procedures of commanders and their staffs. The inspections will not be punitive, but will provide a “periodic opportunity for general officers and flag officers to understand whether, from an institutional perspective, we think they are inside or outside the white lines.”” I found this component to be similar to the ‘Mock Audit’ concept that is used in the power industry that I recently wrote about in the post “In Praise of the Mock Audit”. A ‘Mock Audit’ is a mechanism by which a compliance team can go into a facility and not only try to determine what might need remediation but, equally importantly, help the employees in that facility to move towards greater compliance.

For the FCPA compliance practitioner, this response by the US military has some very interesting parallels to what the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) say should be in your FCPA compliance program. The DOJ/SEC FCPA Guidance demonstrates that a company should strengthen and supplement its compliance program on causes underlying the compliance issues which arose. The Guidance states, “An effective compliance program promotes “an organizational culture that encourages ethical conduct and a commitment to compliance with the law.” Such a program protects a company’s reputation, ensures investor value and confidence, reduces uncertainty in business transactions, and secures a company’s assets. A well-constructed, thoughtfully implemented, and consistently enforced compliance and ethics program helps prevent, detect, remediate, and report misconduct, including FCPA violations. [emphasis supplied] Further, in its section on Declinations, one of the six common elements which companies that received declinations engaged in was to make their compliance program more robust around the FCPA violation which arose. Clearly the DOJ and SEC believe that a company with a strong compliance system and culture will not only be in better position to comply with the FCPA but will be a better company.

General Dempsey clearly believes that the military has high ethical values. Shanker wrote that “He said the issue of understanding the military as a profession, and not just an occupation, had fascinated him since his days as a junior officer; he would be subject to the same rules, regulations and assessments he now is championing.” Shanker ended his article with the following quote from General Dempsey, “In my 39 years in the military, I have learned that you are not a profession just because you say you are,” he said. “You have to earn it and re-earn it and re-evaluate it from time to time.”

To me that sounds something like the following-you are not an ethical company because you say you are but because you do compliance by putting in the policies and procedures to do so.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

Amway’s Lessons in China: How to Weather the Compliance Storm

One of the questions often presented to the compliance practitioner is what to do in a foreign culture to make your program relevant and, more importantly, followed. Even if you have a well-established compliance program in other areas of the globe, moving into new or different regions can present new and different challenges. For instance, if your company has never done business in the Far East or in China, many of the cultural differences in those regions can present challenges for the implementation of a Foreign Corrupt Practices Act (FCPA) compliance program. I thought about those challenges when I read a recent article in the Harvard Business Review (HBR), entitled “Amway’s President on Reinventing the Business to Succeed in China”, by Doug DeVos, President and co-Chief Executive Officer (CEO) of Amway.

For those of you who do not know, Amway has a long running successful sales model based on door-to-door sales by independent salespersons; this direct sales model has been used by the company since the 1960s. Amway entered the Chinese market in 1995 but found that it was locked out of the market in 1998, when the Chinese government outlawed the direct sales model for Western companies. The Chinese government made this change because it believed that some direct sales models were simply scam artists, taking advantage of the Chinese peoples’ desire for all things Western. This would have appeared to sound the death knell for Amway in China as the company had never built or operated out of fixed retail outlets. The story of how Amway overcame this change in Chinese law and eventually prospered financially has some interesting insights for the compliance practitioners.

Lesson One: Understand the Market, Economics, Politics and People

Amway did not believe that the Chinese government would withdraw its legal permission to engage in direct sales. It viewed the Chinese actions as an extreme over-reaction to a relatively small problem. Further, the company believed it had shown its commitment to the Chinese market both to the Chinese people and the government. But the key in the company’s understanding came in its response in losing its license.

Senior management in the US were counseled by the head of Amway China to stay the course when she advised the company “not to lose sight of the opportunity” which presented itself to the company in China. Amway should work with the Chinese government to “create good direct selling legislation”. Relying on an old Chinese proverb (are there any new Chinese proverbs?) “If you are patient in a moment of anger, you will escape a hundred days of sorrows” the company did the spade work with the Chinese government and with its local senior management to enact reforms which set the stage for Amway’s growth in China.

Compliance Lesson: Key your eye on the compliance ball.

Lesson Two: Remain True to Your Mission and Purpose

While this concept would seem to be sacrosanct to a compliance practitioner, there may well be lots of factors driving a company’s actions in new markets, particularly when a company’s financial investment is on the line. For Amway, this meant that the company had to ask some hard business questions about itself. The question that the company eventually had to answer dealt with its core value: was it a direct sales organization only or was it a “company providing a business opportunity based on core values of partnership, integrity, and personal responsibility?” Amway decided it was the latter.

Based on this realization of its core values, the company decided not only to work with the Chinese government to create new laws to protect buyers from unscrupulous direct sellers but to do something the company had never done, create physical stores; market to them and set up suppliers to deliver products in a new and different manner. It had to set up a new distributor compensation system to begin to do brand advertising. In short, it had to learn to do business a new way but did so in a manner that it believed was consistent with its core values because once again the long term focus was on the opportunity that the Chinese market presented to the company.

Compliance Lesson: You can engage in a new business model if your core compliance and ethical values are in place.

Lesson Three: Being an Honorable Corporate Citizen

The biggest thing that Amway was able to develop was trust. This had to begin with developing a trusting relationship with the Chinese government so that Amway could prove itself to the government officials with whom it was interacting. But trust has another component; it is that you are in for the long term and you are in China to stay. The company needed to demonstrate that it “would be a long-term honorable corporate citizen in China.”

For their part, Chinese government officials listened to Amway’s ideas about how create a business environment which would benefit both Western companies with direct sales approaches and the Chinese need to protect its citizens from unscrupulous operators. But through this trust relationship, the appropriate government officials began to understand that Amway wanted to “create a mutually beneficial opportunity.” It all paid off for Amway when in late 2005, legislation was passed which allowed Western companies to engage in direct sales in China and Amway received a license in 2006.

Compliance Lesson: Not only do you have to engage in the compliance talk the talk, but you must walk the compliance walk.

Lesson Four: Stay the Course

This lesson involves how important it is to build a business by taking the long term view. The Amway view is that you must take a long term view even if it feels like you are taking a step backward at times. The Amway experience is that you can be humble without being weak. While the rules for doing business may be unique in China, the Amway experience shows that if you keep your eye on the ball for the long-term, you can overcome many substantial obstacles.

It turned out that Amway derived many advantages from their experiences in China. They developed a new and different business model, which there were able to take to other areas in the world. But perhaps the biggest change was that Amway admitted it had to change the way it had done business for over 40 years and that this change could be accomplished. But the company did so by focusing on what it needed to do to accomplish what it wanted to do.

Compliance Lesson: Your compliance program is a core part of any successful international business and integration of it into your overall business planning will pay off by making your company a better business at the end of the day.

While the Amway experience in China relates to sales, the concepts that the company used and were articulated in the HBR article provide some interesting lessons for the compliance practitioner. If you move your compliance program into a new region, listen to your local folks, take the long view and stay true to your core compliance principles. If you do this, you may well be able to install a compliance program that not only works for you but in the new territory that you are opening it into.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

Interview with Dick Cassin

Ed. Note-we continue our interview series with thought leaders in the compliance and ethics field. Today we post an interview with the person I consider to be the Godfather of compliance and ethics bloggers-Dick Cassin, Editor of the FCPA Blog.

———————————————————————————————————————————————————————-

1.      Where did you grow up and where did you go to college and law school? Can you tell us about anything from those experiences that led you into the field of compliance?

I was fortunate to grow up in a small town in the heart of New England. Keene, New Hampshire was (and still is) a beautiful place — with four seasons and nearby lakes, rivers, and mountains. It was also just a couple of hours from Fenway Park and the Boston Red Sox. I have wonderful memories of those years.

My dream from early on was to be a lawyer. I worked in Keene during my early teens for a very generous attorney, Ernest L. Bell, III. He had a small firm with all sorts and sizes of clients. I swept floors, delivered mail, bought pantry supplies, shoveled snow — and in between, I read case files and transcripts and watched Mr. Bell work. To me, it was the best job in the world.
I stayed in New England for my schooling.

After law school, I started out in a big firm, practicing antitrust law. That experience eventually led to a job in the the oil industry, a big part of which was under investigation by the antitrust unit of the U.S. Justice Department. The antitrust issues went away but I stayed close to the industry.

That was during the early years of the FCPA. There were no real anti-corruption compliance programs then, and few professionals skilled in the field. It was all brand new.

I was fascinated by the FCPA — the idea that a U.S. law was meant to apply to behavior outside the United States, and even potentially to non-U.S. people and companies. It was amazing. And I thought corruption was always harmful. I was seeing a lot of it and the damage it was doing. So I admired the FCPA and its aims. From the beginning I wanted to help companies find practical ways to comply.
2.      You spent several years living and working overseas. Can you tell us what those positions were and how this work informed your ideas about compliance?

I worked in a lot of countries ruled by corrupt regimes — places with long histories and cultures of corruption. I know how hard it can be for expat and local employees to function in that environment. My sympathy is with them.

At the same time, corruption is really toxic. It distorts markets. It robs people of their tax money and strips them of their rights as citizens. People mired in red tape and corruption become depressed and hopeless, and for good reason. They can’t get medical care without bribing someone. Educating the kids requires bribes. Police will only protect bribe payers. It’s all bad.

I was a partner in a big law firm and I did a couple of stints in house for oil-industry related companies. Most of my time was spent overseas — in the Middle East, Russia, and Asia. I’ve enjoyed all of it.
3.      What is the reason you started the FCPA Blog and what do you hope to achieve with it?

My main professional interest is the FCPA — what it means, how to comply with it, how it’s enforced. That’s what I wanted to read about and talk about. But six years ago, there was no daily source of FCPA-related news and information. I started posting some ideas to share with clients and friends. And that eventually became the FCPA Blog.

My aim then was to deliver practical information accessible to anyone. That’s why the posts are written in plain English, and most are fairly short. That’s still the objective. But the scope has broadened. Posts now deal with any aspect of corruption, enforcement, and compliance. And the FCPA Blog is now a team project. I work with dozens of great people to produce the blog. It’s a wonderful job and there’s nothing else I would rather do.

4.      You have developed a group of compliance related resources such as ethixbase, FCPA Jobs, and others. Can you tell us how you came up with these resources and what they can provide for the compliance practitioner?

ethiXbase is the biggest anti-corruption compliance database in the world. The indexed materials in it — global gift-giving regulations, anti-corruption legislation, enforcement actions, and so on — are absolutely essential for any compliance professional. These are the primary resources I and my clients always needed most. So I wanted them to be widely available to anyone who wants them.

ethiXbase has also developed the first fully automated, cloud-based compliance-related communication platforms for use with employees and third-parties, such as vendors, agents, partners, and so on.

We’ve known for quite a while now what’s required by the DOJ and SEC for an effective compliance program. A lot of it depends on frequent, targeted communications to deliver policies, reminders, updates, alerts, and the like. But unless this can be done automatically and very cost effectively, it won’t be done at all. And that increases the risk of a compliance problem. The ethiXbase platforms exist to solve these problems.

The FCPA Jobs site is there to help companies find compliance professionals. And it’s a great place to look for a compliance-related position.

5.      You have worked in the compliance field for some time. What are the biggest changes that you have seen over this time period?

The biggest change is that there is now something we all recognize as the anti-corruption compliance field. It didn’t exist just ten years ago. Now thousands of people worldwide think of themselves as compliance professionals. And the field is exploding. So there’s truly a compliance community, which is a new development.

There are more compliance resources available today than ever before. ethiXbase is an example of practical tools to help companies of any size comply with the FCPA and related laws. Tom Fox’s writings and talks are wonderful resources where anyone can learn more about compliance. The press and media now regularly report FCPA-related stories. People from the DOJ, SEC, U.K. Serious Fraud Office, OECD, U.N., World Bank, the NGOs, and so on are talking about anti-corruption compliance and enforcement. That rarely happened just a five years ago.

All these changes have been driven by stepped up U.S. and global enforcement since around 2008. More enforcement has led to much more awareness of corruption and compliance.

There’s a clearer concept today that graft is bad, no matter where it occurs. Not long ago, serious people were still debating whether overseas bribery should be against the law. The argument advanced was often that bribery is a victimless crime. Now we know that’s never true and there is no good bribery. Its victims can be counted in the millions or billions. Grand or systematic corruption is even seen now in many places as a human rights violation. So the world’s attitude toward corruption has changed dramatically. And that attitude is the essential ingredient for changing how business is done.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

How To You Move Ethical Values Down Through Your Company?

What do employees want most in their company’s values? That is a question that has plagued companies for many, many years. I would argue that one of the concepts which should be in the conversation is respect for a company’s ethical values. One of the tasks in any company is to get senior and middle management to respect the stated ethics and values of a company, because if they do so, this will be communicated down through the organization. This topic was explored in a recent article, entitled “If the Supervisors Respect Values, So Will Everyone Else”, in the Corner Office section of the New York Times (NYT), when reporter Adam Bryant interviewed Victoria Ransom, the Chief Executive Officer (CEO) of Wildfire, a company which provides social media marketing software.

Company Values

Ransom spoke about the role of senior management in communicating ethical values when she said “Another lesson I’ve learned as the company grows is that you’re only as good as the leaders you have underneath you. And that was sometimes a painful lesson. You might think that because you’re projecting our values, then the rest of the company is experiencing the values.” These senior managers communicate what the company’s ethics and values are to middle management. So while tone at the top is certainly important in setting a standard, she came to appreciate that it must move downward through the entire organization. Ransom came to realize “that the direct supervisors become the most important influence on people in the company. Therefore, a big part of leading becomes your ability to pick and guide the right people.”

Ransom said that when the company was young and small they tried to codify their company values but they did not get far in the process “because it felt forced.” As the company grew she realized that their values needed to be formalized and stated for a couple of reasons. The first was because they wanted to make it clear what was expected of everyone and “particularly because you want the new people who are also hiring to really know the values.” Another important reason was that they had to terminate “a few people because they didn’t live up to the values. If we’re going to be doing that, it’s really important to be clear about what the values are. I think that some of the biggest ways we showed that we lived up to our values were when we made tough decisions about people, especially when it was a high performer who somehow really violated our values, and we took action.” These actions to terminate had a very large effect on the workforce. Ransom said that “it made employees feel like, “Yeah, this company actually puts its money where its mouth is.””

Ransom wanted to make clear to everyone what senior management considered when determining whether employees “are living up to the company culture.” The process started when she and her co-founder spent a weekend writing down what they believed the company’s values were. Then they sat down with the employees in small groups to elicit feedback. Her approach was to look for what they wanted in their employees. They came up with five.

• Passion: Do you really have a thirst and appetite for your work?
• Humility and Integrity: Treat your co-workers with respect and dignity.
• Courage: Speak up – if you have a great idea, tell us, and if you disagree with people in the room, speak up.
• Curiosity: They wanted folks who would constantly question and learn, not only about the company but about the industry.
• Impact: Are you having an impact at the company?
• Be outward-looking: Do good and do right by each other.

Leadership

Ransom came to realize that as her company’s leader, more was expected from her. Her employees listened to what she said. This is one of the best descriptions of ‘tone at the top’ that I’ve seen. Ransom “started to realize how what you say can have such an influence. You can’t just say things off the cuff anymore, because people take it so much more seriously than you ever meant it. And that can be good and bad. The bad is that you might say something sort of flippant, or you’re trying to be really transparent and honest with the team about the challenges we may have. But that can get passed on down the line and repeated until there’s a panic.”

But equally important was what she does not say. This is because she learned “how comforting what I say can be to the team, even if I’m not giving the answers. I thought at first that I always needed to be able to give them the solution, but I realized that actually that wasn’t needed at all. All that was needed was acknowledging the challenges, and showing that we’re on top of it and we get it.”

Ransom had an equally valuable insight when she talked about senior management and ethical values. She believes that “the best way to undermine a company’s values is to put people in leadership positions who are not adhering to the values. Then it completely starts to fall flat until you take action and move those people out, and then everyone gets faith in the values again. It can be restored so quickly. You just see that people are happier.”

I found the Ransom interview to be quite useful to the compliance practitioner. She makes clear that ‘tone at the top’ is only one key to instituting ethical values throughout your organization. It also means ‘tone in the middle’ and ‘tone at the bottom’. But she points out not only how to establish that tone but more importantly how to walk the walk of ethics and compliance. Her interview also showed the importance of establishing the values that you want in your company. By doing more than simply writing and then announcing them, through her work with small employee groups she was able to get buy-in from everyone. This was more than communication, this was collaboration. If you make your employees feel that they are a part of the process you will have greater success in your mission to bring ethical values to your organization.

============================================================================================

Please join Patrick Taylor, CEO of Oversight Systems and myself tomorrow afternoon for a webinar on Anti Corruption and On-going Transaction Monitoring. The webinar will be at 2 PM EST and is free. For registration and information click here.

============================================================================================

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

Chesapeake Lighthouses and Lighting the Way for Compliance

In the winter 2013 issue of the Colonial Williamsburg magazine is an article by Michael Lombardi, entitled “Lighthouses Marked the Shoals of the Commerce Clause”. In this article, Lombardi wrote about four lighthouses authorized by Congress in the late 18^th and early 19^th century to light the way for sailors in Chesapeake Bay. The four lighthouses were the Cape Henry Lighthouse, the Old and New Point Comfort Lighthouses and the Smith Point Lighthouse. All four still exist today and one, the Old Point Comfort Lighthouse, is still in operation.

I thought about the story of these lighthouses and how they literally lit the way for sailors for over 200 years when I read an article in the Q2 issue of Ethisphere Magazine, entitled “Imagination Working with Integrity: How General Electric Creates a Global Culture of Ethics”, by Michael Price. Price discusses how General Electric (GE) has made “ethics and compliance a benchmark of its operations around the world, and is, in many ways the gold standard that other companies look to when it comes to modeling global compliance and ethics programs.”

I also considered these lighthouses in the context of how GE sets the tone for ethics and compliance and then communicates that commitment throughout its organization. Obviously it all starts at the top and GE is a prime example of this strength. Price noted that GE’s top brass meets annually at a conference where one of the frequent topics was ethics and compliance and the need for integrity in GE. Following this meeting of the GE senior management, they cascade down this commitment to middle management and emphasize the reputational risk to GE should there be a violation of the Foreign Corrupt Practices Act (FCPA) or other anti-corruption statute by the company. The middle managers then further cascade this message down so that it goes through the whole company at regular intervals.

Price made clear that one thing that GE will not tolerate is a manager who fails to take ethics and compliance seriously. This extends to managers who were ignorant of compliance issues in their units. He wrote that GE has “removed people from leadership positions when they didn’t know there was a problem”. GE demands that its management not only be aware of compliance in their units, but to ask “the right questions when they are faced with an uncertain situation”.

As you might expect from a company which has business in over 100 countries, GE has to work with many different cultural norms. It can be that “different cultures have different frameworks for understanding integrity and how to confront unethical conduct.” So, for instance, to overcome some cultural barriers of reporting unethical conduct GE has “five different pathways in which employees around the world can bring their concerns to management’s attention.” These pathways include the following:

• Employees can talk directly to their managers;
• Employees can go to talk to people in the compliance function;
• Employees can go to talk to someone in the legal department;
• Employees can take their concerns to HR; and
• Employees can report anonymously to an ombudsman through a variety of channels.

GE provides several types of training in each of these methods and has “Compliance Days” in “which the company discusses compliance issues and reiterates the importance about employees raising concerns about unethical practices.” The article makes clear not only how seriously GE takes compliance but that it believes its commitment to ethical practices makes it stand out as a market differentiator. I would say that ethics and compliance is even a lighthouse for corporate culture at GE, in many ways, leading the way by which GE does business and conducts itself.

I once worked for a major oilfield service company where it was clear that safety was the Number 1 priority. We started every meeting with a safety moment. Each year, there was one day where the entire company stood down and met on safety on a world-wide basis. Both of these techniques emphasized to me not only the importance of safety but that safety was my responsibility as well, even though I was a lawyer doing international transactional work. This was another lighthouse but it was one for safety.

As a recovering trial lawyer who has handled many personal injury lawsuits and then worked in the energy industry, I will always consider safety as Mission Number 1 but I would like to propose that ethics and compliance is Mission 1A in your company. Try some of the techniques that GE uses to communicate its commitment to ethics and compliance. It does not cost anything to have senior management meet with middle management and tell them about the company’s commitment to integrity. It does not cost anything to allow employees to speak with their immediate managers about concerns over unethical practices, go talk to someone in the compliance department or legal department about such concerns or report their concerns to HR. If you do not have an anonymous reporting line, it is about time you invested in one. I do recognize that many companies do not have an ethics and compliance ombudsman but the key concept there might be that by having such an impartial position, employees believe they will be treated fairly.

How about having a compliance moment before every meeting? By having such a moment before every meeting you can not only provide some teachable moments but also drive home the concept that compliance is everyone’s responsibility not just the responsibility of the compliance or legal department. How about a Compliance Day? If you cannot go that far, I would suggest that you hold a series of brown bag lunches where you talk about doing business with integrity through ethical and compliant business practices. You could hold them throughout the company.

One thing I learned as a lawyer is that you are only limited by your imagination. Try to get the message out because compliance is in many ways, the 21^st century lighthouse for doing business.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

The Tube and Updating Your Compliance Policies

2013 is the 150^th anniversary of the London Underground, affectionately known as “The Tube.” It truly is one of the great urban architectural marvels of all-time. The oldest sections of the London Underground completed 150 years of operations on 10 January 2013. The Underground serves 270 separate stations and has 250 miles of track, 45% of which is underground. In 2011, it served over 1.2 billion riders but, like any transportation system, it has to be evaluated and upgraded. For my money, the most useful upgrade would be to air condition the cars as they can become unbearably hot in the summer but that may not be on the top of Prime Minister’s Cameron’s list about now.

I thought about this auspicious anniversary and maintenance of the London Underground when I read a recent article in the Compliance Week magazine by Michael Rasmussen, entitled “Improving Policies Through Metrics”. Rasmussen believes that effective policy management requires that a company must periodically review their policies to ensure that they are relevant and aligned with both current laws and corporate objectives. This is because today’s business environment is dynamic and involves both internal and external factors, so, consequently, as a company evolves and changes its policies need to be updated to reflect these changes.

One of the key components of any best practices compliance regime under any anti-bribery and anti-corruption program is policies. Policies tie together a company, its business environment, the risks it faces and the compliance requirements. Policies are a specific requirement for any anti-corruption/anti-bribery compliance regime. In the recently released Department of Justice (DOJ) Guidance on the Foreign Corrupt Practices Act (FCPA), it stated, “Whether a company has policies and procedures that outline responsibilities for compliance within the company, detail proper internal controls, auditing practices, and documentation policies, and set forth disciplinary procedures will also be considered by DOJ and SEC.” Under the UK Bribery Act, policies are discussed in the Six Principles of an Adequate Procedures compliance program under Principle V – Communication, where it states “The business seeks to ensure that its bribery prevention policies and procedures are embedded and understood throughout the company through internal and external communication, including training, that is proportionate to the risks it faces.”

While I think that most compliance practitioners understand this need for policies one of the things that is not usually emphasized at a company is effective policy management. One technique which can be used is to elevate the policy function to the senior management level. One of my former employers, Halliburton, did this when it created a Vice President for Policies back in 2006. So kudos to Halliburton for leading the industry by creating the position of Vice President for Policies.

Rasmussen believes that at a minimum, policies must be reviewed annually. He recommends that each policy should go through a yearly review process to determine if it is still appropriate. There should be a “system of accountability and workflow that facilitates” any policy review process. The end product should be a decision to “retire the process, keep the policy as it is, or revise the policy.” Rasmussen lists five items that a policy owner should evaluate as a part of the policy review process.

• Violations. Here Rasmussen believes that information from reporting systems such as hotlines or other anonymous lines as well as internal or external investigations must be reviewed. Not only would such information indicate if a company policy was violated but the follow-up investigation would help to determine how the policy might have failed, whether it was through “lack of awareness, unauthorized exceptions [or] outright violations.”
• Understanding. Here Rasmussen writes that there should be an analysis of “training and awareness programs, policy attestations” and attendant metrics to determine an appropriate level of policy understanding. He believes that questions to a helpdesk or compliance department could help to discover any ambiguities in a policy that might need to be corrected.
• Exceptions. If you have a policy it should be followed. If an exception to a policy was granted the reason for the exception should have been documented. If there are too many exceptions granted for a policy, it might indicate that “the policy is inappropriate and unenforceable” and therefore should be revised.
• Compliance. A policy should govern and authorize internal controls. These internal controls should be reviewed in conjunction with the policy review to determine overall policy effectiveness. This is because “At the end of the day the policy needs to be complied with.”
• Environment. All the factors around a policy are in flux. This includes a company’s risk profile, its business strategy, laws and regulations. Since a business’ climate is dynamic, a policy should be reviewed in the context of a company’s overall situation and revised accordingly.

If there is a change in a policy it is important that not only the correct change be made but that any change is documented. An audit trail is a key component for a company to internally understand when a change is made and the reason for that change but also to demonstrate to a regulator effective policy management and to present “a defensible history of policy interactions on communications, training, acknowledgements, assessments and related details needed to show the was enforced and operational.” This audit trail should include “key data points such as the owner, who read it, who was trained, acceptance acknowledgements and dates for specific policy versions”. In addition to an audit trail, policy revisions should be archived for referral back at a later time. So, once again, the key message is document, document and document.

Just as best practices in the FCPA compliance arena evolve, so do business practices, markets and risks. If you throw in the complexities from an inter-connected global business milieu, the task becomes even tougher. Business policies are one of the keystones of a company’s communications to its employees on what it expects and what is required of its employees. To keep policies up-to-date and properly take advantage of this valuable tool, policies need to be evaluated and updated as appropriate. If your company fails to do so this takes away from the value of having policies in the first place. I hope that you will use the techniques which Rasmussen has described to help you effectively manage your policies going forward.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

Internal Audit Review of Charitable Donations Under the FCPA

When is a rose not a rose? When it is a charitable donation not made for philanthropic purposes and it violates the Foreign Corrupt Practices Act (FCPA). I thought about that concept when reviewing the Eli Lilly and Company (Lilly) FCPA enforcement action brought by the Securities and Exchange Commission (SEC) late last month. The Lilly enforcement action discussed a bribery scheme utilized by Lilly in Poland. The scheme and FCPA violations mirrored an earlier FCPA enforcement action, also brought by the SEC as a civil matter, rather than by the Department of Justice (DOJ) as a criminal matter, against another US entity Schering-Plough, for making charitable donations in Poland which violated the FCPA. One of the remarkable things about both of these enforcement actions, brought almost eight years apart, was that they involved improper payments to the same Polish charitable foundation to wrongfully influence the same Polish government official to purchase products from both of these companies.

I.                   The Bribery Schemes

Both companies were involved in negotiations for the sale of products with the Director of the Silesian Health Fund (Health Fund). He had also established a charitable foundation, the Chudow Foundation to engage in restoration of ancient castles in Poland. Both companies made donations to the Chudow Foundation at or near the time decisions were made regarding the purchase of their respective products by the Health Fund. The FCPA books and records violations for the donations stated that they were all mischaracterized on the respective company’s books. The donations were made by each company with the description for the donations as follows:

LILLY BOX SCORE OF DONATIONS MADE TO CHUDOW FOUNDATION

	Date	Amount of Donation	Listed Reason for Donation
1	6/21/2000	$2,730	Purchase of computers
2	11/13/2000	$1,855	To support the foundation in its goal to develop activities in [Chudow Castle]. It was also noted that the ‘value of the request’ was indirect support of educational efforts of foundation settled by Silesian [Health Fund]
3	5/22/2001	$8,019	Rental of castle for conferences
4	11/05/2001	$2,438	Rental of castle for conferences
5	3/27/2002	$7,779	Rental of castle for conferences
6	6/14/2002	$7,434	Rental of castle for conferences
7	11/20/2002	$5,112	Rental of castle for conferences
8	1/29/2003	$2,622	Rental of castle for conferences
	Total	$37,989

Although all of these donations were approved by a team within Lilly, the “Medical Grant Committee [MGC]”, who reviewed the request for such donations, the MGC’s approval was “largely based on the justification and description in the submitted paperwork.” While Requests 1 & 2 may have had tangential value to the stated purpose of the Chudow Foundation to restore castles in Poland, even Request 3 was clearly a quid pro quo as an action to obtain business. Just as clearly, ‘rental of castle’ is not a charitable donation but an expenditure, even with that understanding, the SEC Complaint noted that Lilly held no conferences at any castles so it was an outright misrepresentation.

SCHERING-PLOUGH BOX SCORE OF DONATIONS MADE TO CHUDOW FOUNDATION

	Date	Amount of Donation	Listed Reason for Donation
1	2/23/1999	$777	Covering fight against viral hepatitis
2	3/17/2000	$4,909	Support of health campaign within county of Gliwice
3	7/19/2000	$8,065	Financing second stage of health prevention campaign in Gliwice
4	11/8/2000	$8,766	Financing for the Foundation
5	12/20/2000	$9,292	Financing second stage of research
6	3/19/2001	$4,340	Financing lung cancer prevention program
7	3/22/2001	$4,854	Financing screening examinations to detect skin cancer
8	4/25/2001	$4,958	Support of lung cancer prevention program
9	6/4/2001	$5,019	Support of lung cancer prevention program
10	10/29/2001	$4,878	Support of a coronary disease prevention program and promote the image of the company in the medical community
11	12/18/2001	$10,067	Support of an anti-chain smoking health program and promote the company as one that cares about the people of Silesia
12	12/19/2001	$5,067	Financing of Foundation
13	3/25/2002	$4,868	Support actions of Foundation in preventing infectious diseases of the liver
	Total	$75,860

The Schering-Plough SEC Complaint noted that the company Manager involved in the payment scheme, “provided false medical justifications for most of the payments on the documents that he submitted to the company’s finance department.” Additionally, he structured the payments so that they were at or below his approval limit so that he did not have to ask for permission to make the improper payments. The Manager in question viewed the donations as “dues that were required to be paid for assistance from the Director.”

II.                The Red Flags for Charitable Donation

 a.     Schering-Plough

What were the factors which should become red flags for the review of charitable donations under the FCPA? The Schering-Plough SEC Complaint listed several items which it deemed indicia of red flags.

1.      No due diligence. The first is that no due diligence was performed on the charity to identify the Director of the Silesian Health Fund as the founder or his role in the Chudow Foundation.

2.      Donations not related to health care. While the company permitted donations to healthcare related programs there was no follow up to determine the purposes or uses of the donated funds.

3.      Outside normal range of donation. The next red flag was that the donations made to this single charitable foundation approximately 40% of the company’s promotional budget in 2000 and 20% in 2001.

4.      Disproportionate sales. The company’s sales increased disproportionately compared with its own sales of the same products in other areas of Poland. Up to 53% of one product was sold in the region run by the Director of the Silesian Health Fund.

b.  Lilly

The Lilly SEC Complaint listed several items which it deemed indicia of red flags.

1.      No due diligence. Once again there was no due diligence performed on the charity to identify the Director of the Silesian Health Fund as the founder or his role in the Chudow Foundation.

2.      Donations not related to health care. Unlike Schering-Plough, the reasons listed for the charitable donations did not relate to health care. Moreover, they were approved by a Lilly committee specifically tasked with reviewing such requests failed to investigate beyond the submitted paperwork, which was apparently not correct.

3.      Outside normal range of donation. The SEC Complaint quoted an email from a Lilly manager who said that he had decided to commit 70-75% of the [charitable donation] budget and the Director of the Silesian Health Fund was given a “free hand to manage the Lilly investment, emphasizing the fact we only doing this for him…”

4.      Suspicious Timing. The donations were made at or near the time that decisions on the purchase of Lilly products were made by the Director of the Silesian Health Fund. One donation was made two days are the Director of the Silesian Health Fund agreed to make a purchase of Lilly products.

Here Lilly used charitable donations to a charitable foundation which was, as stated in the SEC Complaint, “founded and administered by the head of one of the regional government health authorities at the same time that the subsidiary was seeking the official’s support for placing Lilly drugs on the government reimbursement list.” There were a total of eight payments made to the charitable foundation. In addition to the charitable donations made, Lilly “falsely characterized the proposed payments”. Lilly had a group which reviewed the request for such donations called the “Medical Grant Committee [MGC]” which approved the payments “largely based on the justification and description in the submitted paperwork.”

III.       The Role of Internal Audit

Jon Rydberg, Principal of Orchid Advisors, has categorized the Lilly situation as one of a failure of internal controls. I would add that there was also a failure of internal audit. What does internal audit need to review in the context of charitable donations under the FCPA? Internal audit needs to start with the DOJ FCPA Guidance regarding charitable donations. Internal audit should begin by asking the following five initial questions:

(1)   What is the purpose of the payment?

(2)   Is the payment consistent with the company’s internal guidelines on charitable giving?

(3)   Is the payment at the request of a foreign official?

(4)   Is a foreign official associated with the charity and, if so, can the foreign official make decisions regarding your business in that country?

(5)   Is the payment conditioned upon receiving business or other benefits?

Next internal audit should make inquiries based upon the DOJ Opinion Releases issued regarding charitable donations. Some of the protections a company can do to comply with the FCPA regarding charitable donations are as follows:

1)      Have the donation recipients certified that they or the entity will comply with the requirements of the FCPA;

2)      Has the recipient provided audited financial statements; and

3)      Has the recipient restricted the use of the donated funds to humanitarian or charitable purposes only;

4)      Were the funds transferred to a valid bank account; and

5)      Ongoing auditing and monitoring of the efficacy of the charitable donation program.

Based upon the Schering-Plough and Lilly SEC enforcement actions, there are some additional inquiries that internal audit should make, they are as follows:

a.      What was the timing of the charitable donation or promise to make a donation in relation to the obtaining or retaining of business?

b.      Did the company follow its normal protocol for requesting, reviewing and making a charitable donation or is there a pattern of unusual donations outside the protocol?

c.       Did any one person make multiple donations just below their authority level so that it did not have to go up the line for review?

d.      Was the total amount donated to one charitable foundation out of proportion to the rest of the country or region’s charitable donation budget?

e.       Did the sales in one area, region or country spike after a pattern of charitable donations?

The information on the red flags from the prior Opinion Releases and the best practices, as set out in the FCPA Guidance, have been available for some time. I think that the information found in both the Schering-Plough and Lilly enforcement actions have a different focus for internal audit. In addition to looking at the timing of charitable donations to see if they are at or near the time of the awarding of new or continued business, I think that internal audit may now need to look at overall increases in sales to determine if they are tied to a pattern of charitable donations. I once heard my colleague Henry Mixon explain how the award of a contract may be the product of fraud or corruption. By looking at the timing and quantum of charitable donations, internal audit may be able to ascertain that a spike in sales is tied to corrupt conduct. This may not be something that is on the current radar of auditors when they review charitable donations, but may now be something they need to consider.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013