FCPA Compliance and Ethics Blog

July 3, 2015

IN CONGRESS, July 4, 1776

Filed under: Uncategorized — tfoxlaw @ 8:42 am

July 4Ed. Note-I hope that every American, at least once per year will take the time to read the foundational document of our country, the Declaration of Independence. What Thomas Jefferson wrote and his fellow signers agreed to still ring as true today as it did some 239 years ago. So to honor American, today I post the text of entire Declaration of Independence. I would ask that you take some time over this weekend to read it. 

The unanimous Declaration of the thirteen united States of America,

When in the Course of human events, it becomes necessary for one people to dissolve the political bands which have connected them with another, and to assume among the powers of the earth, the separate and equal station to which the Laws of Nature and of Nature’s God entitle them, a decent respect to the opinions of mankind requires that they should declare the causes which impel them to the separation.

We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness.–That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed, –That whenever any Form of Government becomes destructive of these ends, it is the Right of the People to alter or to abolish it, and to institute new Government, laying its foundation on such principles and organizing its powers in such form, as to them shall seem most likely to effect their Safety and Happiness. Prudence, indeed, will dictate that Governments long established should not be changed for light and transient causes; and accordingly all experience hath shewn, that mankind are more disposed to suffer, while evils are sufferable, than to right themselves by abolishing the forms to which they are accustomed. But when a long train of abuses and usurpations, pursuing invariably the same Object evinces a design to reduce them under absolute Despotism, it is their right, it is their duty, to throw off such Government, and to provide new Guards for their future security.–Such has been the patient sufferance of these Colonies; and such is now the necessity which constrains them to alter their former Systems of Government. The history of the present King of Great Britain is a history of repeated injuries and usurpations, all having in direct object the establishment of an absolute Tyranny over these States. To prove this, let Facts be submitted to a candid world.

He has refused his Assent to Laws, the most wholesome and necessary for the public good.
He has forbidden his Governors to pass Laws of immediate and pressing importance, unless suspended in their operation till his Assent should be obtained; and when so suspended, he has utterly neglected to attend to them.
He has refused to pass other Laws for the accommodation of large districts of people, unless those people would relinquish the right of Representation in the Legislature, a right inestimable to them and formidable to tyrants only.
He has called together legislative bodies at places unusual, uncomfortable, and distant from the depository of their public Records, for the sole purpose of fatiguing them into compliance with his measures.
He has dissolved Representative Houses repeatedly, for opposing with manly firmness his invasions on the rights of the people.
He has refused for a long time, after such dissolutions, to cause others to be elected; whereby the Legislative powers, incapable of Annihilation, have returned to the People at large for their exercise; the State remaining in the mean time exposed to all the dangers of invasion from without, and convulsions within.
He has endeavoured to prevent the population of these States; for that purpose obstructing the Laws for Naturalization of Foreigners; refusing to pass others to encourage their migrations hither, and raising the conditions of new Appropriations of Lands.
He has obstructed the Administration of Justice, by refusing his Assent to Laws for establishing Judiciary powers.
He has made Judges dependent on his Will alone, for the tenure of their offices, and the amount and payment of their salaries.
He has erected a multitude of New Offices, and sent hither swarms of Officers to harrass our people, and eat out their substance.
He has kept among us, in times of peace, Standing Armies without the Consent of our legislatures.
He has affected to render the Military independent of and superior to the Civil power.
He has combined with others to subject us to a jurisdiction foreign to our constitution, and unacknowledged by our laws; giving his Assent to their Acts of pretended Legislation:
For Quartering large bodies of armed troops among us:
For protecting them, by a mock Trial, from punishment for any Murders which they should commit on the Inhabitants of these States:
For cutting off our Trade with all parts of the world:
For imposing Taxes on us without our Consent:
For depriving us in many cases, of the benefits of Trial by Jury:
For transporting us beyond Seas to be tried for pretended offences
For abolishing the free System of English Laws in a neighbouring Province, establishing therein an Arbitrary government, and enlarging its Boundaries so as to render it at once an example and fit instrument for introducing the same absolute rule into these Colonies:
For taking away our Charters, abolishing our most valuable Laws, and altering fundamentally the Forms of our Governments:
For suspending our own Legislatures, and declaring themselves invested with power to legislate for us in all cases whatsoever.
He has abdicated Government here, by declaring us out of his Protection and waging War against us.
He has plundered our seas, ravaged our Coasts, burnt our towns, and destroyed the lives of our people.
He is at this time transporting large Armies of foreign Mercenaries to compleat the works of death, desolation and tyranny, already begun with circumstances of Cruelty & perfidy scarcely paralleled in the most barbarous ages, and totally unworthy the Head of a civilized nation.
He has constrained our fellow Citizens taken Captive on the high Seas to bear Arms against their Country, to become the executioners of their friends and Brethren, or to fall themselves by their Hands.
He has excited domestic insurrections amongst us, and has endeavoured to bring on the inhabitants of our frontiers, the merciless Indian Savages, whose known rule of warfare, is an undistinguished destruction of all ages, sexes and conditions.

In every stage of these Oppressions We have Petitioned for Redress in the most humble terms: Our repeated Petitions have been answered only by repeated injury. A Prince whose character is thus marked by every act which may define a Tyrant, is unfit to be the ruler of a free people.

Nor have We been wanting in attentions to our Brittish brethren. We have warned them from time to time of attempts by their legislature to extend an unwarrantable jurisdiction over us. We have reminded them of the circumstances of our emigration and settlement here. We have appealed to their native justice and magnanimity, and we have conjured them by the ties of our common kindred to disavow these usurpations, which, would inevitably interrupt our connections and correspondence. They too have been deaf to the voice of justice and of consanguinity. We must, therefore, acquiesce in the necessity, which denounces our Separation, and hold them, as we hold the rest of mankind, Enemies in War, in Peace Friends.

We, therefore, the Representatives of the united States of America, in General Congress, Assembled, appealing to the Supreme Judge of the world for the rectitude of our intentions, do, in the Name, and by Authority of the good People of these Colonies, solemnly publish and declare, That these United Colonies are, and of Right ought to be Free and Independent States; that they are Absolved from all Allegiance to the British Crown, and that all political connection between them and the State of Great Britain, is and ought to be totally dissolved; and that as Free and Independent States, they have full Power to levy War, conclude Peace, contract Alliances, establish Commerce, and to do all other Acts and Things which Independent States may of right do. And for the support of this Declaration, with a firm reliance on the protection of divine Providence, we mutually pledge to each other our Lives, our Fortunes and our sacred Honor.

The 56 signatures on the Declaration appear in the positions indicated:

Column 1
Button Gwinnett
Lyman Hall
George Walton

Column 2
North Carolina:
William Hooper
Joseph Hewes
John Penn
South Carolina:
Edward Rutledge
Thomas Heyward, Jr.
Thomas Lynch, Jr.
Arthur Middleton

Column 3
John Hancock
Samuel Chase
William Paca
Thomas Stone
Charles Carroll of Carrollton
George Wythe
Richard Henry Lee
Thomas Jefferson
Benjamin Harrison
Thomas Nelson, Jr.
Francis Lightfoot Lee
Carter Braxton

Column 4
Robert Morris
Benjamin Rush
Benjamin Franklin
John Morton
George Clymer
James Smith
George Taylor
James Wilson
George Ross
Caesar Rodney
George Read
Thomas McKean

Column 5
New York:
William Floyd
Philip Livingston
Francis Lewis
Lewis Morris
New Jersey:
Richard Stockton
John Witherspoon
Francis Hopkinson
John Hart
Abraham Clark

Column 6
New Hampshire:
Josiah Bartlett
William Whipple
Samuel Adams
John Adams
Robert Treat Paine
Elbridge Gerry
Rhode Island:
Stephen Hopkins
William Ellery
Roger Sherman
Samuel Huntington
William Williams
Oliver Wolcott
New Hampshire:
Matthew Thornton

July 2, 2015

Channeling John Steed in Your Tone in the Middle

Patrick MacneeToday we honor a great English actor from one of the 1960s signature television series. Last week, Patrick Macnee died. He was one-half of the crime-fighting duo on The Avengers. As reported in his New York Times (NYT) obituary, “Macnee, who wielded a lethal umbrella and sharp repartee as the dapper secret agent John Steed.” In The Avengers, Macnee “faced off against an assortment of evildoers, armed with understated wit and a traditionalist British fashion sense that made him look less like a spy in the Bond mold than “a junior cabinet minister,” as he once put it, although his tightly rolled umbrella concealed a sword and other crime-fighting gadgets, and his bowler hat, lined with a steel plate, could stop bullets and, when thrown, fell an opponent.”

His initial partner was the actress Honor Blackman but after she left the series to play Pussy Galore in the James Bond film Goldfinger his more famous sidekick became “Diana Rigg, stylish in a leather cat suit and every bit his equal in the wit and hand-to-hand-combat departments. In many scenes he was content to observe, an eyebrow cocked, as Emma — whom he always referred to as Mrs. Peel — unleashed her martial arts expertise on a hapless foe. He would often summon her to action with the words “Mrs. Peel, we’re needed.” Steed carried no gun. Aplomb and sang-froid were his weapons.” He could communicate what he meant when he meant it.

I thought about Macnee, his role as Steed and, of course, Mrs. Peel when I considered how a company must communicate its message of compliance. A company must have more than simply a good ‘Tone-at-the-Top’; it must move it down through the organization from senior management to middle management and into its lower ranks. This means that one of the tasks of any company, including its compliance organization, is to get middle management to respect the stated ethics and values of a company, because if they do so, this will be communicated down through the organization.

Adam Bryant, in a NYT article, entitled “If Supervisors Respect The Values, So Will Everyone Else”, explored this topic when he interviewed Victoria Ransom, the Chief Executive of Wildfire, a company which provides social media marketing software. Ransom spoke about the role of senior management in communicating ethical values when she was quoted as saying “Another lesson I’ve learned as the company grows is that you’re only as good as the leaders you have underneath you. And that was sometimes a painful lesson. You might think that because you’re projecting our values, then the rest of the company is experiencing the values.” These senior managers communicate what the company’s ethics and values are to middle management. So while tone at the top is certainly important in setting a standard, she came to appreciate that it must move downward through the entire organization. Bryant wrote that Ransom came to realize “that the direct supervisors become the most important influence on people in the company. Therefore, a big part of leading becomes your ability to pick and guide the right people.”

Ransom said that when the company was young and small they tried to codify their company values but they did not get far in the process “because it felt forced.” As the company grew she realized that their values needed to be formalized and stated for a couple of reasons. The first was because they wanted to make it clear what was expected of everyone and “particularly because you want the new people who are also hiring to really know the values.” Another important reason was that they had to terminate “a few people because they didn’t live up to the values. If we’re going to be doing that, it’s really important to be clear about what the values are. I think that some of the biggest ways we showed that we lived up to our values were when we made tough decisions about people, especially when it was a high performer who somehow really violated our values, and we took action.” These actions to terminate had a very large effect on the workforce. Ransom said, “it made employees feel like, “Yeah, this company actually puts its money where its mouth is.””

Ransom sought to ensure that everyone knew what senior management considered when determining whether employees were “living up to the company culture.” The process started when she and her co-founder spent a weekend writing down what they believed the company’s values were. Then they sat down with the employees in small groups to elicit feedback. Her approach was to look for what they wanted in their employees. They came up with six.

  • Passion: Do you really have a thirst and appetite for your work?
  • Humility and Integrity: Treat your co-workers with respect and dignity.
  • Courage: Speak up – if you have a great idea, tell us, and if you disagree with people in the room, speak up.
  • Curiosity: They wanted folks who would constantly question and learn, not only about the company but about the industry.
  • Impact: Are you having an impact at the company?
  • Be outward-looking: Do good and do right by each other.

Ransom had an equally valuable insight when she talked about senior management and ethical values. She believes that “the best way to undermine a company’s values is to put people in leadership positions who are not adhering to the values. Then it completely starts to fall flat until you take action and move those people out, and then everyone gets faith in the values again. It can be restored so quickly. You just see that people are happier.”

What should the tone in the middle be? Put another way, what should middle management’s role be in the company’s compliance program? This role is critical because the majority of company employees work most directly with middle, rather than top management and, consequently, they will take their cues from how middle management will respond to a situation. Moreover, middle management must listen to the concerns of employees. Even if middle management cannot affect a direct change, it is important that employees need to have an outlet to express their concerns. Therefore your organization should train middle managers to enhance listening skills in the overall context of providing training for what she termed their ‘Manager’s Toolkit’. This can be particularly true if there is a compliance violation or other incident that requires some form of employee discipline. Ransom believes that most employees think it important that there be “organizational justice” so that people believe they will be treated fairly. Ransom further explained that without organization justice, employees typically do not understand outcomes but if there is perceived procedural fairness that an employee is more likely accept a decision that they may not like or disagree with.

So think about your lines of communication and your communication skills when conveying your message of compliance down from the top into the middle of your organization. You might even want to channel your inner John Steed, from The Avengers, in doing so.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

July 1, 2015

Mifune Gets a Star on the Walk of Fame-the Petrobras Scandal Only Gets Worse

MifuneIt was announced last week that actor Toshirō Mifune (1920-1997) will be honored with a star bearing his name on the Hollywood Walk of Fame. The Hollywood Chamber of Commerce will add the star in 2016, together with new stars in the motion picture category for Quentin Tarantino, Michael Keaton, Steve Carell, Bradley Cooper, Ashley Judd and Kurt Russell. For those of you who may not have heard of Mifune, he was a veteran of sixteen films directed by Akira Kurosawa as well as many other Japanese and international classics. His films with Kurosawa are considered cinema classics. They include Drunken Angel, Stray Dog, Rashomon, Seven Samurai, The Hidden Fortress, High and Low, Throne of Blood, Sanjuro, and Yojimbo. While there are many great, great performances in these films, my personal favorite is Yojimbo where Mifune plays an un-named Ronin, who cleans out a village infested by two warring clans. The film was the basis for the great first Sergio Leone/Clint Eastwood Spaghetti western, A Fistful of Dollars. 

I had always thought that the Hollywood Walk of Fame honors actors but it turns out that it honors a great many more performers. For instance, next year will also see names like LL Cool J, Cyndi Lauper, Shirley Caesar, Joseph B. “Joe” Smith, Itzhak Perlman, Adam Levine, and Bruno Mars added in the music category. I considered this category of entertainers wider than simply actors when I recently read more about the burgeoning scandal in Brazil around the state owned energy company Petrobras and its ever-growing fallout.

The fallout has extended far beyond Petrobras, Brazil and even the direct parties who may have been involved. In an article in the Financial Times (FT), entitled “Petrobras woes loom large in Shell deal for BG”, Joe Leahy, Jamie Smyth and Christopher Adams reported on how the ongoing matter is affecting the world of super sized mergers and acquisitions. The rather amazing thing about this issue is not that British Gas (BG) has been caught up in the scandal or even has been alleged to paying bribes to Petrobras.

Rather it is because of assets that BG has in its portfolio. The article said, “Brazil has the potential to become the location of the most troubled assets in BG’s portfolio because the UK company is partner to Petrobras in some of the vast pre-salt oilfields off the country’s east coast in the Santos Basin.” This has led to speculation that “There is a risk that Petrobras will struggle to fulfill its mandate as sole operator for all new pre-salt oilfields because of the corruption scandal, and that this leads to delays in developing the deepwater discoveries, including those involving BG.”

This development arising out of the Petrobras scandal is so significant that BG mentioned it in their annual report, saying “In Brazil, we are closely monitoring how the current corruption allegations affecting Petrobras may impact the cost and schedule of the Santos Basin [pre-salt] development because of supply chain disruption and/or capital and liquidity constraints placed on Petrobras.” Think about that statement for a moment. It is only in the annual report because it could have a ‘material’ effect on BG and BG is a company being acquired by Shell to the tune of £55 million. However, as noted in the FT article, “many analysts say that Petrobras, partly because of the magnitude of the scandal, does not have the capital or management bandwidth to be the sole operator of all new pre-salt fields.”

What if Petrobras becomes unable to develop enough resources to feed South America’s largest democracy’s need for energy? In 2014 alone, the company posted a new loss of $7.4 billion, of which $2.5 billion was attributable to the ongoing bribery and corruption scandal. How much will it cost the country of Brazil to bring in outsiders to develop its own natural resources? This is a real possibility and it was further driven home by another FT article by Joe Leahy, entitled “Petrobras plans 37% cut in investment”. Petrobras currently is required by Brazilian “government policy forcing it to import petrol at international prices and sell it in the domestic market at a subsidized rate.”

Things can only get worse as Leahy reported that the company announced it “was cutting its projection for investment in 2015-2019 to $130.3bn or by 37 percent in relation to its previous plan.” This would lead to a reduction in “domestic production to 2.8m barrels per day of oil equivalent by 2020 from the previous target of 4.2m.” The article ended by noting that Petrobras would “divest $15.1bn in assets and undertake additional restructuring and sales of assets totaling $42.6bn in 2017-18.”

All of this certainly bodes poorly for the citizens of Brazil. For those who claim that bribery is a victim-less crime; I would point to this as Contra-Example A. But this information is also of significance to any Chief Compliance Officer (CCO) or compliance practitioner for a US, UK or other western country. Not only must you review any contracts you had with Petrobras and any of its suppliers; now you must digger several levels deeper. If you are in an acquisition mode, you not only need to look at the contracts of your target to see if they may have been obtained through bribery and corruption, the simple fact of having a contract with Petrobras may put your potential portfolio asset base at risk. For if Petrobras has to cut back 37% on investments at this point, chances are it will only get much worse. This 37% reduction is based on only the first round of estimates of the cost to the company of the bribery scandal.

But more than simply contracts directly with Petrobras, if you are evaluating a target who has contracts with Petrobras suppliers, you may be at equal risk. Not only could those suppliers obtain their contracts with Petrobras through bribery and corruption, those same contracts, even if valid, may not be worth their estimated value if Petrobras cannot fulfill them or even worse, pay for the goods and services delivered thereunder. How about payment terms? Do think for one minute, Petrobras would not unilaterally extend payment dates out 30, 60, 90 even 180 days when it finds itself in more bribery and corruption hot water?

Finally, I think there is a very good chance the US Department of Justice (DOJ) or Securities and Exchange Commission (SEC) could come knocking, unannounced, for any US company doing business with Petrobras or even with significant operations in Brazil. The SEC could do something as simple as send a letter requesting clarification of your internal controls or books and records regarding subcontractors or other third parties in Brazil. If you received such a letter, would you be in position to respond from the requirements for a public company under the Foreign Corrupt Practices Act?

Toshirō Mifune had a long and distinguished acting career. While it is not clear how long, how far and how deep the Petrobras corruption scandal will reach, it is clear that its repercussions will extend far past the energy industry or even Brazil. You need to review and be prepared to respond now.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

June 30, 2015

Another Great Bassist Gone and Tone at the Bottom


Chris SquireAs readers of this blog know, I am a huge fan prog rock fan. So it was with deep sadness and melancholy that I read Chris Squire passed away this weekend. He was a co-founder and bassist for the seminal rock group Yes. The band was one of founders of the musical genre known as ‘progressive rock’ or simply prog rock. According to his obituary in the New York Times (NYT) he was “the only member to have played on every one of Yes’s albums and participated in every one of its tours”. The NYT went on to say that “Mr. Squire’s propulsive and often melodic bass playing was a key element of the Yes sound. A self-taught virtuoso, he has been cited as an influence by many other rock bassists.”

I found some of the tributes from his former band mates to be the most touching and telling of Squire. Bill Bruford, the band’s original drummer, said in statement quoted in the article, “He had an approach that contrasted sharply with the somewhat monotonic, immobile bass parts of today. His lines were important; counter-melodic structural components that you were as likely to go away humming as the top line melody; little stand-alone works of art in themselves.”

Daniel Kreps, writing in Rolling Stone online, in an article entitled “Jon Anderson, Rick Wakeman Remember Yes’ Chris Squire”, quoted Yes co-founder Anderson for the following, “He was an amazingly unique bass player – very poetic – and had a wonderful knowledge of harmony. We met at a certain time when music was very open, and I feel blessed to have created some wonderful, adventurous, music with him. Chris had such a great sense of humor… he always said he was Darth Vader to my Obi-Wan. I always thought of him as Christopher Robin to my Winnie the Pooh.” Keyboardist Rick Wakeman was quoted in the same article “We have now lost, who for me, are the two greatest bass players classic rock has ever known. John Entwistle and now Chris,” Wakeman wrote. “There can hardly be a bass player worth his salt who hasn’t been influenced by one or both of these great players. Chris took the art of making a bass guitar into a lead instrument to another stratosphere and coupled with his showmanship and concern for every single note he played, made him something special.””

As most rock aficionados know, rock music is basically a dialogue between the bass guitar and the drums. With this base line set, the lead guitars and keyboards can go soaring off. That was certainly the formula for Yes. But as it really does not work unless the bass guitar lays the foundation for the entire band, I thought that a tribute to Squire might be a good way to visit one of the points of doing compliance not discussed often enough. While Tone-at-the-Top is almost ubiquitous, one thing not talked about consistently is the tone on the front lines of an organization. Even with a great ‘Tone-At-the-Top’ and in the middle, you cannot stop. One of the greatest challenges for a compliance practitioner is how to affect the ‘tone at the bottom’.

In a MIT Sloan Management Review article, entitled “Uncommon Sense: How to Turn Distinctive Beliefs Into Action”, authors Jules Goddard, Julian Birkinshaw and Tony Eccles looked at this issue when they explored the “often overlooked, critical source of differentiation is [a] company’s beliefs.”

One of the questions that the authors’ answer is: how to tap into this belief system? They posit a structured manner to obtain this information. By using these techniques, they believe that companies can rethink their “basic assumption and beliefs” and identify new directions for their organization. The authors listed seven approaches that they have used which I believe that the compliance practitioner can use to not only determine ‘Tone at the Bottom” but to impact that tone. They are as follows:

  1. Assemble a group. You need to assemble a group of employees who are familiar with the challenges of doing business in a compliant manner in certain geographic regions. Include both long-time employees and those who are relatively new to the organization. The authors also suggest that if you have any employees who have worked for competitors or for other organizations in your industry you include them as well.
  2. Ask questions. You should ask the members of this group to articulate their basic assumptions about your compliance model, about the management model, about your company’s business model and the future of the industry in general. Ask them to do this individually and not as a group.
  3. Categorize the responses. Now comes the work by the compliance practitioner or compliance team, as the authors believe that these assumptions will usually fall into two groups. The first is assumptions that everyone agrees upon, and these are the common beliefs. The second is those assumptions that only a few of the participants will identify – this is what the authors call the “uncommon beliefs”.
  4. Develop tests for common beliefs. For those beliefs that are labeled common – you should consider how you know these to be true? The authors caution that simply because the group may believe that the company operates in a common industry or that we “do it because it has always been done this way” is not necessarily a “hard fact.” Consider what check you could perform to verify the common belief that you desire to test. The authors note that the purpose here is to “identify the ‘common nonsense’ beliefs that everyone holds that are not actually hard laws of nature.”
  5. Develop tests for uncommon beliefs. Here the authors suggest that you need to consider why some people think that these beliefs are true. What is the information or experience that they have drawn upon? Is there any way for you to test these uncommon beliefs?
  6. Reassemble the original group. You should reassemble the original group and have them consider the beliefs that were articulated by them individually in the context of your compliance model and how both your company and your industry do business. Lead a discussion that attempts to identify any assumptions or beliefs that “are quite possibly wrong, but worth experimenting with anyway.”
  7. List of Experiments to perform. The authors believe that the outcome of the first six steps will be “a list of possible experiments [tests] to conduct” to determine the validity of the common and uncommon beliefs. These tests can be accomplished in the regular course of business, through a special project with a special team and separate budget. You should agree on the testing process and review your testing assumptions throughout the process. This process can and should take some time so do not set yourself such a tight time frame that it cannot be fully matured.

The bottom line is that not only must a company ‘talk-the-talk’ of compliance but it must also ‘walk-the-walk’ of compliance. Donna Boehme says that it’s really about the culture of compliance in your organization. Put another way, as Mike Volkov said, in an article entitled “Mood in the Middle Versus Tone at the Top”, “Even when a company does all the right things at the senior management level, the real issue is whether or not that culture has embedded itself in middle and lower management. A company’s culture is reflected in the values and beliefs that exist throughout the company.” You must find a way to articulate and then drive the message of ethical values and doing business in compliance with such anti-corruption laws from the top down, throughout your organization.

So thanks for the tunes and memories Chris while I Keep Calm and Listen to Prog Rock.

Keep Calm and Listen to Prog Rock

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

June 29, 2015

Bristol Palin, Abstinence and the Compliance Defense

AbstinenceToday Bristol Palin informs the debate on the efficacy of a compliance defense to the Foreign Corrupt Practices Act (FCPA). A noted expert on many areas around ethical behavior and family values, Ms. Palin was credited by Mary Elizabeth Williams in a Salon article, entitled “Bristol Palin’s pregnancy announcement is her coming out”, as being the “world’s least successful spokesperson for abstinence” when she announced last week, that, for the second time, she was pregnant out of wedlock. Ms. Palin had previously been a spokesperson for the Candie’s Foundation on, you guessed it, prevention of unwanted pregnancy through abstinence. How does Ms. Palin’s announcement inform the debate on a compliance defense to the FCPA? Quite simply, much like abstinence, the compliance defense is not effective if you say you have one but only if you are doing compliance.

This rather sad fact that although both abstinence and a compliance defense are simple in concept but perhaps not easy to accomplish in the real world was further driven home last week in a Wall Street Journal (WSJ) article by Joel Schectman, entitled “Russian Uranium Probe Reaches Into Small-Town Ohio”, where he reported that “A widening U.S. bribery probe involving Russian uranium has reached from Moscow to a company in the heart of America’s Rust Belt. U.S. authorities are investigating whether an executive in Bremen, Ohio—a rural community with about 1,500 residents roughly 40 miles southeast of Columbus—bribed Russian energy officials to win his company millions of dollars in contracts to supply shipping containers for uranium, according to people familiar with the matter.”

The rather amazing thing about this report is not that bribery and corruption had occurred in the past century or even the past decade but that bribery is reported to have begun in 2011 by Westerman Company and continued at least through 2013 after the entity was acquired by Worthington Industries Inc. Indeed the article identifies the company executive “Barry Keller, a Bremen native who has spent more than three decades at Westerman, working his way up from the shop floor to senior management” as the person involved in paying the bribes. Further, it does not even appear that the bribery scheme itself was too sophisticated or unique. According to Schectman, it involved paying a Russian middleman who “arranged for the bribe payments to be channeled through a maze of secret accounts in Cyprus, Latvia and Switzerland, where they were collected by higher-ranking officials at Rosatom, Tenex’s parent.” The bribes were funded via “5% of a Westerman contract, and would be paid through a consulting invoice”.

Keller’s involvement brings up a key reason why I think having a compliance defense will not increase the doing of compliance. He was the head of the company and then head of the business unit. Is it really possible that a company that did business internationally, with a foreign state owned enterprise and was a US public company did not understand that it needed to have a FCPA compliance program in 2011? Even aside from the fact that the bribery is alleged to have begun when Westerman was an independent entity, did Worthington bother to perform any pre-acquisition due diligence in the FCPA arena when they purchased Westerman in 2012? If Worthington did bother to engage in any pre-acquisition due diligence prior to buying Westerman, how about when it integrated the newly acquired entity into its ongoing compliance program, trained Westerman employees and performed a full FCPA forensic audit of Westerman as surely it identified Westerman’s sales to “Tenex, part of state-owned Russian nuclear company Rosatom” as potentially high risk?

From Schectman’s article it does not appear that Worthington determined internally that there was any FCPA violation in its operations as he quotes the company’s General Counsel (GC), Dale Brinkman, for the following statement “We first learned of [the investigation] in November, and we are fully cooperating with the Justice Department.” That does not sound much like a company that has appropriate internal controls or keeps books and records in accordance with public accounting requirements under the FCPA. But as with abstinence, saying you engage in it is easy.

I think the lesson to be learned from the Worthington matter, and the clarion call for a compliance defense appended to the FCPA, is that adding a compliance defense to the FCPA will not increase compliance with the FCPA. Corporations take their lead from the top on their priorities. If there is not senior management desire to do business in compliance, it does not matter what the benefits of having a compliance defense bring. In 2015, if a company is doing business outside the US with foreign government officials or officials of state owned enterprises, someone in the business, i.e. their lawyers, their auditors or their Board of Directors, knows that they must do business in compliance with the FCPA. I would argue that it was just as well known in 2011 when Westerman Companies is alleged to have begun its bribery scheme. Having a compliance defense will not help drive compliance if the business owner, business leader or senior management is not committed to doing business in compliance with the FCPA.

For even if such a company does institute a compliance defense, it is the doing of compliance which makes a compliance program effective, not having a written program. A key is how a company incentivizes conduct. For doing compliance in any effective way, a company must commit time and resources to the effort. No ‘out of the box’ solution will allow a company to do compliance because the doing of compliance means dealing with an intersecting matrix of employees, technology and third parties. This means that there must be money spent on compliance. In addition to the resource issues, if the company bases its salary, compensation and benefits to employees solely or even largely on sales only; that is what will be emphasized in a company. If, however, there are incentives built into the compensation structure, it will emphasize the importance of the doing of compliance in the day-to-day work of a company.

Bristol Palin has announced she does not want to be ‘lectured’ about her current pregnancy. Maybe her unique intellect has allowed her some insight into the irony of her situation (or then again perhaps not). However she was right about one thing. If you want to ensure that you do not get pregnant, abstinence is about the best way to do so. But abstinence only works if you are doing abstinence, not simply saying you are abstinent. The same is true for adding a compliance defense to the FCPA. A compliance defense only works if you are doing compliance.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

June 26, 2015


Filed under: Brazil,Clean Companies Act,Raphael Gomes — tfoxlaw @ 12:01 am

IMG_3310Ed. Note-it is always gratifying and a little flattering when someone else uses your mantra. So when today’s Guest Post author sent me a blog with ‘Document Document Document’ in the title, I was sold. Today Raphael Gomes, from the law firm of Chediak Advogados, discusses the need for documentation under the Brazilian Clean Company Act. 

It was only 14 months after Law No. 12.846/2013, Act, entered into force that Brazil finally issued regulations regarding its corporate anti-bribery statute, the so-called Clean Company Act. President Dilma Rousseff issued Decree No. 8.420/2015 on March 18th, which provides for further regulations around the Clean Company Act, with focus on 5 areas: (i) procedural rules for the administrative enforcement of the Act against organizations; (ii) calculation of the penalties; (iii) leniency agreements; (iv) integrity (compliance) programs; and (v) sanctioned, banned, or restricted companies lists (CEIS and CNEP).

As to anti-bribery compliance programs, referred to as integrity programs under the Clean Company Act, the Decree defines the 16 elements of a complete program that will be taken into account in its evaluation by the enforcement authorities, which we have outlined in our post “Compliance Programs under the Brazilian Clean Company Act.

About a month after the Decree was issued, the Federal Comptroller’s Office (Controladoria-Geral da União – CGU), the administrative body responsible for enforcing the Clean Company Act at the federal administration level, issued additional regulations regarding (i) the process for evaluation of the investigated company’s compliance program (Reg. 909 – Portaria CGU nº 909); (ii) procedural rules for the administrative enforcement proceeding or “PAR” (Reg. 910 – Portaria CGU nº 910); the rules for determining the company’s annual gross revenues for calculation of the monetary fines (CGU IN 01/2015); and (iv) the rules around the government’s restricted parties lists CEIS and CNEP (CGU IN 01/2015).

Pursuant to Article 18 of Decree 8420, a company that demonstrates to have a robust, effective compliance program in place shall receive a reduction in the monetary fines of up to 4% of the company’s gross annual revenues for the year preceding the opening of the PAR. This is the major mitigation factor under the Brazilian anti-bribery statute, twice as valuable as voluntary disclosure, and potentially three times as valuable as cooperation. In practice, in some cases the credit for a company’s compliance program may represent a discount of more than 99% of the monetary fine, lowering it to 0.1% of the gross annual revenues, the minimum fine allowed under the Clean Company Act.


Reg. 909 is of particular interest to the Compliance professional, for it provides guidance as to how the investigated company’s compliance program is to be evaluated by the Brazilian Federal authorities, for determining the percentage of credit the company is entitled to. It is a real eye-opener and makes us realize how global compliance and anti-bribery laws and best practices are becoming more and more aligned. Tom Fox constantly reminds us of his mantra: Document, document and document. Well, it looks as though Brazilian enforcers, particularly the CGU, have been reading Tom’s blog and have taken this mantra of his to heart.

In Reg. 909 the CGU sets forth that programs will be evaluated having two basic documents prepared by the company (the Profile Report and the Program Conformity Report) as the basis and starting point for their review. It further provides for that the company shall produce evidence that the program works and is a part of the company’s routine, and demonstrate how the program has worked to help the company prevent, detect, and remediate the very misconduct that is the object of the enforcement action.

The Profile Report should describe:

  • the industry sectors and geographies in which the company operates;
  • organizational structure, including internal hierarchy, decision-making process, boards, departments, and divisions;
  • the number of direct and indirect employees;
  • touch points with the government (national or foreign), highlighting:
  • the importance of licenses, permits, or authorizations to its activities,
  • the quantity and value of contracts with the government, and
  • the frequency and relevance of the use of third party intermediaries in its interactions with the government;
  • equity interests relating to subsidiaries, controlled, parent, and affiliated companies, as well as to JVs or consortia. 

Regarding the Conformity Report, Article 4 of Reg. 909 provides for that the legal entity shall provide information on the structure of the program, describing what elements of the program (listed on Article 42 of Decree 8420) where implemented, how they were implemented, and explaining the importance of the implementation of each element vis-à-vis the company’s peculiarities, as per the Profile Report .

The effectiveness of the company’s program may be evidenced by means of official documents, e-mails, written correspondence, statements, internal memos, minutes of meetings, reports, manuals, computer screen shots, video and audio recordings, photographs, purchase orders, invoices, accounting records, or any other documents, preferably in digital format.

Apparently, the Brazilian enforcers expect the companies to heavily invest in documenting all they can about their compliance programs, and intend to rely on document review for most of the process of evaluation of a company’s program. Not only does Reg. 909 require for the two reports mentioned above to be submitted along with the company’s administrative defense, but it also makes it crystal clear that being able to provide complete, clear, and organized documentation to demonstrate the effectiveness of the program will be key for companies to secure credits that may add up to four percent of a company’s annual revenues.

In paragraph 2 of article 4 of Reg. 909, the CGU expressly lists documents that should be created, copied, archived, retrieved, and submitted to the authorities in an organized fashion, in digital format, in case of an investigation.


The Brazilian Clean Company Act lists many conducts that are regarded as harmful to the public administration, which conducts include, inter alia, fraud and related misconduct involving government procurement, obstruction of government inspections or investigations, and, of course, bribery. The Act provides for strict liability for companies that benefit from violations, which renders it more likely than it was before the law passed for any company to be faced with investigations of potential violations, be it for conduct of its own employees or that of its third party intermediaries.

In such an environment, it is natural for companies not only be willing to put a robust compliance program in place, to prevent, detect, deter, and remediate instances of wrongdoing, but also to wish to secure the maximum credit of 4% when facing an enforcement action, in case all else fails.

Upon being notified by the enforcement authorities of the investigation, with the opening of the PAR, the company shall have a window of 30 days to submit the defense (article 16 of Reg. 910), including the defense arguments and evidence relating to the concrete facts and merits of the case. The defense shall also include the Profile Report, the Program Conformity Report and all the supporting documentation.

What one should look to avoid is that, in the middle of a perfect storm, in which the company’s compliance and legal professionals will have to deal with managing the crisis, interacting with the company’s PR and Investor Relations teams, informing all stakeholders, on a daily or weekly basis, of the issues at hand, the defense strategy, action plan and progress, with a very limited window of time to gather all information they can about the specifics of the case and prepare a defense, is to have to dedicate time, resources, and efforts to tasks that could have been dealt with in advance, under no time pressure.

We would therefore deem it advisable for companies operating in Brazil to prepare and have in their files, ready for submission at any time, both the Profile Report and the Program Conformity Report, along with all the evidence they can gather in advance, in an organized manner and in digital format, evidencing the effectiveness of its program. It is the Compliance Officer’s responsibility to work with the IT department to ensure that the company has a document archive and retrieval process in place to guarantee that documentation pertaining to the compliance program is safely stored in one centralized repository.

Your compliance program, documented and presented in a complete, clear, and organized manner, along with evidence of its effectiveness, may be worth up to 4% of your company’s annual revenues. Make sure you are ready to earn it.

And remember:

What does Thomas Fox say? Document, Document, and Document.


Rafael Mendes Gomes is the partner in charge of compliance and anti-bribery at Chediak Advogados, with offices in São Paulo and Rio de Janeiro, Brazil. The firm offers legal assistance to both Brazilian and international clients across different industries and business sectors.


You can access Chediak Advogados Compliance and Anti-bribery web page here.

June 25, 2015

Custer’s Last Stand and Risk Management

Custer's Last StandOn this day in 1876 one of the greatest failures in risk management took place when Lieutenant Colonel George Armstrong Custer and his entire 7th Cavalry were wiped out at the Battle of the Little Big Horn. Custer had split his command into three wings and he took his battalion of 200 or so men down the center of what he thought would be little resistance. Instead he found that he was facing a far superior force of 3000 largely Sioux warriors who quickly overwhelmed and defeated Custer’s command, with all US troops being killed. There is now some debate on whether all the cavalrymen were actually killed by the Native Americans or took their own lives, saving the last bullet for themselves, in western parlance.

Historians have debated over time the reason for Custer’s defeat. Was it arrogance; bad intelligence; faulty command, just plain stupidity or even a wish for martyrdom by Custer? Whichever the cause, it was the worse defeat of the US Army by Native Americans in the Western campaigns of the later 1800s. Today, it might be termed as a faulty assessment and management of the risks involved.

I thought about Custer and his defeat when I read a recent article in the Harvard Business Review (HBR), entitled “Strategy How to Live With Risks. It presented risk, risk assessments and risk management in a new light, a key acumen being that risk management should be used as a “protection shield, not an action stopper.” It was based upon a research paper by the CEB, entitled “Reducing Risk Management’s Organizational Drag”, which I thought it had some interesting insights for the Chief Compliance Officer (CCO) or compliance practitioner.

The first insight is that, in many instances, companies are assessing risks that are in the rear-view mirror. The author pointed to the Sarbanes-Oxley (SOX) Act, passed in response to the Enron and Worldcom accounting scandals in noting, “In the wake of the 2008 financial crisis many large banks changed their business models, and other companies implemented systems to better manage credit risks or eliminate overreliance on mathematical models.” This type of mentality can lead to what the author says, is “a variation on what military historians call “fighting the last war.” As memories of the recession fade, leaders worry that risk management policies are impeding growth and profits without much gain.” The author went on to quote Matt Shinkman of CEB, a member based advisory company, for the following insight “Firms are questioning whether the models they put in place after the financial crisis are working—and more fundamentally questioning the role of risk management in their organizations.”

This retrospective look back is coupled with what the author says is a decision making process which “is too slow, in part because of an excessive focus on preventing risk” and not managing risk; in other words, companies were slowed down even further by something termed “organizational drag”. Companies need to find new mechanisms to assess and manage risk going forward. The best way to do so, many companies have indicated, is through reorganizing or reprioritizing risk management and the article presented “three best practices” in doing so.

Strike the Right Balance Between Risk and Reward

Recognizing that risk management is often simply ‘just saying no’, the HBR articcle suggests that “Today’s risk managers see their role as helping firms determine and clarify their appetite for risk and communicate it across the company to guide decision making. In some cases this means helping line managers reduce their risk aversion.” The interesting insight I found here is that if an asset is low performing it may be because the management is so risk averse. This may present a CCO or compliance practitioner with an opportunity to increase growth through other risk management solutions that they could implement.

Focus on decisions, not process

This insight is one that CCO and compliance practitioners should think about and try and implement. Recognizing that risk assessments are important, the author believes that risk managers should focus more on decisions concerning risk rather than the process of determining risk. This means, “In addition to relying on paperwork or process, risk managers are turning to tools (such as dashboards that show risks in real time) and training that help employees assess risk. They are also helping companies factor a better understanding of risk into their decision making.”

By having a seat at the senior management’s table, a CCO or compliance practitioner can help identify risk issues early on in planning. This allows a COO to help craft a risk management solution, or even better yet show colleagues how to “spot potential problems and managers see how their projects fit into the company’s overall portfolio of projects, each with its own set of risks.” The author again quoted Shinkman, “This is less about listing risks from a backward-looking perspective and more about picking the right portfolio of risky projects.”

Make employees the first line of defense

The author channels his inner Howard Sklar (water is wet) by stating, “Decisions don’t make themselves, people make them”. However from that insight, the author believes that “smart companies work to improve employees ability to incorporate appropriate levels of risk when making choices.” But this means you must not only adequately train your employees to spot the appropriate risk but you, as CCO must provide them with tools to manage the risk. The author wrote, “Companies are also trying to identify which types of jobs or departments face a disproportionate share of high-risk decisions so that they can aim their training at the right people. They’re focusing that training less on risk awareness and more on simulations or scenarios that let employees practice decision making in risky situations. Finally, risk managers are becoming more involved in employee exit interviews, because people leaving an organization often identify risks that others aren’t able or willing to discuss.”

The article ends by noting that the goal is “to transform risk management from a peripheral function to one with a voice integrated into the day-to-day management” of an organization. That is also viewed as a component of CCO 2.0 and a more mature model of improvement. By focusing on training employees on how to spot Foreign Corrupt Practices Act (FCPA) compliance risks and then providing them with the tools to adequately manage that risk, CCOs can deliver greater value.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

June 24, 2015

Pink Flamingos and the Compliance Audit

FeatherstoneThe creator of one of the most ubiquitous symbols of mid-century Americana died earlier this week. Don Featherstone, the creator of the pink plastic lawn flamingo, the ultimate symbol of American lawn kitsch, has died. He was 79. Featherstone, a trained sculptor with a classical art background, created the flamingo in 1957 for plastics company Union Products, modeling it after a bird he saw in National Geographic. Millions of the birds have been sold. Whether you think of the Pink Flamingo as a symbol of Miami Vice, Jon Waters and Devine or for something less salacious, here is to Featherstone, a true original.

While Featherstone created one of the ultimate symbols of the second half of the 20th century for a generation of South Floridians, the Japanese company Takata Corporation (Takata) continues to be in the news for much less prestigious reasons. As reported in the New York Times (NYT), in an article entitled “Senate Panel Says Tanaka Cut Audits on Safety”, Hiroko Tabuchi and Danielle Ivory said “In the middle of what would become the largest automotive recall in US history, the Japanese airbag manufacturer Takata halted global safety audits to save money”. Interesting (or perhaps ominously might be a better word) Takata responded by saying it had not halted safety audits for products but rather for worker safety. Doesn’t that give you some comfort?

A US Senate committee report found that “Takata halted global safety audits at its manufacturing plants in 2009, a year after Honda had started recalling a small number of cars to replace the airbags.” These audits were later restarted in 2011 but when they found safety issues related to airbag manufacturing in two key plants, “those findings were not shared with Takata’s headquarters in Tokyo, the report said, citing internal emails from Takata’s safety director at the time.” Moreover, “when the safety director returned to the plant months later to conduct a follow-up audit, employees appeared to scramble to create the appearance of a safety committee within the plant.” Finally, and perhaps most damningly, the report cited an internal Takata email which said, “No safety committee, as such, has been formed” at the plants in question.

Foreign Corrupt Practices Act (FCPA) compliance in many ways follows some of the paths laid out by corporate safety departments some 20-30 years ago when safety became much more high profile in US corporations. The safety committee and safety audits became mainstays of any best practices in the area of safety for a company. These techniques inform any anti-corruption best practices compliance program, either under the FCPA, UK Bribery Act or any other anti-corruption regime. Indeed audits are specifically delineated in the FCPA Guidance as a way to assist in the continuous monitoring of your compliance regime. Such an audit can be thought of as a systematic, independent and documented process for obtaining evidence and evaluating it objectively to determine the extent to which the compliance criteria are fulfilled. There are three factors which are critical and unfortunately with Takata seemed to be lacking in its safety audit protocol: (1) an effective audit program which specifies all necessary activities for the audit; (2) having competent auditors in place; and (3) an organization that is committed to being audited.

Auditing can take several different forms in an anti-compliance program. As a matter of course, you should audit the compliance program in your own organization. A forensic audit can collect and analyze accounting and internal-controls evidence in your compliance regime. This information can be used to produce a fact-based report that can inform the decision-making process in inquiries, investigations and dispute resolution. The by-products of a forensic audit can include remediation strategies to help a company mitigate and remedy procedural or internal-controls gaps that allowed the underlying issue to occur. Further, an internal audit can review a compliance process to determine if employees are following prescribed processes or internal controls, in an operational Sarbanes-Oxley (SOX) or FCPA compliance audit.

In addition to the collection and analysis of evidence, an auditor’s objective is to attest to the credibility of assertions that are under examination, such as the material accuracy of financial statements for which the audited company’s management is responsible. Obviously one of the functions of such an audit is to determine if further investigation is warranted.

Now imagine if this scenario had been followed by Takata. The lack of a safety committee is a glaring omission at any manufacturing facility. Simply noting this and reporting it up the chain could have gone some way towards preventing the situation the company now finds itself in; with a worldwide recall of up to 32 million vehicles. The same is true for a compliance audit. Just as monitoring can provide information to you on a more real-time basis; a compliance audit compliments this real-time oversight with a much deeper dive into what has happened on a historical basis.

The recent BHP Billiton FCPA enforcement action is certainly one to look at in this context. Although there was a committee set up to review gifts and travel requests for the company’s 2008 Olympic hospitality program, the committee did not fulfill this charge. It was alleged in the Securities and Exchange Committee (SEC) settlement documents that this committee was never intended to pass muster on the applications for tickets and travel for government officials but was simply there to provide guidance.

Once again this situation points out the difference between having a paper compliance program in place and the actual doing of compliance. Even with an appropriate oversight structure in place BHP Billiton did not do the work of compliance by evaluating the applications for travel and tickets to the Beijing Olympics but left it to the devices of the business unit employees who were making the requests and ultimately most directly benefited from the gifting.

Another area ripe for audit in your compliance program is your third parties. While there is no one specific list of transactions or other items which should be audited when it comes to your third parties below are some of the areas you may wish to consider reviewing:

  • Contracts with supply chain vendors to confirm that the appropriate FCPA compliance terms and conditions are in place.
  • Determine that actual due diligence took place on the third party vendor.
  • Review the FCPA compliance training program for any vendor; both the substance of the program and attendance records.
  • Does the third party vendor have a hotline or any other reporting mechanism for allegations of compliance violations? If so how are such reports maintained? Review any reports of compliance violations or issues that arose through anonymous, hotline or any other reporting mechanism.
  • Does the third party vendor have written employee discipline procedures? If so have any employees been disciplined for any compliance violations? If yes review all relevant files relating to any such violations to determine the process used and the outcome reached.
  • Review expense reports for employees in high risk positions or high risk countries.
  • Testing for gifts, travel and entertainment which were provided to, or for, foreign governmental officials.
  • Review the overall structure of the third party vendor’s compliance program. If the company has a designated compliance officer to whom, and how, does that compliance officer report? How is the third party vendor’s compliance program designed to identify risks and what has been the result of any so identified?
  • Review a sample of employee commission payments and determine if they follow the internal policy and procedure of the third party vendor.
  • With regard to any petty cash activity in foreign locations, review a sample of activity and apply analytical procedures and testing. Analyze the general ledger for high-risk transactions and cash advances and apply analytical procedures and testing.

The compliance function still is behind the safety function in terms of maturity. Because of this there are many lessons which a Chief Compliance Officer (CCO) or compliance practitioner can draw upon from our colleagues in safety. The safety audit is certainly a technique that can be drafted into your compliance program. But as the ongoing Takata air bag debacle demonstrates, your audit only works if you actually perform it. In other words, the protocol is simple, everyone understands you need to audit, but try and cut costs or corners and you will pay for it in the long run.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

June 23, 2015

Fraud and the Detection of the Sources for Bribery


Detection of FraudIn a recent White Paper authored by Peter Smith for OFS Portal, entitled “Procurement and Fraud in the Supply Chain”, where he examined “fraud linked to procurement and supply chain activities.” Smith focuses on where fraud can occur in the procurement process. From this starting point, he suggests “mitigating actions that organisations can take to protect themselves against fraud.” I found this article to be an excellent review of Supply Chain (SC) activities which the Chief Compliance Officer (CCO) or compliance practitioner could put to good use in reviewing their company’s Foreign Corrupt Practices Act (FCPA) anti-corruption and anti-bribery regime.

A. The Problem – How Does Fraud Happen?

Smith starts by classifying fraud in way which will assist the reader in understanding how it occurs. He believes there are “three critical factors to consider: the perpetrator(s), the plan and the point of failure.” The perpetrator is the one “behind the fraud and either executes it directly or through others.” In the anti-corruption world of the FCPA, this can be through an agent or a supplier who is working to help execute the fraud.

Interestingly, in the area of these third parties (and hence the greatest area of risk for FCPA compliance practitioners to consider) Smith notes that “The plan and point of failure factors are linked in that often the plan relies on the point of failure. In other words, most frauds take advantage in some weakness in the process, technology, policy or systems of combination of those.” Smith writes that there are three key phases “in the procurement life-cycle that can be considered; (1) the supplier selection phase; (2) the contract negotiation and award phase; and (3) the contract delivery management phase.”

Phase I – Supplier Selection and Qualification

This phase should be well known to the compliance practitioner as a part of the third party life-cycle management step denominated as due diligence. But Smith asks that you consider factors other than simply whether someone is on the Denied Parties List (DNP) or is a Politically Exposed Person (PEP). He suggests that you consider misrepresentation by the third party in the nature of “concealing the true nature of its business, history or ownership when it bids for the work.” He also points out that through collusion and cartels, persons or entities can work to control a market. If you did any work with Petrobras over the years, you will certainly recognize that many if its approved suppliers operated in this manner. Given what we now know about how corrupt Petrobras was, this is not too surprising.

But Smith also suggests that employees may be involved in skewing the selection process towards a corrupt agent or other partner. He recommends reviewing the bid process to see if there was bias in the competition, which would push an otherwise arms-length award to a corrupt partner. This could occur through biased competition through specification, where an employee would “construct a specification that makes it likely or inevitable that a particular supplier will win the competitive process.” The next is biased competition through tailoring the evaluation process which gives weight to the specific strengths of a corrupt third party. Finally, Smith points out that there can be biased competition through information leakage when a company employee will leak confidential information to a third party to give them an advantage in the bidding process.

Phase II – Contracting

Smith says the “next critical point at which fraud can take place is during the contract negotiations and in agreeing the detailed terms and conditions.” Moreover, Smith believes this stage is critical if often overlooked because “the seeds are often sown at the contracting stage.” Scenarios can include where there is a certain level of ‘local content’ required “but without any clear contractual mechanism to explain how it will be measured or policed.” As any CCO or other FCPA compliance practitioner would recognize, local content is one of the easiest ways to get into FCPA high risk so managing that risk is critical. I found Smith’s concern with setting out the clear legal terms and conditions around any such requirement as a good way to manage the high risk.

Phase III – Contract Delivery and Management

Here Smith laid several different fraud schemes which could facilitate a bribery plan. The first is fake invoices which can rely on “poor processes within an organisation” to spot. However this scheme can also rely on a company insider to approve such fabrications. Next is “volume over-invoicing”. In this scheme, while a supplier does supply some goods or services, the invoice is raised for more than has been delivered. If there is a scheme to create a pot of money to be used to fund bribes, there will need to be an internal company accomplice to “smooth the way by authorizing receipts or invoices.” Next there is “price-related over-invoicing” the third party will over-price the goods or services, above what is allowed under the contract. Another scheme set out by Smith is “invoice diversion” where “a legitimate payment that should go to a certain supplier is diverted to a third party fraudulently.” Another scheme can simply be to ease the contract terms and conditions which allow the third party to receive a benefit with nothing in return being delivered back to the company. Finally, there is what Smith details as one of the “toughest frauds to detect”, that being the delivery of lower quality products than is contractually specified.

B.The Solution – How to Reduce Fraud

Smith believes that fraud prevention can be built around a troika of concepts. (1) You need to have “effective procurement and spend management policies in place. (2) You must “use appropriate and robust processes”. (3) Finally “applying the right technology to support and manage those processes.” In his paper he followed the same outline on how to reduce the instances of fraud.

Phase I – Supplier Selection and Qualification

While a clear procurement policy is the starting point, it is only the starting point. Having a transparent process is important as well as adequate supplier qualification details. He notes that multiple sign-offs should be in place to ensure that one person does not control the entire process. This should also be incorporated into the communications trail with the competitors to ensure that no one third party receives confidential information. Obviously an appropriate level of due diligence should be applied to confirm that not only are the third party’s who they represent themselves to be but that they are also qualified to do the work or deliver the services. Finally, there should be controls around onboarding “so that firms who are actually going to be suppliers go through more rigorous checks before they are accepted onto” the Vendor Master List.

Phase II – Contracting

Obviously the starting point for any business relationship should be a well-drafted contract. However, for larger organizations Smith believes that “a contracts database or contract lifecycle management system is essential.” To the greatest extent possible there should be standard compliance and legal terms and conditions, coupled with an “appropriate level of sign-off and approvals management for contracts.” Finally, segregation of duties (SOD’s) “to make sure that there are checks and balances and that no one person holds too much power in the process.”

Phase III – Contract Delivery and Management

As I often say in the lifecycle management of third parties, the real work begins when the contract is signed. Smith believes that many of the routes of fraud, “can be closed off by taking a few precautions” which include some of the following steps. First and foremost is “no purchase order, no pay” but this also means there should be an invoice from the vendor which is matched to the contract for accuracy. Once again checks and balances, SOD’s for sign-offs and approvals must be built into your payment system. There should be controls around changes to the contract and, more importantly, changes to any payment details. Lastly, ongoing oversight and monitoring through controls analytics and auditing should be employed on the back end to verify delivery of goods or services.

I found Smith’s White Paper to be an excellent review for the CCO or compliance practitioner around not only the mechanism of how fraud occurs but a review of the techniques for fraud prevention. While his concepts may seem like a review for the compliance practitioner, it also allows you to think through how corruption might take place in your organization. The briber has to get the money from some source and Smith’s White Paper can give you insights on where you might look.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015


June 22, 2015

George Carlin and Erga Omnes: the Petrobras Bribery Scandal Expands

George CarlinOn this date in 2008 George Carlin died. If you grew up in the late 1960s or early 1970s and you had anti-parental or anti-establishment inklings, which of course all teenagers do, you knew about George Carlin. In the early 1960s, Carlin was a relatively clean-cut, conventional comic. But around 1970, he reinvented himself as an eccentric, biting social critic and commentator. In this new incarnation, Carlin began appealing to a younger, hipper audience. He grew out his hair and added a beard together with a wardrobe in the stereotypically hippie style.

Carlin’s comedy also became counter-culture, not Cheech and Chong, hippy-dippy dopers, but with pointed jokes about religion, politics yet with frequent references to drugs. His second album with his new routine, FM/AM, won a Grammy Award for Best Comedy Recording. My favorite cut was the 11 O’Clock News. But it was his third album Class Clown that had, what I believe, to be the greatest comedy monologue ever, the profanity-laced routine “Seven Words You Can Never Say on Television.” When it was first broadcast on New York radio, a complaint led the Federal Communications Commission (FCC) to ban the broadcast as “indecent.” The US Supreme Court later upheld the order, which remains in effect today. The routine made Carlin a hero to his fans and got him in trouble with radio brass as well as with law enforcement; he was even arrested several times, once during an appearance in Milwaukee, for violating obscenity laws.

Interestingly I thought about Carlin and his pokings of the Establishment (AKA The Man) when I read several articles over the weekend about the recent spate of arrests around the Petrobras bribery and corruption scandal. In article in the Wall Street Journal (WSJ), entitled “Brazil Probe Sweeps Up Corporate Magnates” Will Connors, Rogerio Jelmayer and Paul Kiernan reported that “Brazilian officials arrested the heads of two Latin American construction giants, alleging they helped to mastermind a cartel that stole billions of dollars from state-run oil company Petrobras with the help of corrupt politicians to whom they paid kickbacks.” Also arrested with the heads of the two companies, Marcelo Odebrecht, head of Odebrecht SA and Chief Executive Officer (CEO) of Andrade Gutierrez, Otávio Azevedo.

The WSJ article reported that “Odebrecht is Latin America’s largest construction conglomerate, with business in the U.S., Europe and Africa, and whose head, Marcelo Odebrecht, is a household name in Brazil. Andrade Gutierrez has business in 40 countries. The privately owned companies are deeply involved in the development of stadiums and infrastructure for the 2016 Summer Olympics in Rio de Janeiro.” Moreover, Odebrecht is reported to have “a presence in 21 countries”. Obviously a question is if the company had engaged in bribery and corruption in Brazil, did they do so in any of the other countries in which they are doing business?

Interestingly, these arrests “come months after the heads of other construction companies were detained by Brazilian authorities.” Indeed in a BBC article in , entitled “Petrobras scandal: Top construction bosses arrested in Brazil”, David Gallas said, “Odebrecht had been named by former Petrobras executives as one of the companies that allegedly paid bribes in exchange for contracts with the oil firm, but until now the firm had not been targeted by investigators.” The WSJ article quoted Brazilian prosecutor Carlos Fernando dos Santos Lima who said at a news conference that the executives from the two companies had not been arrested earlier as the entities, “had a more sophisticated system for making the alleged bribe payments, using foreign bank accounts in Switzerland, Monaco and Panama, so it took longer to prove their case.” David Fleischer, a Brasilia based political analyst, quoted in the WSJ article was even more circumspect. He said, “The prosecutors are very careful. If you’re going after big fish you want to make sure you can take them down.”

Brazilian police said the arrests were “Erga omnes” which the WSJ translated from Latin as “towards all”. I thought about that statement in light of the ongoing debate about enforcement of the Foreign Corrupt Practices Act (FCPA) here in the US. On one side is the Chamber of Commerce and their allies who raise the ever-burgeoning cry that the Department of Justice (DOJ) needs to prosecute the invidious ‘Rogue employees’ who violate the FCPA. You will notice they never want the DOJ to look at the executives who might facilitate payment of bribes in the first place; whether through faux commitment to doing business in compliance, failing to properly allocate resources to compliance and ethics, simply rewarding those employees who git ‘er done no matter what the circumstances or (my favorite) putting a paper program in place and calling it a best practices compliance program.

Indeed those progenitors of relaxed enforcement want the DOJ to back off and let them do business the old fashioned way. However, if the bribery and corruption news from the first half of this year has told the world anything, it is about the dire effects of allowing such illegal conduct to take place and warning against slacking off laws which mandate doing business without bribery and corruption. In another WSJ article, entitled “Roots of a Brazilian Scandal That Weighs Heavily on the Nation’s Economy, Politics”, Marla Dickerson noted, “The scandal has crippled Petrobras, Brazil’s largest and most important company. In late April, the company wrote off more than $16 billion related to losses from graft and overvalued assets. The company’s woes have all but paralyzed the nation’s oil and gas sector. Hurt by slumping oil prices and strapped for cash, Petrobras has slashed investments, sparking a wave of credit downgrades, bankruptcies and layoffs among its suppliers that the weighed on Brazil’s economy.”

I wonder what George Carlin might have thought about all of this. He might have said that what else would you expect but I am relatively certain he would have done so while also sticking his thumb in the eye of The Man. 

For a YouTube version of the 11 O’Clock News, click here.

For a YouTube version of the 7 words you can never say on television, click here.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015


Next Page »

The Rubric Theme. Blog at WordPress.com.


Get every new post delivered to your Inbox.

Join 5,347 other followers