FCPA Compliance and Ethics Blog

May 27, 2015

Economic Downturn Week, Part III – The Desktop Risk Assessment

Economic DownturnI continue my exploration of actions you can take to improve your compliance program during an economic downturn with a review of what my colleague Jan Farley, the Chief Compliance Officer (CCO) at Dresser-Rand, called the ‘Desktop Risk Assessment’. Both the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) make clear the need for a risk assessment to inform your compliance program. I believe that most, if not all CCOs and compliance practitioners understand this well articulated need. The FCPA Guidance could not have been clearer when it stated, “Assessment of risk is fundamental to developing a strong compliance program, and is another factor DOJ and SEC evaluate when assessing a company’s compliance program.” While many compliance practitioners have difficulty getting their collective arms about what is required for a risk assessment and then how precisely to use it; the FCPA Guidance makes clear there is no ‘one size fits all’ for about anything in an effective compliance program.

One type of risk assessment can consist of a full-blown, worldwide exercise, where teams of lawyers and fiscal consultants travel around the globe, interviewing and auditing. Of course this can be a notoriously expense exercise and if you are in Houston, the energy industry or any sector in the economic doldrums about now, this may be something you can even seek funding for at this time. Moreover, you may also be constrained by reduced compliance personnel so that you can not even perform a full-blown risk assessment with internal resources.

However if there is one thing that I learned as a lawyer, which also applies to the compliance field, it is that you are only limited by your imagination. So using the FCPA Guidance’s no ‘one size fits all’ proscription, I would submit that is also true for risk assessments. You might try assessing other areas annually, through a more limited focused risk assessment, literally while staying at your desk and not traveling away from your corporate headquarters.

Some of the areas that such a Desktop Risk Assessment could inquire into might be the following:

  • Are resources adequate to sustain a culture of compliance?
  • How are the risks in the C-Suite and the Boardroom being addressed?
  • What are the FCPA risks related to the supply chain?
  • How is risk being examined and due diligence performed at the vendor/agent level? How is such risk being managed?
  • Is the documentation adequate to support the program for regulatory purposes?
  • Is culture, attitude (tone from the top), and knowledge measured? If yes, can we use the information enhance the program?
  • Disciplinary guidelines – Do they exist and has anyone been terminated or disciplined for a violating policy?
  • Communication of information and findings – Are escalation protocols appropriate?
  • What are the opportunities to improve compliance?

There are a variety of materials that you can review from or at a company that can facilitate such a Desktop Risk Assessment. You can review your company’s policies and written guidelines by reviewing anti-corruption compliance policies, guidelines, and procedures to ensure that compliance programs are tailored to address specific risks such as gifts, hospitality and entertainment, travel, political and charitable donations, and promotional activities.

You could assess your company’s senior management support for your compliance efforts through interviews of high-level personnel such as the Chief Financial Officer (CFO), General Counsel (GC), Head of Sales, Chief Executive Officer (CEO) and all Board, Audit or Compliance Subcommittee members to assess “tone from the top” and their actual knowledge about the Foreign Corrupt Practices Act (FCPA) and your compliance program. You can examine resources dedicated to compliance and also seek to understand the compliance expectations that top management is communicating to its employee base. Finally, you can gauge operational responsibilities for compliance.

Such a review would lead to the next level of assessment, which would be generally labeled as communications within an organization regarding compliance. You can do this by assessing compliance policy communications to company personnel but even more so by reviewing such materials as compliance training and certifications that employees might have in their files. If you did not yet do so, you should also take a look at statements by senior management regarding compliance, such as actions relating to terminating employees who do business in compliance but do not make their quarterly, semi-annual or annual numbers set in budget projections.

A key element of any best practices compliance program is internal and anonymous reporting. This means that you need to review mechanisms on the reporting of suspected compliance violations and the actions taken on any internal reports, including follow-ups to the reporting employees. You should also assess whether those employees who are seeking guidance on compliance for their day-to-day business dealings are receiving not only adequate but timely responses.

I do not think there is any dispute that third parties represent the highest risk to most companies under the FCPA, so a review of your due diligence program is certainly something that should be a part of any risk assessment. But more than simply a review of procedures for due diligence on third party intermediaries, you should also consider the compliance procedures in place for your company’s mergers and acquisitions (M&A) team; focusing on the pre-acquisition phase.

One area that I do not think gets enough play, whether in the FCPA Inc. commentary or in day-to-day practice is looking at what might be called employee commitment to your company’s compliance regime. So here you may want to review your compliance policies regarding employee incentives for compliance. But just as you look at the carrots to achieve compliance with your program, you should also look at the stick, in the form of disciplinary procedures for violations. This means you should see if there have been any disciplinary actions for employee compliance violations and then determine if such discipline has been applied uniformly. If you discipline top sales people in Brazil, you have to discipline your top sales folks in the US for the same or similar violations.

This list is not intended to be a complete list of items, you can pick and choose to form some type of Desktop Risk Assessment but hopefully you can see some of the areas you can assess. My suggestion is that you try identifying and focusing on core compliance components in your organization. Obviously there are probably a million things you could fix. However, you cannot fix everything, so you must make a decision about your primacies, and then act on them. A Desktop Risk Assessment may well help you to do so.

As with the other suggestions I have put forward during the Economic Downturn Week series, if you perform an annual Desktop Risk Assessment with a full worldwide risk assessment every two years or so, you should be in a good position to keep abreast of compliance issues that may change and need more or greater risk management. Moreover, when funds and resources do become available to you and the compliance function, you will have a stronger program and one which move towards best-in-class. Finally, do not forget that the FCPA Guidance ends its section on risk with the following, “When assessing a company’s compliance program, DOJ and SEC take into account whether and to what degree a company analyzes and addresses the particular risks it faces.” By using the Desktop Risk Assessment during an economic downturn, you can answer any regulator who asks what have you done to manage the risks in your company, by using the resources and tools that were available to you.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Economic Downturn Week, Part II – The Golden Gate Bridge and Employment Separation – Hotlines and Whistleblowers During Layoffs

Golden Gate BridgeToday, we celebrate one of the greatest engineering achievements of the century. On this date in 1937, the Golden Gate Bridge opened. At 4200 feet long, it was at the time the world’s longest suspension bridge. But not only was it an engineering and architectural milestone, its aesthetic form was instantly recognized as classical and to this day is one of the most iconic structures in the US if not the world. With just a few years until its 80th birthday, it demonstrates that a lasting structure is more than simply form following function but contains many elements that inform its use and beauty.

I use the Golden Gate Bridge as an entrée to my continued discussion on the series on steps that you can use in your compliance program if you find yourself, your company or your industry in an economic downturn. Whether you are a Chief Compliance Officer (CCO) or compliance practitioner, these steps are designed to be achieved when you face reduced economic resources or lessened personnel resources going forward due to a downturn your economic sector. Yesterday, I discussed mapping your current and existing internal controls to the Ten Hallmarks of an Effective Compliance Program so that you can demonstrate your compliance with the Foreign Corrupt Practices Act’s (FCPA) internal control prong to the accounting procedures. Today I want to discuss the issues surrounding the inevitable layoffs your company will have to endure in a downturn.

In Houston, we have experienced energy companies laying off upwards of 30% of their workforce, both in the US and abroad. Employment separations can be one of the trickiest maneuvers to manage in the spectrum of the employment relationship. Even when an employee is aware layoffs are coming it can still be quite a shock when Human Resources (HR) shows up at their door and says, “Come with me.” However, layoffs, massive or otherwise, can present some unique challenges for the FCPA compliance practitioner. Employees can use layoffs to claim that they were retaliated against for a wide variety of complaints, including those for concerns that impact the compliance practitioner. Yet there are several actions you can take to protect your company as much as possible.

Before you begin your actual layoffs, the compliance practitioner should work with your legal department and HR function to make certain your employment separation documents are in compliance with the recent SEC v. KBR Cease and Desist Order regarding Confidentiality Agreement (CA) language which purports to prevent employees from bringing potential violations to appropriate law or regulatory enforcement officials. If your company requires employees to be presented with some type of CA to receive company approved employment severance package, it must not have language preventing an employee taking such action. But this means more than having appropriate or even approved language in your CA, as you must counsel those who will be talking to the employee being laid off, not to even hint at retaliation if they go to authorities with a good faith belief of illegal conduct. You might even suggest, adding the SEC/KBR language to your script so the person leading the conversation at the layoff can get it right and you have a documented record of what was communicated to the employee being separated.

When it comes to interacting with employees first thing any company needs to do, is to treat employees with as much respect and dignity as is possible in the situation. While every company says they care (usually the same companies which say they are very ethical), the reality is that many simply want terminated employees out the door and off the premises as quickly as possibly. At times this will include an ‘escort’ off the premises and the clear message is that not only do we not trust you but do not let the door hit you on the way out. This attitude can go a long way to starting an employee down the road of filing a claim for retaliation or, in the case of FCPA enforcement, becoming a whistleblower to the Securities and Exchange Commission (SEC), identifying bribery and corruption.

Treating employees with respect means listening to them and not showing them the door as quickly as possible with an escort. From the FCPA compliance perspective this could also mean some type of conversation to ask the soon-to-be parting employee if they are aware of any FCPA violations, violations of your Code of Conduct or any other conduct which might raise ethical or conflict of interest concerns. You might even get them to sign some type of document that attests they are not aware of any such conduct. I recognize that this may not protect your company in all instances but at least it is some evidence that you can use later if the SEC (or Department of Justice (DOJ)) comes calling after that ex-employee has blown the whistle on your organization.

I would suggest that you work with your HR department to have an understanding of any high-risk employees who might be subject to layoffs. While you could consider having HR conduct this portion of the exit interview, it might be better if a compliance practitioner was involved. Obviously a compliance practitioner would be better able to ask detailed questions if some issue arose but it would also emphasize just how important the issue of FCPA compliance, Code of Conduct compliance or simply ethical conduct compliance was and remains to your business.

Finally are issues around hotlines, whistleblower and retaliation claims. The starting point for layoffs should be whatever your company plan is going forward. The retaliation cases turn on whether actions taken by the company were in retaliation for the hotline or whistleblower report. This means you will need to mine your hotline more closely for those employees who are scheduled or in line to be laid off. If there are such persons who have reported a FCPA, Code of Conduct or other ethical violation, you should move to triage and investigate, if appropriate, the allegation sooner rather than later. This may mean you move up research of an allegation to come to a faster resolution ahead of other claims. It may also mean you put some additional short-term resources on your hotline triage and investigations if you know layoffs are coming.

The reason for these actions are to allow you to demonstrate that any laid off employee was not separated because of a hotline or whistleblower allegation but due to your overall layoff scheme. However it could be that you may need this person to provide your compliance department additional information, to be a resource to you going forward, or even a witness that you can reasonably anticipate the government may want to interview. If any of these situations exist, if you do not plan for their eventuality before you layoff the employee, said (now) ex-employee may not be inclined to cooperate with you going forward. Also if you do demonstrate that you are sincerely interested in a meritorious hotline complaint, it may keep this person from becoming a SEC whistleblower.

Just as the Golden Gate Bridge provides more to the human condition than simply a structure to get from San Francisco to Marin County, layoffs in an economic downturn provide many opportunities to companies. If they treat the situation appropriately, it can be one where you manage your FCPA compliance risk going forward.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

 

 

 

May 26, 2015

Economic Downturn Week, Part I – Mapping of Your Internal Compliance Controls

Economic DownturnThis week I will present a series on steps that you can take in your compliance program if you find yourself, your company or your industry in an economic downturn. All of the recommendations I will make are ideas that have been put into action by companies currently facing these issues. They are ideas that you can use if you have scarce or lessened economic resources for your compliance function. Today I will take my cue from the recent Securities and Exchange Commission (SEC) enforcement action against BHP Billiton (BHP) as a key indicator of where greater and more rigorous SEC enforcement is heading. That is in the area of the enforcement of internal controls and steps that you can take right now, even with reduced head count and budgetary resources, to improve your Foreign Corrupt Practices Act (FCPA), UK Bribery Act or other anti-corruption compliance program.

However, before we get to that subject, I want to remember Marques Haynes, who died last week. Haynes was a basket baller extraordinaire who played with the Harlem Globetrotters off and on for 40 years. As was set out in his New York Times (NYT) obituary last week, Haynes “whose dazzling ball-handling skills, exhibited for more than 40 years as a member of the Harlem Globetrotters and other barnstorming black basketball teams, earned him a place in the Naismith Basketball Hall of Fame and an international reputation as the world’s greatest dribbler”. He was the first Globetrotter inducted into the Naismith Memorial Basketball Hall of Fame. I saw Haynes play in the later stages of his career with the Globetrotters; both on ABC’s Wide World of Sports and through their non-stop touring when they came to even my Podunk hometown. So here’s to you Marques and I am sure you have called ‘Next’ for that great pickup game in the sky several times now.

As they made clear with several FCPA enforcement actions from last fall, the SEC has placed a renewed interest in the accounting provisions of the FCPA, specifically the internal controls provisions. The BHP enforcement continued this trend, where there was no evidence that bribes were paid or offered in violation of the FCPA, tet the poor internal compliance controls at BHP led to a $25MM fine. Indeed Kara Brockmeyer, the Chief, FCPA Unit; Division of Enforcement of the SEC, who spoke at the recently concluded Compliance Week 2015, in a session entitled “A New Look at FCPA Enforcement”, reiterated that the SEC was committed to protecting investors in US public companies and those which list other securities in the US, through enforcement of the accounting provisions, including internal controls provisions of the FCPA. It would seem that the reason is straightforward; a company with rigorous internal compliance controls is better able to prevent, detect and remedy any FCPA violations that may occur.

So, in the midst of an economic downturn, what can you do around the FCPA’s requirements for internal controls and current SEC emphasis? I would suggest that you begin with an exercise where you map the internal controls your company has in place to the indicia of the Ten Hallmarks of an Effective Compliance Program, as set out in the FCPA Guidance. While most compliance practitioners are familiar with the Ten Hallmarks, you may not be as familiar with standards for internal controls. I would suggest that you begin with the COSO 2013 Framework as your starting point.

As a lawyer or compliance practitioner you may not be familiar with all the internal controls that you have in place. This exercise would give you a good opportunity to meet with the heads of Internal Audit, Finance and Accounting (F&A), Treasury or any other function in your company that deals with financial controls. Talk with them about the financial controls you may already have in place. An easy example is employee expense reports. Every company I have ever worked at or even heard about requires expenses for reimbursement to be presented, in documented form on some type of expense reimbursement form. This is mandatory for IRS reporting; so all entities perform this action. See how many controls are in place. Is the employee who submits the expense reimbursement required to sign it? Does his/her immediate supervisor review, approve and sign it? Does any party in the employee’s direct reporting chain review, approve and sign? Does anyone from accounts payable review and approve, both for accuracy and to make sure that all referenced expenses are properly receipted? Is there any other review in accounts payable? Is there any aggregate review of expense reports? Is there a monetary limit over which additional reviews and approvals occur?

Now if an employee has submitted expenses for activities that occurred outside the US are there are any foreign government officials involved? Were those employees identified on the expense reimbursement form? Was the business purpose of the meal, gift or other hospitality recorded? Can you aggregate the monies spent on any one foreign official or by a single employee in your expense reporting system? All of these are internal controls that can be mapped to the appropriate prong of the Ten Hallmarks or other indicia of your compliance program.

You can take this exercise through each of the five objectives under the COSO 2013 Framework and its attendant 17 Principles. From this mapping you can then perform a gap analysis to determine where you might need to implement internal compliance controls into your anti-corruption compliance program. This can lead to remedial steps that you can take. For example you can recommend procedures be written for all key compliance areas in which there are currently no procedures and your existing procedures can be updated to include compliance issues and clear definition how controls are to be evidenced. Through this you can move from having detect controls in place, to having prevent controls, whenever possible.

As a Chief Compliance Officer (CCO) or compliance practitioner, this is an exercise that you can engage in at no cost. You simply investigate and note what internal controls you have in place and how they may be a part of your anti-corruption efforts going forward. As I said last week, compliance is a straightforward exercise. This does not mean that it is easy; you do have to work at it so that you will simply not have a paper, “check the box”, program. But using the excuse that you have limited resources is simply an excuse and a rather poor one at that. While the clear lesson from the BHP enforcement action is that you are required to have effective internal controls in place, by engaging in this mapping exercise you can then figure out what you have and, more importantly, what internal compliance controls that you do not have and need to institute.

Finally, if you do have resources and need some help, you can reach me at the email below.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

May 25, 2015

Memorial Day – A Big Thank You

Filed under: Fair Process Doctrine — tfoxlaw @ 7:20 am

Memorial DayToday’s is a personal blog. Today is Memorial Day. It is traditionally the day we celebrate the men and women who have gave their lives in service of country in our armed forces. One of the things that I have long rued was the manner in which returning veterans were treated when they came home from Vietnam, no parades, no congratulations, no thank you for serving. In my mind one of the best things to come out of the first Gulf War was the change in how our returning veterans were treated. When they first landed on American soil, at Bangor, Maine, cheering crowds were there to greet them. I find this to be right and proper.

But as I said today is personal. I want to especially honor the men and women who served our country in World War II both those who made the ultimate sacrifice, those you have died since and those still with us on this Memorial Day. I certainly view them as “the greatest generation” for a whole host of reasons, not in the least their collective fight against the forces of evil in the world. Name any right you hold sacred as an American and the men and women of that era fought to defend it. Right to vote, freedom of expression, freedom of religion, are but a few. However, there are many other rights that might you might not think of that we owe to these men and women who fought and sacrificed for us during this conflict.

My father served in that conflict. He is still alive and kicking today at 88. For the past 40 years he has been a labor arbitrator. He believes that working people should have due process regarding their jobs and as an arbitrator he has put that belief into practice by requiring companies who terminate employees to follow the due process requirements of termination for just cause. Put another way, if an employer is going to deliver a death penalty sanction in the workplace, in the form of job termination, it must do so fairly and justly. This does not prevent management from exercising its rights or prevent management from running its business. At a bare minimum, it means that a company must have an agreed upon disciplinary process in place and that process must be followed if the company is going to terminate an employee. A company must investigate and it must allow an employee to tell his or her side of the story, the employee must have the right for union or other representation in the process and the final appeal of any termination must be made by someone other than the original decision maker. In other words, the fair process doctrine. It is one of the rights which the greatest generation defended in that conflict.

So on this Memorial Day, I honor my father and all of the other ever-dwindling number of World War II veterans for their part in making this country the greatest country in the world. I would ask each of you to honor our veterans on Memorial Day in your own way, even if it is just a moment to reflect on those who made the ultimate sacrifice in giving their lives or those who raised their right hands and swore to protect the rest of us.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

May 22, 2015

On the Oregon Trail: the BHP Enforcement Action and High-Risk Hospitality

Oregon TrailToday we celebrate American exceptionalism. As noted in ‘This Date in History’, on this date in 1834 the first wagon train, made up of 1,000 settlers and 1,000 head of cattle, set off down the Oregon Trail from Independence, Missouri, on the Great Emigration. After leaving Independence, the giant wagon train followed the Santa Fe Trail for some 40 miles and then turned to its northern route to Fort Laramie, Wyoming. From there, it traveled on to the Rocky Mountains, which it passed through by way of the broad, level South Pass that led to the basin of the Colorado River. The travelers then went southwest to Fort Bridger and on to Fort Boise, where they gained supplies for the difficult journey over the Blue Mountains and into Oregon. The Great Emigration finally arrived in October, completing the 2,000-mile journey from Independence in five months.

The settlers who took off on this Great Emigration on the Oregon Trail did not have anything in the way of a road map. Fortunately for the modern day anti-corruption compliance practitioner, you do have road maps that can guide your compliance with the Foreign Corrupt Practices Act (FCPA) going forward. Over the past few years the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) have put out significant and detailed information on compliance failures, which have led to FCPA enforcement actions. For any Chief Compliance Officer (CCO) or compliance practitioner, these enforcement actions provide solid information of lessons learned which can be used as teaching points for companies. Further, these lessons can be used as road maps to review compliance programs to see what gaps, if any, may exist and how to implement solutions.

This trend continued with the release of the SEC FCPA enforcement action involving BHP Billiton Ltd. (BHP) this week. First and foremost to note is that it was a SEC enforcement action involving violations of the internal controls provision of the FCPA. There was no evidence of bribery leading to any DOJ enforcement action. Yet as I have been writing and saying for almost one year, SEC enforcement of the internal controls provision of the FCPA is increasing and companies need to pay more attention to this part of the FCPA. A bribe or offer to bribe does not have to exist for an internal controls violation to occur. CCOs and compliance practitioners need to be cognizant of compliance internal controls and put effective compliance internal controls in place that can be audited against to test their effectiveness.

The BHP enforcement action revolved around the company’s hospitality program for the Beijing 2008 Olympics. Every CCO and compliance practitioner should study this enforcement action in detail so that they can craft appropriate compliance internal controls for high dollar entertaining for big time sporting events. For any company that may be planning for high dollar hospitality spends for the 2016 Brazil Olympics, this enforcement action lays out what you should and should not do in your compliance program. But this holds true for any major sporting event such as the Super Bowl, World Cup or you name the event.

BHP had a paper program that appeared robust. As laid out in the Cease and Desist Order, “BHPB developed a hospitality application which business managers were required to complete for any individuals, including government officials, whom they wished to invite.” The application included these questions to be fully answered:

  • “What business obligation exists or is expected to develop between the proposed invitee and BHP Billiton?”,
  • “Is BHP Billiton negotiating or considering any contract, license agreement or seeking access rights with a third party where the proposed invitee is in a position to influence the outcome of that negotiation?”
  • “Do you believe that the offer of the proposed hospitality would be likely to create an impression that there is an improper connection between the provision of the hospitality and the business that is being negotiated, considered or conducted, or in any way might be perceived as breaching the Company’s Guide to Business Conduct? If yes, please provide details.”; and
  • “Are there other matters relating to the relationship between BHP Billiton and the proposed invitee that you believe should be considered in relation to the provision of hospitality having regard to BHP Billiton’s Guide to Business Conduct?”

So the right forms were in place and some of them were fully filled out. However, as the Cease and Desist Order made clear, an effective compliance program does not end at that point. Now would be an appropriate time to recall that high risk does not mean you cannot engage in certain conduct. High risk means that to have an effective compliance program, you have to manage that risk. A basic key to any effective compliance program is oversight or a second set of eyes baked in to your process. BHP formally had this oversight or second set of eyes in the form of an Olympic Sponsorship Steering Committee (OSSC) and Global Ethics Panel Sub-Committee.

Where BHP failed was that “other than reviewing approximately 10 hospitality applications for government officials in mid-2007 in order to assess the invitation process, the OSSC and the Ethics Panel subcommittee did not review the appropriateness of individual hospitality applications or airfare requests. The Ethics Panel’s charter stated that its role simply was to provide advice on ethical and compliance matters, and that “accountability rest[ed] with business leaders.” Members of the Ethics Panel understood that, consistent with their charter, their role with respect to implementation of the hospitality program was purely advisory. As a result, business managers had sole responsibility for reconciling the competing goals of inviting guests – including government officials – who would ““maximize [BHPB’s] commercial investment made in the Olympic Games” without violating anti-bribery laws.”

But there was more than simply a failure of oversight by BHP. The Cease and Desist Order noted that not all of the forms were filled out with the critical information around a whether a proposed recipient might have been a government official. Even more critically missing was information on whether the proposed recipient was in a position to exert influence over BHP business. Moreover, BHP did not provide training to the business unit employees who ended up making the call as to whether or not to provide the hospitality on payment of travel and hospitality for spouses. The Cease and Desist Order stated that BHP “did not provide any guidance to its senior managers on how they should apply this portion of the Guide when determining whether to approve invitations and airfares for government officials’ spouses.” Finally, there were no controls in place to update or provide ongoing monitoring of the critical information in the forms.

All of this led the SEC to state the following, “As a result of its failure to design and maintain sufficient internal controls over the Olympic global hospitality program, BHPB invited a number of government officials who were directly involved with, or in a position to influence, pending negotiations, efforts by BHPB to obtain access rights, or other pending matters.” This led to the following, “BHPB violated Section 13(b)(2)(B) because it did not devise and maintain internal accounting controls over the Olympic hospitality program that were sufficient to provide reasonable assurances that access to assets and transactions were in executed in accordance with management’s authorization.” Perhaps it was stated most succinctly by Antonia Chion, Associate Director of the SEC’s Division of Enforcement, in the SEC Press Release announcing the enforcement action when he said, “A ‘check the box’ compliance approach of forms over substance is not enough to comply with the FCPA.”

There is also clear guidance from the SEC about how BHP was able to obtain the reduced settlement it received. BHP “provided significant cooperation with the Commission’s investigation”. Moreover, the Cease and Desist Order laid out the remedial steps the company took. These steps included: (1) creation of compliance group independent of the business units; (2) review of its anti-corruption program and implementation of certain upgrades; (3) embedding of anti-corruption managers into the business units; (4) enhancements of “its policies and procedures concerning hospitality, gift giving, use of third party agents, business partners, and other high-risk compliance areas”; (5) enhancement of “financial and auditing controls, including policies to specifically address conducting business in high-risk markets”; and (6) enhanced anti-corruption compliance training.

FCPA compliance is a relatively simply exercise. That does not mean it is easy. For travels on the Great Emigration on the Oregon Trail, travel was neither simple nor easy. If you want to send government officials to high profile sporting events or provide other high dollar hospitality, the FCPA does not prevent you from doing so. But it is a high risk and to be in compliance you must to manage those high risks appropriately, all the way through the process. The BHP enforcement action provides you a detailed road map of what to do and what not to do.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

May 21, 2015

Compliance Week 2015 Wrap Up

Wrap UpCompliance Week 2015 has ended. This year was the tenth anniversary of the annual conference and in many ways I found it to be the best one yet. Matt Kelly and his team put together a conference and experience, which was absolutely first-rate. If you were not able to make this year’s event, I hope you will join us for Compliance Week 2016, which Matt announced the dates for at the conclusion of this year’s event. The dates for 2016 are May 23-26, back of course in Washington DC to be held yet again at the Mayflower Hotel. I wanted to give you some of my thoughts on the highlights of this year’s event and what made it so unique.

At my age, I am somewhat loathe to channel my teenage daughter but the first thing that I noticed was a very different vibe this year over past year’s conferences. From the Cocktail Party reception held on Sunday night, all the way through the conclusion of the event, there seemed to be an air that I have not quite been able to put my finger on. It was more than an acknowledgement and perhaps even an excitement about how far the compliance profession has come in the past ten years. While I have written about the Chief Compliance Officer (CCO) and compliance profession as CCO 2.0, I had the feeling that we may be moving on to CCO 3.0, as that was even the title of a session.

But this vibe was more tangible than simply a feeling. One key ingredient for me was the use of social media into the conference experience. While many events have a conference app, which can provide you information on such things as the agenda, speakers and their presentations, room locations and the like; the Compliance Week 2015 app was fully interactive, allowing you to live tweet, send IM to fellow conference attendees and receive text messages when a room changed or other conference alteration occurred. It also provided a virtual help desk for all attendees.

Many of sessions were led by CCOs from major corporations and they were able to provide a strategic vision of where they were going at their organizations. This was kicked off from the start of the conference, from the first panel on the first day where the CCOs from Boeing, GE and the Director of Compliance for Wal-Mart began the event. Obviously these are three of the largest companies in the US and do business on a worldwide basis. Yet, while sharing their strategic visions, each one was able to provide a solid example from their respective organization that a CCO or compliance practitioner from any sized company could implement. From Wal-Mart with a workforce of 2.2 million employees, it was keep the message simple. From Boeing, it was incorporate any compliance failures as teaching moments or lessons learned into your internal compliance training going forward. From GE, it was how to inculcate and incorporate compliance into your everyday business planning.

The conversations were excellent as usual. I led the FCPA conversation and there were several alumni present, who told me they look forward to attending each year. One of the reasons is that there is no avenue in their hometowns to get together in an environment to discuss issues of mutual concern. It is concept that Mike Snyder and I used in founding the Houston Compliance Roundtable. A place where you can ask any question and have it answered by another compliance professional in an environment where Chatham House rules apply. While I certainly started the discussion, it quickly became fully interactive with all participants sharing their views on a variety of topics. While we have some great compliance talent in Houston at our Roundtable, it cannot top the level of maturity and sophistication present at the Compliance Week annual conference. We all benefited from the experience.

This experience was doubled when I led a breakfast event on Tuesday. While an inducement to attend was a complimentary copy of my book Doing Compliance, there were 25 attendees who joined me for a very engaging and free-flowing conversation about the state of compliance, we practitioners and where enforcement may be heading. Compliance Week treated us all to breakfast and, once again, I probably learned as much as any one. But since Chatham House rules were in effect, I cannot report on any of the substantive things that were discussed. I will share with you that I am excited to lead such a breakfast again next year and I hope you will be one of the 25 to sign up.

As always there were a number of government representatives who spoke at Compliance Week again this year. For me, the parade was led by Department of Justice (DOJ) Assistant Attorney General Leslie Caldwell. While I will be writing further, and in more detail, about Caldwell’s remarks, she said a few things that I think bear emphasis. One was that compliance professionals need to work towards more data analytics in the form of transaction monitoring to assist in moving to a prevent and even predictive and prescriptive mode for your best practice compliance program. Next she emphasized that your compliance program must not be static but must evolve as your business risks evolve. Finally, and much closer to my heart, were her remarks that you need to “sensitize your business partners to compliance.” It was if she was channeling her inner Scott Killingsworth with his groundbreaking work on ‘Private-to-Private’ or P2P compliance solutions. Or, as I might say, she was advocating a business solution to the legal problem of bribery and corruption across the globe.

But Caldwell was not the only DOJ representative as we had Laurie Perkins, Assistant Chief, Foreign Corrupt Practices Act (FCPA) Unit and Kara Brockmeyer, Chief, FCPA Unit; Division of Enforcement from Securities and Exchange Commission (SEC), on a panel moderated by yours truly. First I would urge that if you are ever asked to moderate a panel with FCPA enforcers and regulators, jump at the chance. The reason is that you get to ask the questions you want answers to; even if you get past your prepared questions, when there is a lull in questions from the audience, you can follow up with something you want to know or in my case always wanted to know. So I asked some basic questions like: What is Criminal Information? (to Perkins) and Could you explain the process for the SEC’s Administrative Procedure? (to Brockmeyer). I was certainly enlightened by their answers to both questions.

The event sponsors were of course there to provide information on their solutions to assist any compliance practitioner. If you have never been to an event at the Mayflower Hotel in Washington, the conference rooms are along a wide hall that allows good people flow and adequate room for the sponsors and others to set up, meet attendees and discuss their products and services. I view the sponsors and vendors as a part of the compliance solution going forward and while they are clearly there to sell; they also engage in a fair amount of education. But the education runs both ways with many compliance practitioners communicating needs they have which can be incorporated into new product developments.

Unfortunately Compliance Week 2015 had to come to an end. But the feeling, information and new friends I met will last with me until Compliance Week 2016 next year. I hope you will plan to join me.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

May 20, 2015

Levi Strauss and Auditing of Third Parties

Levi StraussToday we celebrate innovation. On this day in 1873, a patent to create work pants reinforced with metal rivets was granted. This marked the birth of one of the world’s most famous garments: the blue jeans. Jacob Davis, a tailor in Reno, Nevada, presented the idea to Levi Strauss in 1872 when he wrote Strauss a letter about his method of making work pants with metal rivets on the stress points to make them stronger. Davis didn’t have the money for the necessary paperwork and proposed that Strauss provide the funds and that they get the patent together. Strauss agreed and the patent for “Improvement in Fastening Pocket-Openings”, the innovation that would produce blue jeans, was granted.

Until Strauss opened a factory in 1880 the “waist overalls”, as the original jeans were known, were manufactured by seamstresses working out of their homes. Levi’s 501’s, previously known as “XX”, were soon a bestseller, and by the 1920s they were the top-selling work pant in the US. Over the decades the fad has grown and today they are a firm staple in closets around the globe.

I thought about this innovation and sustained excellence when I sat through a presentation at Compliance Week 2015 by two ladies from BakerHughes Inc. (BHI) Jennifer Ellison, Senior Legal Compliance Manager, and Marianne Ibrahim, Senior Counsel, on Audits and Investigations. They focused on three aspects of the company’s audit program in its compliance function, types and purpose of Foreign Corrupt Practices Act (FCPA) audits, planning for the audit and interviewing all in conjunction with your audit program for third parties.

When planning for such an audit they laid out the following steps. You should plan out four to six weeks in advance, you should perform the audit with your legal counsel’s lead to preserve privilege, work with the business sponsor to establish key business contacts, discuss audit rights and processes with the third party, you should prepare initial document request lists for financial information queries, take the time to review findings from previous audits and resolutions and also review details of opened and closed internal investigations, if there are any Code of Conduct questionnaires available take care to review and finally be cognizant of any related Department of Justice (DOJ) and Securities and Exchange Commission (SEC) enforcement actions.

They noted you should try and determine the entry points of foreign government involvement. They broke this down into (1) direct and (2) indirect. In the direct category they listed the following areas: customs and duties, corporate taxes and penalties, social security or national insurance issues for employees, obtaining in-country visas and work permits, public official gifts and entertainment, training of and attendant travel for employees of government owned entities, procurement of business licenses and permits to perform work and, finally, areas around police escort and security. In the indirect category, some of the key areas to review are: customs agents and freight forwarders, visa processors, commercial sales agents, including distributors and, finally, those who might be consultants or other channel partners.

Document review and selection is important for this process. They said that you should ask for as much electronic information as possible well in advance of your audit. They did recognize that it is much easier to get database records for internal audits than audits of third parties. One item they made sure to ask for in advance was records in database or excel format and not simply in .pdf. They suggested you ask for the following categories of documents; trial balance, chart of accounts, journal entry line items, financial and compliance policies, prior audited financial statements, bank records and statements, a complete list of agents or intermediaries and revenue by country and customer.

When you are ready to commence your interviews, they emphasized that the lead interviewer needs to be culturally sensitive, patient and must negotiate a good working relationship with auditors, who will be reviewing the documents from the forensic perspective. Regarding potential interviewees, they related you should focus on those who interact with government entities, foreign government officials or third parties, including those personnel involved with:

  • Business Leadership
  • Sales/Marketing/Business Development
  • Operations
  • Logistics
  • Corporate Functions: Human Resources, Finance, Health, Safety and Environmental, Real Estate and Legal.

For the interview topics, they suggested several lines of inquiry. Initially they noted you should conduct the audit interview as precisely that, an audit interview and not an investigative interview. You should not play ‘got-cha’ in this format. They said you should avail yourself of the opportunity to engage in training while you are interviewing people. The topics to interview on included:

  • General policies and procedures
  • Books and records pertaining to FCPA risks;
  • Test knowledge of FCPA and UK Bribery Act including facilitating payments and their understanding of your company’s prohibitions;
  • Regulatory challenges they may face;
  • Any payments of taxes, fees or fines;
  • Government interactions they have on your behalf; and
  • Other compliance areas you may be concerned about or that would impact your company, including: trade, anti-boycott, anti-money laundering, anti-trust.

Ellison and Ibrahim went into detail regarding the review you should make around the General Ledger (GL) accounts. They suggested you review commission payments to agents and representatives, any facilitating payments made, all payments around travel, meals and entertainment, payments made around training, gifts, charitable contributions, political donations and sales and promotion expenses. If there were payments made for customs or freight forwarders and other processing agents, permits, licenses, taxes and other regulatory expenses should be reviewed. Additionally any entries pertaining to community contributions and social responsibility payments should be assessed and, finally, they suggested that a review of any security payments, extortion payments, payments to legal consultants or tax advisors or fines and penalties should be considered.

Regarding bank accounts and cash disbursement controls, you should review the following:

  • Review controls around bank accounts and cash disbursements;
  • Identify and review authorized signers, approval levels, and bank reconciliations;
  • Ensure all bank accounts are included in the General Ledger;
  • Identify and review certain bank and cash disbursement transactions;
  • Identify offshore bank accounts.

In the area of cash funds review the following:

  • Review controls around petty cash funds;
  • Ascertain processes in place regarding disbursement and reconciliation of cash funds;
  • Identify and review payments to government officials, agents, or any unusual or suspicious activities; and
  • Identify and review certain bank transactions and test for any improper payments.

For gifts, travel and entertainment, you should explore payments made through employee-reimbursed expenses, scrutinize for any suspicious expenses submitted, expenses lacking adequate documentation, incorrect posting; and identify and review accounts associated with gifts, meals, entertainment, travel, or promotion. In the area of payroll, consider the risks around the use of ghost employees, hiring of relatives of government employees, and the use of bonus payments and be sure to request a payroll listing and review for any such persons.

Around training you should determine whether your company provides industry specific training to government entities, and review GL accounts and expenses for related items. In taking a look at payments under local law, you should obtain list of payments to the government required by local laws and identify and review payments to government authorities or employees, customs authorities or agents, income taxes authorities or license requirements. For payments made to third parties, you should review commission and expense payments for compliance with company policy and also trace payments to the third party’s bank account.

Ellison and Ibrahim provided solid, detailed information on not only what your audit protocol should be but also provided material on what you should look for and how you should do it. It was an excellent presentation.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

May 19, 2015

A CCO Job Function: Managing Talent

Garo YepremianGaro Yepremian died this past week. For anyone who grew up watching National Football League (NFL) games in the late 1960s or 1970s; this was a name quite familiar to you even if you had trouble pronouncing it. Yepremian was a left-footed field goal kicker who went from the heights of glory such as once kicking six field goals in one game and ending the NFL’s longest game; the Miami Dolphins-Kansas City Chiefs 1971 playoff game which he won with a field goal in the second sudden death overtime. Unfortunately it is not these achievements that he is best known for. That rather ignominious distinction was when he had a field goal blocked in the 1973 Super Bowl against the Washington football team; then picked it up and tried to pass it only to have it slip from his hands into the arms of Mike Bass who ran it in for a touchdown. The score changed a one-sided game from 14-0 Dolphins to 14-7 and put their undefeated season on the line for the remainder of the game. Fortunately for posterity and Yepremian, the Dolphins held on to complete the NFL’s only undefeated season.

I thought about Yepremian, his gaffe and the fact he grew up in Cyprus playing soccer when I read a recent article in the Financial Times (FT), entitled “Game of talents: management lessons from top football coaches”, where Mike Forde and Simon Kuper wrote about how “football [soccer for you Yanks reading this blog] coaches grapple with egos, tantrums and rivalry. Business could learn a lot from them.” This is because talent management is a key component of any successful organization and none more so than on a soccer team where “Football managers are, above all, talent managers.” The article had some interesting insights for the Chief Compliance Officer (CCO) or compliance practitioner which I believe could be helpful when dealing with large egos found in any business organization.

  1. Big talent usually comes with a big ego. Accept it. I grew up professionally in the private practices world of a law firm where big egos not only existed but also thrived and were perhaps even cultivated. This is not always true in the corporate world. The authors believe that “managing difficult people is the best test of a good manager.”
  2. Look for big egos that have ‘gotten over themselves’. At some point we all grow up. In the business world, just as in sports, “some players underperform early in their careers because they are immature.” Maturity can lead to players “accept their limits and become coachable.”
  3. Single out and praise those who make sacrifices for the organization. Reward those who might be willing to make a personal sacrifice. If you do, you behavior as a leader will be noticed and others in the business may well do the same.
  4. The manager shouldn’t aspire to dominate the talent. In soccer “Talent wins matches…Successful managers accept this. They don’t try to emphasise their leadership by dominating talent.” As a CCO, you should not only work to help the business folks succeed but let them take the glory if a big deal is closed.
  5. Ask talent for advice – but only for advice. While it seems self-evident, it always bears repeating if you take someone’s advice to craft a solution, that person will then be personally invested in the success of that solution. The authors quoted David Brailsford, general manager of the Team Sky cycling team, for the following, “We all perform better if we have a degree of ownership of what we do.”
  6. The manager’s job isn’t to motivate. “Great talent motivates itself.” The converse of this means that if you have top-notch sales talent, part of your job as a CCO or compliance practitioner is “not to demotivate them”. But more than simply not ‘demotivating’ your job should be to encourage “long-term commitment: sustained motivation over time.”
  7. Talent needs to trust each other more than it needs to trust the manager. This directly relates to the culture you set. If the only way for employees to succeed is to steal and cheat from their co-workers, you will have a toxic environment. Think of this in the context of your Foreign Corrupt Practices Act (FCPA) investigation protocol; if your goal is to skin some employee to save the company, you will not have much credibility left with your other employees.
  8. Improve the talent. Unfortunately, most managers spend most of their time managing incompetent employees. The authors believe this is a wasted opportunity as most top talent “have a gift for learning and a desire to improve. That desire often drives their career choices.” For a CCO this means you need to provide such opportunities to those on your compliance team. But think about taking this concept out into the workforce. What if you could offer a top sales person or executive a chance to not only learn something but also advance their career by a rotation through the compliance department or a signature project they could lead?
  9. 99% per cent of recruitment is about who you don’t sign. Here the message is to use your background due diligence to make sure that that ‘someone’ is the right person in the right situation because “Introducing a weak or undisciplined player [employee] can damage the standards and culture.”
  10. Accept that talent will eventually leave. “Few talented people are looking for a job for life.” Indeed in the compliance arena, since there are no trade secrets around anti-corruption compliance, the skills a compliance practitioner uses can be easily translated into another company. I often think about Jay Martin, the CCO of BakerHughes Inc. (BHI) in Houston. He is now on his third generation of compliance practitioners who work under him. While they are at BHI they have the chance to work under and for one of the top in-house compliance practitioners around and for a company that has a robust compliance program. They work very hard while they are at BHI but they get great experience, a great resume entry and a great reference from one of the top compliance practitioners around. If you are a CCO you might consider the BHI model.
  11. Gauge the moment when talent reaches its peak. In the sports world, the only person who wins every time (eventually) is Father Time. While that may not be as true in the corporate world, burnout is true. I went through it in my 40s as a trial lawyer and many others do as well. If you are a CCO and see reduced enthusiasm or commitment in an employee this may be the reason. Would you consider a sabbatical for the employee? How about a plumb overseas role to rekindle the passion? As a leader, you need to recognize this issue and use your leadership skills to address the situation.

The authors note, “Talent management has been a business obsession at least since 1997, when the consultancy McKinsey identified a “war for talent.”” As a CCO you should certainly consider these issues in managing your compliance function. However I believe the concepts laid out by Forde and Kuper work for the broader corporate world as well. If you are going to use you influence throughout the organization, you should consider incorporating these techniques into your skill set.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

May 18, 2015

The Thrill is Gone: On the Intersection of CSR and the FCPA

BB KingYes indeed the thrill is gone as BB King died last week. While I cannot aver he was the bluesman ever as Keith Richards would say that was Robert Johnson, or he was even the greatest bluesman during my lifetime as Muddy Waters lived until 1965, he was certainly the most well-known and prolific bluesman I ever heard and therefore he had the greatest influence on my passion for the blues than perhaps any other. My favorite BB King song is Mannish Boy and album is “Live in Cook County Jail” which I was introduced to in law school by a law school buddy and his wife who hailed from Chi-town. So even though BB King is dead, his music and name will live on forever.

Somehow it seems fitting that the legacy of BB King inform today’s blog post which is about the intersection of Corporate Social Responsibility (CSR) and anti-corruption laws such as the US Foreign Corrupt Practices Act (FCPA) and UK Bribery Act. Last week I had the opportunity to visit with Alison Taylor, who is the Director of Energy and Extractives for BSR, for a podcast on the FCPA Compliance and Ethics Report. BSR is a global non-profit business network and consultancy dedicated entirely to sustainability that works through its 275 member companies and assists with sustainability and CSR issues. BSR does one on one consulting, grant funded research and collaborative initiatives, all to aid in bringing people together to solve problems that no single company can solve on their own.

Taylor has spent quite a lot of time studying organizational psychology looking at the organizational dynamics of corruptions and looking at what are the organizational culture characteristics of corrupt organizations. So before we got to her specific expertise in CSR, I asked her about some of her observations regarding the organizational issues that can lead to a high risk of corruption. We began with how excessive local autonomy can lead to corruption issues, where Taylor believes that a high corruption risk can derive from a “lack of oversight from headquarters leaving local leadership with a very, very heavy position with authority and ability to control and limit the information coming out of that team. You have an archetypal corrupt team in a remote location, very far from head office, with an autocratic command and control leader, very high pressure, unrealistic incentives, and then strong information boundaries, so a strong incentive not to share meaningful information with the rest of the company. Often very high performing, often getting very good results, but that is a melting pot of corruption risk, in essence.”

A second area where Taylor has seen corruption risks increase is where high pressure and high rewards can work to undermine business ethics and compliance. She said, “What you can end up with is, and this is something that hits sales people in remote environments in particular, is that these sales people are on the ground. They’re in Angola, they’re in China, they’re in a high-risk market. They’re being told simultaneously, “Whatever you do, don’t pay bribes. But whatever you do, grow your business by 20 or 30% this year, and we don’t really care how you do it.” Then what will happen is that that individual or that team will make a calculation about what the company considers more important. That’s where you see the [high] corruption risk. What I’m really saying is that companies are not aligning their strategies, their goals, their incentives, with their corruption checks and balances. It’s leaving employees with mixed messages.” While all of this might seem self-evident, I found her next observation quite interesting and one that is not always considered in an anti-corruption compliance program. It is that if you have a robust compliance program, and your internal messaging is not consistent, “Then you are, in parallel, incentivizing employees to have to meet sales targets that may not be realistic, given the characteristics of the external environment.”

Taylor tied these two concepts of strong local control and high pressure together in her next point. Where a company may have a very autocratic command and control structures and high pressure to meet sales goals, “The leadership is very demanding, very high pressure, telling the team “If you don’t meet these targets, your job is under threat.” There is a strong limit of bottom up information so people are discouraged from sharing their problems and sharing the pressures that they may be under, often so the leadership can maintain plausible deniability. That can play very heavily into oversight dynamics between the center and the region.”

We next turned to the intersection of CSR and anti-corruption programs such as those based on the FCPA’s Ten Hallmarks of an Effective Compliance Program and UK Bribery Act’s Six Principals of Adequate Procedures. I found Taylor’s initial comments telling as she stated, “if I were to say one thing about CSR and anti-corruption, it’s that those two conversations need to be brought together a lot more closely.” In other words, as in many areas of complimentary compliance issues Taylor has found that CSR programs and compliance practitioners tend to be siloed and do not interact enough. She went on to add that, “I think what we’ve got going on is that the anti-corruption department and the CSR department aren’t speaking the same language and aren’t talking about the same things. There needs to be a lot more thinking about what is appropriate from a community investment point of view and whether that violates anti-corruption standards.”

Taylor advocated companies stepping back and looking at CSR in conjunction with compliance in a more holistic approach. She stated, “There’s obviously a lot of, just the different language and the different thinking going on. Sometimes there will be some communication, but it most often takes the form of the compliance due diligence process and background checks slowing down the CSR team. What I think is really needed, is for companies to take a giant step back and look at their entire strategy.”

She also observed that “CSR programs, particularly in terms of community investment, community development, particularly for extractive companies, and particularly in high risk markets, they’re not exclusively in high risk markets, are an absolutely key part of the company managing its non-technical risk and maintaining a social license to operate, which is absolutely critical. The cost of community processes to extract its companies absolutely astronomical.”

Taylor’s thoughts and ideas resonated strongly with me and I would recommend that any Chief Compliance Officer (CCO) or compliance practitioner’s out there go do some checking into your company’s CSR initiatives to see if any are outside the US and would have FCPA implications. You may well have written a charitable donation tract into your FCPA compliance policy and procedures but your CSR program or initiative may be implemented separate and apart from your department. If you do have functioning CSR initiatives, you should review them for FCPA implications. You should also review your oversees operations to see if they meet any of the high risk criteria that Taylor identified to see if there are Red Flags which you may need to clear or simply greater FCPA risk management tools you need to put in place. While you are at it, listen to BB King Live in Cook County Jail on YouTube or download it from iTunes, slap on your headphones and enjoy some of the greatest blues ever created.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com. © Thomas R. Fox, 2015

May 15, 2015

Lunch with the FCPA Compliance and Ethics Blog – Donald Anderson of TDI

donald andersonEd. Note-today I continue my sometimes series of blog posts based on lunches with the FCPA Compliance and Ethics Blog. In this post, I report on a visit with Donald Anderson, the Partner in Charge for TD International’s (TDI) Houston Office.

I recently had the chance to sit down for a lovely lunch at the Federal Grille with Donald Anderson, the Partner in Charge for TD International’s (TDI) Houston Office. Donald is a Louisiana native who attended LSU, receiving a BS in Civil Engineering and later a MS in the same discipline. He worked for many years in the energy sector with Fugro Consultants, a geosciences firm. He later obtained a MBA from Rice University in Houston and began his career with TDI, where he specializes in country and regional business strategies, pre-transaction due diligence for mergers and acquisitions (M&A), compliance investigations for anti-corruption laws such as the Foreign Corrupt Practices Act (FCPA) and UK Bribery Act, assessment and mitigation of above-ground risks, and litigation support.

TDI is a strategic intelligence advisor to business and financial leaders operating in emerging and first world markets. It has four main focus areas including strategic advisory services, which combines the company’s commercial, diplomatic, and intelligence experience; its business risk services for domestic and internal business and reputational issues; due diligence work from third parties under the FCPA to potential business acquisitions and business partner reputational issues; and localized assessments for corporate strategy.

Anderson and I enjoyed a wide-ranging chat on a variety of topics. He always has some great strategic insights. Since we are both in Houston, the current state of the energy industry was one of our initial topics of conversation; ranging from the current price of oil to where it may go with the ongoing instability in the Middle East. Within the FCPA context, one of the more interesting set of issues is coming out of Iraq.

Unfortunately the corruption issues surrounding the current Iraqi government are well-known. But the status of the Islamic State (ISIS) has only acerbated the corruption situation. Anderson expounded that this is because Iraq’s financial woes are caused by the two-fold problem of dramatically increased military expenditures, coupled with decreasing oil revenues. This dip in oil revenues comes from the twin problems of the world-wide drop in the price of oil and the country’s internal loss of oil resources to ISIS. In the short term, the government can fund its operations against ISIS at the expense of other government programs. However, this will seriously increase Iraqi government’s debt to foreign energy companies and negatively impact desperately needed investments for critical infrastructure and other government related construction projects.

Anderson explained that the Iraqi government has resorted to ceasing payments to energy firms with oil supplies. Instead, the government is selling oil on the open international market. Of course with the drop in prices from more than $100 per barrel to somewhere now hovering in the neighborhood of $50 per barrel, this has seriously impacted the ability to raise significant cash, so the government has to sell ever-increasing amounts of oil to maintain revenues.

Moreover, in the long-term, this is a very risky strategy for the country. These changes have made bribery and corruption more rampant because the contracts that directed where the oil was to be sold have become porous, with many sales going to the highest bidder. It is not hard to see how an Iraqi government official might well be tempted to make a sale, in this situation, facilitated through the payment of a bribe.

Another issue coming out of Iraq is the implosion of the oil agreement between the government and the Kurdistan Regional Government (KRG). Under this oil agreement, there was a contractually mandated formula for the exporting of oil out of the area held by the KRG with a revenue sharing component from the central Iraqi government back to the Kurds. The KRG has attempted to export oil unilaterally and the Iraqi government has cut off the KRG from receiving its full portion of the federal budget. We had this conundrum come up in Houston late last year, when a tanker of KRG oil was stopped from unloading their oil by the Iraqi government through an injunction it obtained in US Federal District Court in Houston.

Anderson emphasized that if the oil agreement continues to be held in abeyance, both the central Iraqi government and the KRG will suffer financially. But from the compliance perspective, he indicated that if the KRG exports oil, it could be through a pipeline which goes out through Turkey or some other country. I view this situation as one which could well lead to bribery and corruption to get KRG oil out in violation of the agreement between the central government and the KRG.

Later in the lunch, our conversation turned to Brazil and the ever-burgeoning corruption scandal, which began with Petrobras. Anderson gave his opinion that the matter could become one of the world’s largest corruption scandals. When I brought up GlaxoSmithKline PLC (GSK) and how I thought it would be such a game-changer in anti-corruption compliance, Anderson responded that while the Chinese corruption scandal certainly was large, it is still largely focused on China and Chinese persons and entities. He did acknowledge the role of GSK but pointed out that the Brazil corruption scandal had exploded beyond Petrobras and Brazilian companies to a number of western companies from the US and Europe. Further, the recently announced scandal in the Brazilian tax appeal board has implicated a number of non-Brazilian companies.

In our discussions relating to Petrobras, I raised with Anderson the issue of the scheme used by Petrobras employees to obtain bribes. It appeared that contract prices were over-inflated by 3% and then the company paying the bribe would rebate the money to the corrupt Petrobras official or his Swiss bank account. My question to Anderson was how could you determine if 3% is truly an overcharge to the contract or is even outside a reasonable range of profit. Anderson had a great phrase which was to “follow the money” by looking at similar contracts awarded to the company or where they had bid to determine. One might need to look at a large number of contracts to determine the full value of services or products offered but he believes that such an analysis could be done.

We both agreed that this type of analysis is something any US or UK company which has done business with Petrobras over the past 5 years should do so sooner rather than later. We also discussed any companies, which may have won Brazilian contracts for infrastructure or other construction projects for the 2014 World Cup or 2016 Olympics. There is already one European company, the German company Bilfinger, which has announced an internal investigation into contracts from construction projects relating to these events. We both believe that there will be others so ensnared and that the better approach for any US or European company would be to engage in an internal investigation now to see if there are issues along these lines.

Finally, Anderson had an insight I had not seen previously, around bribery and corruption the energy space. He drew out a graph, which detailed the spending in any mineral extraction process. He explained to me that at certain points the lifecycle of a project you have increased spending. One time is during the bid process, a second time is during the exaction or drilling process and finally in the divestiture or sale of the asset phase. It is during these times where there is money being bid out for work but also a large number of permits or other government interactions required. There may also be a new set of players in each phase, who have their collective hands out. It is during these phases that companies have the highest risk of their employees engaging in bribery and corruption. Armed with this knowledge, a company can bring greater compliance resources and risk management to bear to prevent or detect FCPA or UK Bribery Act issues.

Unfortunately our time for lunch ran out and we had to return to our respective offices. As you can tell from this article, Anderson has an extremely interesting background and his work with TDI allows him to utilize his wide variety of educational and professional tools. If you have the need for any of the services discussed in this article, I would urge you to contact Anderson. He can be reached at anderson@tdinternational.com.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Next Page »

The Rubric Theme. Blog at WordPress.com.

Follow

Get every new post delivered to your Inbox.

Join 5,257 other followers