Georgia On My Mind – How Does Compliance Enhance Shareholder Value?

Can you get a sense of place from listening to a song? In an article in the Financial Times (FT), entitled “The Life of a Song – Georgia On My Mind”, Mike Hobart wrote that when you “combine Stuart Gorrell’s lyrics with Hoagy Carmichael’s music… the sense of place becomes palpable.” While that may be true, the piece attributed to Frank Trumbauer who said, “Nobody ever lost money writing songs about the South”. The song did not become the well-known standard it is today until Ray Charles recorded it in 1960, some 30 years after Carmichael wrote it. Hobart believes that the song works so well “not the least because ‘Georgia On My Mind’ is a brilliant piece of imaginative fiction that captures the yearnings of a homesick soul. That fact and fantasy are so out of step only adds to the pathos.”

That ultimate line from Hobart’s piece struck me around an issue that I have thought about for some time. How many Chief Compliance Officers (CCOs) and compliance practitioners out there have faced the following question from the General Counsel (GC), Chief Executive Officer (CEO), Chief Financial Officer (CFO) What does it do to enhance shareholder value? This is the question that is posed when senior management wants to deny resources to or even cut back the compliance function. At best the question is disingenuous and at worst it is simply a dodge by someone wanting to denude a corporate compliance function for their own nefarious reasons.

Michael Skapinker raised this second point, in another FT article entitled “Shareholder value is a cover for over-mighty chief executives”. Skapinker further opines that this question also presages an inquiry into whether CCOs “are using the cover of shareholder primacy to put themselves first?” While he also condemned the disparity in the growth of senior executives salaries and true shareholder value, Skapinker worries about the lack of accountability of CCOs and how their actions can damage a company’s reputation.

So how do you respond to this query? I think there is an answer with which you can always respond when faced with a clearly hostile CEO or other senior manager. It is the following. A best practices anti-corruption compliance program, whether based on the Foreign Corrupt Practices Act (FCPA), UK Bribery Act or other anti-bribery law always enhances shareholder value. The reason is quite simple. It is all about tightening up the internal controls to prevent bribery and corruption.

However the part that such CEOs or other senior management may not understand is that FCPA internal controls are largely financial controls. Such controls are in place not only to comply with laws but also to provide internal oversight on how money flows out from an organization. The better the internal financial controls the better run a company will be in both the short and long term.

Most readers are familiar with Ethisphere’s annual designation of the World’s Most Ethical Companies. Many commentators deride this list because many of the companies on the list have gone through a FCPA investigation or enforcement action. Even with that factor, one of the things that Ethisphere touts about this list is that the companies on it routinely outperform the Standard & Poor’s (S&P) Index in annual performance. I thought about this seeming anomaly for a long time, wondering how ethical companies could be in the midst of FCPA investigations and be on a most ethical list.

The reason these companies are on the list is that they have better financial controls and by having better financial controls, these companies are more generally better run. Think about financial controls around employee expense reimbursement as an example. These are in place to satisfy Internal Revenue Service (IRS) rules to demonstrate the business purpose of employee travel, entertainment of customers, hospitality for potential customers and similar business expenses. Now consider this IRS requirement overlaid with a FCPA compliance requirement. Not only do you need to record the foreign government officials (or not) that you entertain, you need to document the expense incurred and the business purpose. If the expenses were predetermined to be over the amount set in your compliance policy, you may require compliance department pre-approval. When an employee submits an expense reimbursement form, there is usually a signature or self-attestation required. Then the employee’s supervisor, and perhaps one level above, must approve the reimbursement request before it even gets to Accounts Payable (AP) for a financial and procedure focused review.

All of these steps are financial controls yet they operate as internal compliance controls as well. If the controls are enforced the compliance function would have a searchable database to test employee expense reimbursement requests to see if any anomalies appear which should be set aside for further investigation. Imagine how GlaxoSmithKline PLC (GSK) might have fared if it had properly assessed its Chinese employee reimbursement requests to determine if the employees had actually put on the events for which they claimed reimbursement.

The same financial control analogy is true for the other key steps in any best practices compliance program. Management must communicate the message regarding doing business in compliance down to the troops. This message should be formalized in policies and procedures to set expectations of behavior. Then there should training on these educations and a person or function sufficiently resourced to run it. Next there should be incentives to do business in compliance and sanctions for those who fail to meet the set expectations and an appropriate reporting mechanism for internal reporting of compliance violations. Any best practices FCPA compliance program would also have a risk assessment, management of third parties and a mergers and acquisition (M&A) component. Finally, all of these concepts should be memorialized through internal controls that are designed, implemented and tested for effectiveness.

So the next time one of those senior management types asks you what the compliance function does or even what an expenditure that you want to incur will do to increase shareholder value, you can not only point him (or her) to the Ethisphere Most Ethical Company list but you can dive down to the specific level of your company and point directly to one of the above concepts around internal controls, which are really financial controls, to make your company not only run more efficiently but also provide appropriate levels of oversight.

So just as Hoagy Carmichael may indeed have written Georgia On My Mind because no one “ever lost money writing songs about the South”; no company was worse run because it had effective internal controls. Quite the contrary, the more effective your compliance controls are the better run your company will be and that will most certainly enhance shareholder value.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Do Your Executives Have (Compensation) Skin in the Game?

This year marks the 150^th anniversary of the ascent of the most famous mountain in Europe, the Matterhorn. On Bastille Day, in 1865, four British climbers and three guides were the first climbers to reach the summit. In an article in the Financial Times (FT), entitled “In Whymper’s steps”, Edward Douglas wrote, “It was a defining moment in the history of mountaineering, arguably as pivotal as the first ascent of Everest. Before this calamity climbing was a quirky minority pastime and Zermatt an indigent and obscure village. All that changed on July 14, 1865. As locals cheerfully acknowledge, the Matterhorn disaster enthralled the public around the world and sparked an unprecedented tourist boom.”

The disaster had befallen the climbing team on its descent after having scaled the summit. The team was led by Edward Whymper. As they were coming back down, they were all tied together with rope. When one of the team slipped, he knocked over his guide and “their weight on the rope pulled off the next man…and a fourth climber as well.” Only expedition leader Whymper and two Swiss guides, a father and son duo from Zermott, survived the disaster when “they dug in and the rope tightened – then snapped – leaving them to watch in horror as the bodies of their companions cartwheeled thousands of feet down the mountain.” The depiction of the disaster by the French artist Gustave Doré captures for me the full horror of the tragedy.

Yesterday I wrote about the role of compensation in your best practices compliance program. Today I want to focus on the same issue but looking at senior management and compensation. I thought about this inter-connectedness of compensation in a compliance program, focusing up the corporate ladder when I read a recent article in the New York Times (NYT) by Gretchen Morgenson, in her Fair Game column, entitled “Ways to Put the Boss’s Skin In the Game”. Her piece dealt with a long-standing question about how to make senior executives more responsible for corporate malfeasance? Her article had some direct application to anti-corruption compliance programs such as those based on the US Foreign Corrupt Practices Act (FCPA) or UK Bribery Act. Morgenson said the issue was “Whenever a big corporation settles an enforcement matter with prosecutors, penalties levied in the case – and they can be enormous – are usually paid by the company’s shareholders. Yet the people who actually did the deeds or oversaw the operations rarely so much as open their wallets.”

She went on to explain that it is an economic phenomenon called “perverse incentive” which is one where “corporate executives are encouraged to take outsized risks because they can earn princely amounts from their actions. At the same time, they know that they rarely have to pay any fines or face other costly consequences from their actions.” To help remedy this situation, the idea has come to the fore about senior managers putting some ‘skin in the game’. Her article discussed three different sources for this initiative.

The first is a current proxy proposal in front of Citigroup shareholders which “would require that top executives at the company contribute a substantial portion of their compensation each year to a pool of money that would be available to pay penalties if legal violations were uncovered at the bank.” Further, “To ensure that the money would be available for a long enough period – investigations into wrongdoing take years to develop – the proposal would require that the executives keep their pay in the pool for 10 years.”

The second came from William Dudley, the President of the Federal Reserve Bank of New York, who made a similar suggestion in a speech last fall. His proscription involved a performance bond for the actions of bank executives. Morgenson quoted Dudley from his speech, “In the case of a large fine, the senior management and material risk takes would forfeit their performance bond. Not only would this deferred debt compensation discipline individual behavior and decision-making, but it would provide strong incentives for individuals to flag issues when problems develop.”

Morgenson reported on a third approach which was delineated in an article in the Michigan State Journal of Business and Securities Law by Greg Zipes, “a trial lawyer for the Office of the United States Trustee, the nation’s watchdog over the bankruptcy system, who also teaches at the New York University School for Professional Studies.” The article is entitled, “Ties that Bind: Codes of Conduct That Require Automatic Reductions to the Pay of Directors, Officers and Their Advisors for Failures of Corporate Governance”. Zipes proposal is to create a “contract to be signed by a company’s top executives that could be enforced after a significant corporate governance failure. Executives would agree to pay back 25 percent of their gross compensation for the three years before the beginning of improprieties. The agreement would be in effect whether or not the executives knew about the misdeeds inside their company.”

As you might guess, corporate leaders are somewhat less than thrilled at the prospect of being held accountable. Zipes was cited for the following, “Corporate executives are unlikely to sign such codes of conduct of their own volition.” Indeed Citibank went so far as to petition the Securities and Exchange Commission (SEC) “for permission to exclude the policy from its 2015 shareholder proxy.” But the SEC declined to do and at least Citibank shareholders will have the chance to vote on the proposal.

In the FCPA compliance context, these types of proposals seem to me to be exactly the type of response that a company or its Board of Directors should want to put in place. Moreover, they all have the benefit of a business solution to a legal problem. In an interview for her piece, Morgenson quoted Zipes as noting, “This idea doesn’t require regulation and its doesn’t require new laws. Executives can sign the binding code of conduct or not, but the idea is that the marketplace would reward those who do.” For those who might argue that senior executives can not or should not be responsible for the nefarious actions of other; they readily take credit for “positive corporate activities in which they had little role or knew nothing about.” Moreover, under Sarbanes-Oxley (SOX), corporate executives must make certain certifications about financial statement and reporting so there is currently some obligations along these lines.

Finally, perhaps shareholders will simply become tired of senior executives claiming they could not know what was happening in their businesses; have their fill of hearing about some rogue employee(s) who went off the rails by engaging in bribery and corruption to obtain or retain business; and not accept that leaders should not be held responsible.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Who is Responsible for Complying with the FCPA?

The Department of Justice (DOJ) still faces criticism over its Foreign Corrupt Practices Act (FCPA) enforcement strategy. Some decry that it is too aggressive, that the DOJ has moved into waters Congress never intended the DOJ to navigate into regarding the FCPA. Others worry that the DOJ, through its use of settlement mechanisms such as Deferred Prosecution and Non-Prosecution Agreements (DPAs and NPAs), let corporations off to easily with fines and other monetary penalties being the equivalent of a slap on the wrist. Yet another school of thought says that it is up to the DOJ to tell companies how not to engage in bribery and corruption by specifying precisely what type of anti-corruption compliance program to put into effect.

One thing these commentariat all have in common is that they generally do not look to those responsible for obeying the law, i.e. companies and persons who are subject to the FCPA, for their responsibility of complying with the law. Such failure seems to me to be sadly misplaced. But it is not simply Mike Volkov’s FCPA Paparazzi who fail to assess a corporation’s role in their failure to comply with the law; unfortunately it is also company leaders themselves.

We recently were treated to another such display of ‘What Me Worry?’ mentality by HSBC Chief Executive Officer (CEO) Stuart Gulliver when he said, “Can I know what every one of 257,000 people is doing?” Leaving aside the issue of whether a corporate CEO who has signed one of the largest DPAs in the history of the world (for money-laundering, not FCPA violations); should admit he (1) he doesn’t care or (2) his company is too unwieldy for it to obey the laws that you and I follow everyday; Gulliver inadvertently hit upon one of the key concepts of a best practices compliance program. That concept is a well-rounded program that assures compliance, not some all knowing, all seeing narcissist at the top.

In a Financial Times (FT) article entitled “Too big to manage”, Andrew Hill blasted Gulliver’s statement as “disingenuous” but went on to state, “Knowing what every employee is doing is not the leader’s responsibility. But by using a combination of the right structure, the latest technology and, above all, by imbuing a company with the correct culture and reinforcing regular communication with visits to the shop floor, he or she should be able to limit the chance of a major scandal.” Hill quoted management thinker Henry Mintzberg for the following, ““You can’t excuse [scandals] by saying we have so many employees. You . . . have got to be on the ground to have a sense of what your organisation is all about.””

This means a CEO is not required to know everything but he does need to have an overall sense of whether his company is moving in a direction to do things such as follow the law. I would say this is even truer when you have promised (yet again) in a DPA that your company will follow the law. It also means that the leader sets the tone. If your leader takes the position that he or she cannot know what everyone is doing; that tone will be communicated down to the field troops but the message will be that said maximum leader does not care what the middle and lower levels are doing. Hence the DOJ would say that it all starts with Tone at the Top. Sadly Gulliver does not seem to acknowledge, let alone understand, that issue.

But more than simply having a leader that cares and is engaged; Gulliver’s statement belies other aspects of a best practices compliance program. Technology provides a mechanism for oversight of a compliance regime. Under the FCPA Ten Hallmarks of an Effective Compliance Program, monitor is recognized as a key element so your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with the finance departments in your foreign offices to ask if they’ve noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries they manage. Additionally, the global compliance committee should meet or communicate as often as every month to discuss issues as they arise. These ongoing efforts demonstrate your company is serious about compliance.

In addition to monitoring, structural controls are recognized as an important element. Hill said that large companies “must use structural means to maintain control.” One of the best explanations of the use of internal controls as a structural component of any best practices compliance program comes from Aaron Murphy, a partner at Foley and Lardner in San Francisco, in his book entitled “Foreign Corrupt Practices Act”, where he said, “Internal controls are policies, procedures, monitoring and training that are designed to ensure that company assets are used properly, with proper approval and that transactions are properly recorded in the books and records. While it is theoretically possible to have good controls but bad books and records (and vice versa), the two generally go hand in hand – where there are record-keeping violations, an internal controls failure is almost presumed because the records would have been accurate had the controls been adequate.”

I would advocate that it is the interplay of the right message, tools in place to communicate and enforce the message and then oversight to ensure compliance with the message that allows a 250,000 plus employee base company to have a chance to operate in compliance with their legal obligations. Echoing this maxim, Hill quoted Rick Goings, Chairman and CEO of Tupperware Brands Corporation, for the following, “Wars are won not by generals, but by non-commissioned officers. If you have the right kind of structure…and behind that a value system, I think you can do it.”

HSBC continues to be the poster child for compliance lessons learned, whether intentional or not. Hill concluded his piece with the following, “The lesson may be that, irrespective of the size of the company, executives who lose touch with how their staff are using the culture they preach are courting embarrassment and scandal. The trend towards large companies operating through smaller units, with more autonomy and accountability for their actions, does not absolve leaders from meeting their traditional responsibilities to know what is happening on the frontline. As Prof Fischer suggests, they should manage according to the old Russian proverb that Ronald Reagan adopted when dealing with the Soviet Union in the 1980s: trust, but verify.”

There is a plethora of compliance regimes that companies can look to in order to create a best practices compliance program. Simply put, it is a relatively straightforward exercise; perhaps not easy but certainly there are well-articulated compliance programs that companies can follow. To continue to criticize the DOJ (and Securities and Exchange Commission) for failing to communicate what they wish to see in a best practices compliance program, simply fails to take into account the responsibility that corporations have in complying with US laws. The information is out there in abundance. Even a weekend article in the FT lays it out for you.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

GSK in China-the Book

The year 2013 brought the anti-corruption compliance world a new situation as the Chinese government aggressively investigated, for the first time, a western company for bribery and corruption of Chinese citizens in China, based on Chinese domestic law. The company, GlaxoSmithKline PLC (GSK), was convicted of corruption in September 2014. I wanted to put together, in one volume, the background facts, information from the trials and conviction and add some of the most significant lessons to be learned for any compliance practitioner going forward. For these reasons, I am pleased to announce the publication of my latest book, GSK in China: Anti-Bribery Enforcement Goes Global which is now available through Amazon.com.

I believe that GSK will be a watershed in the global fight against bribery and corruption. Behavior and conduct, which was illegal under Chinese law but previously tolerated and even accepted by Chinese government officials, quickly became a quagmire that the company was caught in when charges of corruption were leveled against them last year. David Pilling, writing an article in the Financial Times (FT), entitled “Why corruption is a messy business”, said “Multinationals are discovering that there is only one thing worse than operating in a country where corruption is rampant: operating in one where corruption was once rampant – but is no longer tolerated.” GSK became the first western company to pay the piper when this new tune began to play.

When it began, it was not it clear why China’s Communist Party Chief Xi Jinping began his anti-corruption push. Some speculated that it was an attack on western companies for more political reasons that economic reasons. Others took the opposite tack that the storm, which broke with the bribery and corruption investigation of GSK, was China’s attack on western companies to either hide or help fix problems endemic to the Chinese economic system. My take is that his campaign has a different purpose but incorporates both political and economic reasons. That purpose is that Xi has recognized something that the US government officials, and most particularly the DOJ, have been preaching for some time. That is, the insidiousness of corruption and its negative effects on an economic system.

Xi and China have realized that corruption is a drain on the Chinese economic system. Publications as diverse as the Brookings Institute to the Wall Street Journal (WSJ) have noted that one of the reasons for the anti-corruption campaign is to restore the Chinese public’s faith in the ruling Communist Party. Bob Ward, writing in the WSJ article, entitled “The Risks in China’s Push to Root Out Wrong”, said, “China’s anticorruption drive began in late 2012 as a way to cleanse the ruling Communist Party and convince ordinary Chinese that the system isn’t rigged against them. Investigators are targeting some of China’s most powerful officials and disciplining tens of thousands of lower-echelon officials who party investigators contend got used to padding their salaries.” Cheng Li and Ryan McElveen, writing online for Brookings in an article entitled “Debunking Misconceptions About Xi Jinping’s Anti-Corruption Campaign”, wrote, “If there were ever any doubts that Xi could restore faith in a party that had lost trust among the Chinese public, many of those doubts have been dispelled by the steady drumbeat of dismissals of high-ranking officials since he took office.”

There have already been demonstrated economic benefits to China’s anti-corruption campaign. In September, Bloomberg reported that China’s fight against bribery and corruption could boost economic growth, generating an additional $70 billion for the budget, in summarizing economists’ forecasts. An article in the online publication Position and Promotions, reported that the bribery “could trigger a 0.1-0.5 percent increase in the world’s second-biggest economy, equivalent to $70 billion dollars.” This crackdown should also be welcomed by western companies, as “it could also benefit foreign companies operating on the Chinese market, who have experienced the negative effects of the omnipresent palm-greasing, according to Joerg Wuttke, president of European Chamber of Commerce in China.”

GSK’s actions during the pendency of this entire series of events will long be studied as one NOT to follow when faced with allegations of corruption and bribery. GSK sealed its own fate when they, in the face of credible allegations of bribery and corruption by a well-informed whistleblower, performed an investigation and came up with no evidence to support such allegations. It took the Chinese government less than 30 days to not only develop credible evidence but also secure confessions from GSK employees topped off with a very public corporate apology.

As with any good scandal there is a sex angle with a sex tape surfacing involving the GSK China Country Manager. This sex tape and GSK’s attempts to investigate its provenance led to the conviction of a husband and wife investigators, who are a UK and US citizen, in a trial for violations of Chinese privacy laws.

At the close this phase of GSK’s bribery and corruption saga in China, GSK in China – The Book, provides some thoughtful reflection, which you may be able to put to good use in your compliance program going forward. For the compliance practitioner there have been many specific lessons to be learned from GSK’s missteps. I think the clearest lesson is that the only real hope that a company has in today’s world is an effective, best practices anti-corruption compliance program. Whether it is designed to help a company comply with the US Foreign Corrupt Practices Act (FCPA), UK Bribery Act or other anti-corruption legislation, really does not matter. It is the only, and I mean only, chance your company will have when an issue in some far-flung part of the world splashes your company’s name across the world’s press.

But there may also be cause for celebration to those who have long preached against the evils of corruption, whether it is for economic reasons or for those who view the fight against anti-corruption as a part of the fight against terrorism. For if China is attacking domestic corruption, I believe that will lead other countries to do so as well. So while GSK may well suffer going forward, the fight against global bribery and corruption may just have moved a few feet forward.

For a copy of my new book GSK in China: Anti-Bribery Enforcement Goes Global in bound version, click here.

For a copy of my new book GSK in China: Anti-Bribery Enforcement Goes Global in Kindle version, click here.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Good Bye to Mr. Cub, the Siege of Vienna and Doing More Compliance with Less

Let’s play two! That was perhaps the most famous maxim from Ernie Banks, who died this past weekend at the age of 83. As for a sobriquet, it does not get much better than being known as ‘Mr. Cub’ from any baseball fan from 9 to 90. Banks was famous as one of the greatest power-hitting shortstops, leading the National League (NL) in homers and runs batted in, while playing that position as an All-Star in 1958 and 1959. He ended up with over 500 career home runs, when that actually meant something. But he was also known as ‘Mr. Sunshine’ for having one of the most pleasant dispositions of anyone ever to play Major League Baseball (MLB). He remained close to the Cubs team and made frequent appearances at their spring training grounds, in Arizona. Author Harry Strong wrote in 2013 that “the Chicago Cubs do not have a mascot, but they hardly need one when the face of the franchise is still so visible.” Mr. Cub indeed.

I also considered the invasion of Europe by the Ottoman Empire that culminated in the siege of Vienna, in 1683. This marked the high-water mark for the Ottomans and after their defeat they began a long slide until they became known as the ‘sick man of Europe’ in the early 1900s. One of the more interesting things I learned was that the original walls surrounding Vienna had been constructed from monies paid to the Holy Roman Emperor as his ransom for releasing the English King Richard the Lionhearted back in 1194. Talk about getting some serious value for your spending.

I thought about that initial use of monies by the Holy Roman Emperor, who was then the King of Vienna almost 500 years before the Ottoman invasion and how the later walls of Vienna were re-engineered to repulse not only more modern siege weapons but even the advent of gunpowder and cannon fire which the Ottomans tried to use to batter the city into submission.

While the rest of the US economy is finally on an uptick, things down here in Texas are not so rosy with the price of oil hovering at less than $50 per barrel. Major energy service companies have announced cutbacks in spending and layoffs have commenced in a major way, with some companies trimming their work force by over 10% at this early stage. Even companies that have not laid off workers, as yet, are seriously considering no raises or bonuses for the largest parts of their employee base for 2015. For those in the compliance space, viewed as non-revenue generating overhead, things are beginning to get ugly, if not downright scary.

What does this economic reversal mean for compliance? First, and foremost, your compliance function has to continue to operate to prevent, detect and remediate compliance issues. The Department of Justice (DOJ) and Securities and Exchange Commission (SEC) will not consider arguments that ‘we did all we could with what we had’ when you are still operating in places where there is a high indicia of bribery and corruption. But what do Mr. Cub and the Siege of Vienna have with this economic conundrum facing those Chief Compliance Officers (CCOs) and compliance practitioners in the energy space? Both of these examples point out that you can use other parts of your organization to affect your compliance efforts going forward. Banks was associated with the Cubs for over 60 years. The walls of Vienna, originally constructed in the 13^th century, were used as a base for the next 400 years. I have long advocated that your Human Resource (HR) function should be a first-rate friend of your compliance function. There are several areas where HR has expertise that can facilitate your compliance efforts going forward. These include hiring, employee evaluation and succession planning to help enable you to hire, reward and promote employees with the values that compliment your compliance efforts.

Other areas include the IT and Marketing departments. Another person I would add is the Corporate Secretary, the reason for this is that the Corporate Secretary has several constituencies within the company that he or she may work with and for. This can provide an opportunity to view a company’s ethics and compliance program and to help shape and direct it. The Corporate Secretary, head of IT or Marketing may be excellent resources to the CCO, that may be under-utilized. It might be worth a cup of coffee or short meeting to see what they might think about your ethics and compliance program or how they might be able to assist you in your efforts.

Another way to think through some of these issues was presented in a recent article in the Financial Times (FT) Fast Times column, entitled “Local lessons for taking on the world”, by Tyler Brûlé. In this article he pointed to some roundtable discussions he attended at the recent conference in Davos, where local mayors discussed some “tried – and – tested policies for governing thousands of people that can be applied to millions of people”. I found them some excellent thoughts for a CCO or compliance practitioner who might be required to do more with less on a rather immediate basis.

Degree or not degree. The Swiss do not believe that a person must have an advanced degree to fix high-speed cabling above a mountain pass or to be a fine hotel general manager. Brûlé notes there is “An emphasis on apprenticeships and vocational education means more workers with useful skills, rather than thousands of unemployed people with useless degrees.” For the CCO, think about using non-lawyer resources in key roles such as using a well-trained paralegal to oversee your ongoing third party program.

Support compliance locally. With an emphasis on not just locally grown but also locally made, the Swiss use this practice to aid many different and diverse areas from protecting small businesses to wasteful global logistics. Brûlé said that “Buying local helps expand the wealth base and forces big retailers to cater to an audience who appreciate that many items are still Made in Switzerland.” For the compliance practitioner this means using more local resources to home grow compliance in various regions outside the US.

Join the compliance community. Brûlé believes that “New arrivals need to recognize that they’re signing up to Switzerland’s social codes, and not the other way around.” While this might not seem Politically Correct from the political perspective, from the compliance perspective you should work more closely with HR to hire folks who profess the same values that you espouse.

High-value versus value engineering. Brûlé writes that the Swiss have “A tradition of building infrastructure, housing and offices right the first time rather than engineering them so they need to be updated constantly creates a culture where quality is admired and consumers expect value for money rather than settling for “good enough”.” I recognize that programs, policies and procedures need fine-tuning, however, from the walls of Vienna being in use for over 400 years to the Cubs using Ernie Banks as an institution for nearly that long shows that high-value can be derived from multiple sources. As a compliance practitioner you are only limited by your own imagination to make things work, through trial and error if need be but you can create something which will work for some time.

Talk to me. Interestingly Brûlé found that “the Swiss are among the lowest users of social media in Europe.” He chalked this up to “village life, good public transport and a sense of community.” If there is one skill a CCO or compliance practitioner should learn, work on and employ continuously it is to listen. Beyond that your employee base is in large part looking for your input on how to do business ethically and in compliance. So talk to them as well.

So farewell to Ernie Banks and I hope that the Cubs have a better century in the 21^st than they had in the 20^th.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

What’s the Password for Compliance? Swordfish and Lessons for the CCO

I continue my exploration of the Marx Brothers this week by looking at their most successful commercial film made for Paramount, Horse Feathers. While Duck Soup is and always will be my favorite film due to its overall and complete anarchy, Horse Feathers comes in a close second. The movie takes place on a college campus and generally revolves around Huxley College’s attempt to win ‘the big game’ against Darwin College and payments to college football players (does that sound familiar?). I remember after the first time I saw it and told my father about it, he was still able, some 40 years after he first viewed it, to quote the famous password scene involving all manners of puns on the word ‘swordfish’. I quote the entire scene, where Professor Wagstaff (Groucho) attempts to gain access to a Speakeasy guarded by Baravelli (Chico).

Baravelli: …you can’t come in unless you give the password.

Professor Wagstaff: Well, what is the password?

Baravelli: Aw, no. You gotta tell me. Hey, I tell what I do. I give you three guesses. It’s the name of a fish.

Professor Wagstaff: Is it “Mary?”

Baravelli: [laughing] ‘At’s-a no fish!

Professor Wagstaff: She isn’t? Well, she drinks like one! …Let me see… Is it “Sturgeon”?

Baravelli: Aw, you-a craze. A “sturgeon”, he’s a doctor cuts you open when-a you sick. Now I give you one more chance.

Wagstaff: I got it! “Haddock”.

Baravelli: ‘At’s a-funny, I got a “haddock” too.

Wagstaff: What do you take for a “haddock”?

Baravelli: Sometimes I take an aspirin, sometimes I take a calomel.

Wagstaff: Y’know, I’d walk a mile for a calomel.

Baravelli: You mean chocolate calomel? I like-a that too, but you no guess it. [Slams door. Wagstaff knocks again. Baravelli opens peephole again.] Hey, what’s-a matter, you no understand English? You can’t come in here unless you say, “Swordfish.” Now I’ll give you one more guess.

Professor Wagstaff: …swordfish, swordfish… I think I got it. Is it “swordfish”?

Baravelli: Hah. That’s-a it. You guess it.

Professor Wagstaff: Pretty good, eh?

Harpo (“Pinky”) takes the perhaps more direct approach. When Baravelli challenges him for the password, he gets into the speakeasy by pulling a sword and a fish out of his trench coat, putting the sword down the throat of the dead fish and presenting the combined sword and fish the doorman. While I still guffaw when reading all of this, I would urge you to click through to the YouTube video I have linked to at the end of this blog post.

I do find some lessons for the Chief Compliance Officer (CCO) or compliance practitioner in this scene. I have adapted the lessons from an article in the Financial Times (FT) by Michael Skapinker, entitled “Seven lessons in management I learnt over the last decade”.

1. Do not rush. It takes Groucho a while but he does not rush and he gets in. We all arrive with a new plan. Your plan may be right or wrong but unless the barbarians are at the gate (i.e. banks or creditors) you will have time to listen, refine and build alliances and to identify those folks who were actually waiting for what you may want to propose. Skapinker believes the most important promise you will make in an interview is to talk to everyone first and then work towards your implementation.
2. A good deputy helps you sleep at night. This one may seem to be a counter-intuitive lesson from the above skit but not in reality, as it is in the interest of the establishment for Groucho to actually enter the Speakeasy. However, Skapinker believes you should have someone who not only understands what you want but also “a deputy with different skills from yours. You want someone who will alert you to problems. But you also want someone who sees the business the way you do”.
3. Decide what your business stands for and tell everyone until you can no longer stand the sound of your voice. The Marx Brothers did this every time they opened their collective mouths; insanity prevailed. Skapinker wrote, “You need to decide what yours is, and you need to keep telling people, both inside and outside. Whether they believe you depends on how true it is”. I cannot think of anything more important for the CCO or compliance practitioner to follow.
4. Hire people on probation. This would seem to be the entire point of the swordfish exercise. You need to find a way to determine if folks are going to do and say the right thing before you let them in. In the corporate world this should take place in the form of employees being evaluated for doing business the right way and in compliance with anti-corruption laws such as the Foreign Corrupt Practices Act (FCPA) or UK Bribery Act. Whenever someone is promoted to senior management or into a position where there is a high risk of corruption, such as to a region with a propensity for corruption, such an evaluation should be made by the compliance function in conjunction with the Human Resources (HR) function of an organization.
5. Treat your team like adults. If the Marx Brothers were anything it certainly was adults. By this I mean their humor worked on multiple and a multitude of levels. It worked for me as a teenager in the 1970s just as it worked for my father who was then in his late 40s. Skapinker relates what might seem self-obvious that “Most people want to do a good job. They do not come to work to rip you off. So trust them. Judge them by their results and do not hover over them.” However, coming from the energy industry in Houston, I have certainly seen companies that treated employees like they were in the third grade. It simply does not work in the compliance arena because if you are big enough to be international, you will not have the ability to lord over all your employees, all the time. You have to try and hire the right folks, train them and give them the tools to succeed.
6. Tell people what they have just told you. This technique simply shows you are listening, which is how Groucho finally figured out the password and got into the Speakeasy. In a company, Skapinker believes that “There is no more powerful management tool than showing people that you have listened to them. The best way not only to show you have listened, but really to do so, is to repeat their views in good faith back to them. That way, even if you decide something different, they feel they have had a good hearing.” At the close of meetings you can use this strategy to help rally your team around your decision including those who might have disagreed with you.
7. Make your numbers. I think Harpo’s example here is paramount. Let folks see what you are doing. Since he was the mute one, he gave a visual representation of a swordfish but it communicated the message. For the CCO or compliance practitioner, you need to come up with some metrics to demonstrate the value you are adding. I would suggest that it comes in the area of accounting controls because at the end of the day, internal controls under the FCPA are accounting controls. You need to communicate your mission and that you are achieving it to the Board of Directors or senior management. 

I still grin when I think about the swordfish scene. For a clip of the scene on YouTube, click here.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Get Your Tootsie-Frootsie Ice Cream; Hiring as Part of Your Compliance Program

One of my great loves is the Marx Brothers. I fell in love with their rapid-fire wiseacre remarks as a teenager and have been enthralled with them since then. I have seen all of their movies, most of their television appearances and even read some of their radio scripts. I was reminded of the their unique brand of comedy and contribution to the great good when I read an article in the Financial Times (FT) by Danny Leigh, entitled “Souped-up comedy”. Leigh wrote the article around the British Film Institute’s (BFI) 2015 season, which includes a year-long retrospective of Marx Brothers movies. To honor both the BFI and my beloved Marx Brothers, this week, I am featuring series of Marx Brothers themed blog posts.

Today, I want to look at what many believe is one of their funniest skits, which comes from the MGM-released movie A Day at the Races, the “Tootsie-Frootsie” Ice Cream/Code Book scene. Tony (Chico) poses as an ice-cream vendor outside the racetrack – he is actually a con artist selling racing tips on horses. He knows that in the next race, he can win with 10-1 odds with a bet on Sun-Up, but he needs the cash. So he sets up the scam as gullible victim Dr. Hackenbush (Groucho) arrives at the racetrack to bet two dollars on Sun-Up. Hackenbush is advised by Tony to bet on Rosie, a 40-1 shot. At the betting window, Hackenbush bets two dollars on Rosie, but the bookie tells him the race is already over – Sun-Up was the winner. Hackenbush realizes he has been taken. He thinks for a moment, then dumps the books back in the cart and takes the scammer’s place waiting for a victim, crying: ”Get your Tootsie-Frootsie. Nice ice cream. Nice Tootsie-Frootsie ice cream.”

I thought about the Tootsie-Frootsie ice cream scene in the context of hiring and Foreign Corrupt Practices Act (FCPA) compliance. One of the theories of conventional wisdom about anti-corruption compliance is that you will never be able to reach 5% of your workforce with compliance training because they are predisposed to lie, cheat and steal anyway. Whether they are simply sociopaths, scumbags or just bad people; it really does not matter. No amount of training is going to convince them to follow the rules, such as the FCPA, UK Bribery Act or even foreign domestic laws against bribery and corruption, consider the Chinese domestic laws that GlaxoSmithKline PLC (GSK) was convicted under, they were of no import to such people. They do not think such laws apply to them and they will lie, cheat and steal no matter what industry they are in and what training you provide to them. But knowing such people exist and they may be able to lie, con or otherwise dissimilate their way into your organization does not protect your company from FCPA liability when they inevitably violate the law by engaging in bribery and corruption. It is still the responsibility of your company to prevent and detect such conduct and then remediate if it occurs. Simply put, if you hire Chico, you are going to get a Tootsie-Frootsie ice cream.

I thought about these concepts when reading an article in the Corner Office column of the New York Times (NYT), entitled “Three Keys to Hiring: Skill, Will and Fit”, by Adam Bryant where he reported on an interview with Marla Malcolm Beck, the Chief Executive Officer (CEO) of Bluemercury. She had several lessons that I thought would be helpful for Chief Compliance Officer (CCO) or compliance practitioner in general and in particular when trying to have your company avoid bringing in the five per-center mentioned above.

Be Passionate

Beck related an early leadership lesson that she learned during college, she ran unopposed to be President of a student organization. Since she was unopposed, she ran no campaign but did not receive a majority of votes and therefore was not elected to the position. So she tried to learn from her mistakes, “In the second election, someone ran against me, but I had interviewed a lot of people about why I didn’t get the position the first time, and they said I wasn’t human enough, I wasn’t passionate enough. So I talked more about the mission and my dreams for the organization, and I think people respected me for getting up there again, and I got most of the votes.” For the compliance practitioner or CCO, I think the message here is both communication and passion. If you do not believe in the anti-corruption compliance regime that you are pushing, it will be nearly impossible for the rest of your far-flung corporate work force to believe in it. Talk about compliance and the positive aspects of your program for your company. If you sit in your office, situated as Dr. No in the Land of NO, you and your program will get NOwhere fast.

Problem Solving

Another valuable lesson that Beck related was one she learned early on in her entrepreneurial career and it related to problem solving. She said, “Early on, I kept a lot of the hard problems to myself. Not only did that put more pressure on me, but also people can start working on the wrong things, and you have no way to course-correct if you don’t give them the “why.” I don’t think I was brave enough early on, and I’m more brave now about not keeping things to myself — things that are working, things that are not working, and just being more fluid with communication. I still catch myself now when I’m asking people to do things, and I have to go back to why it’s important and why we need to do this as a company.”

As a CCO or compliance practitioner, you will never have enough time to answer every question, nor should you. If you can provide your employee base the tools to make the right call, I think you will find most of the time they will. In a compliance leadership role, you should have two overriding goals: (1) burn compliance into the DNA of your company deeply enough that the business folks will come up with the right response almost all the time, and (2) be there when they cannot do so. Beck’s query of “why it’s important and why we need to do this as a company.”

The Hiring Process

I found Beck’s remarks on hiring the most interesting. I have long argued that Human Resources (HR) is a key component in any best practices anti-corruption compliance program. This is particularly true in hiring and promotion of employees to senior management. Avoiding the hiring or promotion of the sociopaths, or even the Chico’s of the world, is a key tool that HR brings to the table. Beck’s approach is to take a short interview technique in which she attempts to assess, Skill, Will and Fit. She said, “I’ll ask, “What’s the biggest impact you had at your past organization?” It’s important that someone takes ownership of a project that they did, and you can tell based on how they talk about it whether they did it or whether it was just something that was going on at the organization. Will is about hunger, so I’ll ask, “What do you want to do in five or 10 years?” That tells you a lot about their aspirations and creativity. If you’re hungry to get somewhere, that means you want to learn. And if you want to learn, you can do any job. In terms of fit, I’m looking for people who have some sort of experience with a smaller company. At big companies, your job is really one little piece of the pie. I need someone who can make things happen and is comfortable with ambiguity.”

Through such a structured series of questions, a properly trained HR professional can begin to assess whether an employee might have a propensity to engage in bribery and corruption. By adding information about your company’s values towards doing business ethically and in compliance, you can introduce this topic at either the interview evaluating process or in the promotion process. While true sociopaths will most certainly lie to you, perhaps even convincingly, by introducing the topic at such a pre-employment stage, they may be encouraged to take their skills elsewhere. Or you can just get your Tootsie-Frootsie ice cream.

For a clip of the Get Your Tootsie-Frootsie Ice Cream scene on YouTube, click here.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Where to Now St. Peter? – Due Diligence Going Forward in China

Whatever you might think of where his career went, Elton John had some great early stuff. I still rank Tumbleweed Connection right up there as one of my favorite albums of all-time. And while it was packed with some great tracks, one of my most favorite was Where to Now St. Peter? It was the opening track on Side 2 and dealt with whether a dying soldier would end up in heaven or hell. While perhaps having quite the spiritual overtones, I did think about this song when I read about the convictions on Saturday of Peter William Humphrey, a 58-year-old British national, and his wife, Yu Yingzeng, a 61-year-old naturalized American, on charges of illegally purchasing personal information about Chinese nationals.

In a one day trial the couple was convicted of illegally purchasing information on Chinese citizens. In an article in the Financial Times (FT), entitled “China court hands GSK investigator jail term and orders deportation”, Gabriel Wildau and Andrew Ward reported that husband Humphreys received a two and a half year jail term which was “just short of the three-year maximum”. In an article in the Wall Street Journal (WSJ), entitled “China Convicts Two Corporate Investigators”, James T. Areddy and Laurie Burkitt reported that he was also ordered to pay a fine of approximately $32,500 and will be deported from the country when his jail term is completed. Wife Yingzeng received a two year jail term and was ordered to pay a fine of approximately $23,000 but will be allowed to remain in the country after her sentence is completed.

In a New York Times (NYT) article, entitled “In China, British Investigator Hired by Glaxo, and Wife, Sentenced to Prison”, David Barboza reported that the couple “acknowledged that from 2009 to 2013, they obtained about 250 pieces of private information about individuals, including government-issued identity documents, entry and exit travel records and mobile phone records, all apparently in violation of China’s privacy laws.” According to the NYT article, wife Yu claimed that she did not know her actions where illegal and was quoted as saying, “We did not know obtaining these pieces of information was illegal in China. If I had known I would have destroyed the evidence.” According to the WSJ, the privacy law which was the basis of the conviction, was enacted in 2009 “to make it illegal to handle certain personal medical records and telephone records” but that the law itself “remains vague” on what precisely might constitute violation.

From the court statements, however, it did appear that the couple had trafficked in personal information. As reported by the WSJ, “In separate responses over more than 10 hours, My Humphreys and Ms. Yu denied that their firm trafficked in personal information, saying they had hired others to obtain personal data when clients requested it.” From the documents presented by the prosecution, it would seem clear that the couple had obtained my items which were more personal in nature. They were alleged by prosecutors to have “used hidden cameras to gather information as well as government records on identification numbers, family members, real-estate holdings, vehicle owner, telephone logs and travel records.”

Recognizing the verdicts under Chinese laws are usually predetermined and the entire trials are scripted affairs, there is, nonetheless, important information communicated to the outside world by this trial. First and foremost is, as reported in the NYT article is a “chilling effect on companies that engage in due diligence work for global companies, many of whom believe the couple may have been unfairly targeted.” The WSJ article went further quoting Geoffrey Sant for the following, “It impacts all attempts to do business between the U.S. and China because it will be very challenging to verify the accuracy of company or personal financial information.” In other words, things just got a lot tougher to perform, what most companies would expect to be a minimum level of due diligence.

Second is the time frame noted in the court statements as to the time of the violations, from 2009 to 2013. Many had assumed that Humphreys and Yingzeng’s arrests related to their investigation work on behalf of the British pharmaceutical giant GlaxoSmithKline PLC (GSK) which was trying to determine who had filmed a sex tape of the company’s head of Chinese operations, which was then provided to the company via an anonymous whistleblower. This would seem to beg the question of whether the couple would have been prosecuted if they not engaged in or accepted the GSK assignment.

But as Elton John asked, “Where to now St. Peter?” You should always remember that performing due diligence is but one of five steps in the management of the third party life cycle. If you cannot perform due diligence at a level that you do in other countries or that you could even have done in China before the Humphreys and Yu trial, you can beef up the other steps to help proactively manage your third parties. I often say that your real work with third parties begins when the contract is executed because then you have to manage the relationship going forward. So, if you cannot perform the level of due diligence you might like, you can put more resources into monitoring the relationship, particularly in the area of invoice review and payments going forward.

In a timely article found in this month’s issue of the SCCE magazine, Compliance and Ethics Professional, Dennis Haist and Caroline Lee published an article, entitled “China clamps down on bribery and corruption: Why third-party due diligence is a necessity” where they discussed a more robust response to the issue as well. They note that the retention of third party’s to do business in China is an established mechanism through which to conduct business. They advise “For multinationals with a Chinese presence, or plans to enter the market in the near future, now is the time to pay close attention to the changing nature of the business landscape as it relates to bribery and corruption.” Further, they suggest that “In order to ensure compliance with ABAC [anti-bribery/anti-corruption] regulatory scrutiny, multinationals must demonstrate a consistent, intentional and systematic approach to third-party compliance.” But in addition to the traditional background due diligence, they believe that companies should consider an approach that moves to proactively managing and monitoring third parties for compliance. Lastly, at the end of the day if a regulator comes knocking from the Department of Justice (DOJ) or Serious Fraud Office (SFO), you will need to demonstrate the steps you have put in place and your active management of the process.

In the FT, WSJ and NYT articles it was clearly pointed out that the invisible elephant in the room was GSK. Also it is not clear what the personal tragedy that Humphreys and Yu have endured will mean for GSK or the individuals caught up in that bribery scandal going forward. Humphreys had previously said that he would not have taken on the GSK sex tape assignment if it had been disclosed to him that the company had sustained allegations of corruption by an internal whistleblower. Perhaps one lesson may be that in the future companies will have to disclosure more to those they approach to perform such investigative services.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2014

GSK Faces a Bad Day at Black Rock

One of my favorite movies is Bad Day at Black Rock. It is one of the few movies to combine elements of film noir into something approaching a traditional Western. It also attacks directly the prejudice and hate against Japanese-Americans in the immediate aftermath of Pearl Harbor. I thought about that eponymous title when I read a recent article in the Financial Times (FT), entitled “GSK salesmen want ‘bribes’ reimbursed”, by reporters Patti Waldmeir and Andrew Ward.

You know it is going to be a bad day when your employees line up to testify against your company in an ongoing investigation for bribery and corruption. But those rainy day sighs can go up to the Bad Day at Black Rock level when these same employees publicly announce that the company they work for owes them for the creation of fraudulent invoices used by a business unit to fund bribery and corruption which violates not only the US Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act but also domestic Chinese anti-corruption laws. This happened to the UK pharmaceutical giant GlaxoSmithKline PLC (GSK) last month when it was announced that certain current employees in its China operation were petitioning the company to reimburse them for bribes they were ordered to pay by their superiors.

In their article, Waldmeir and Ward wrote “the UK pharmaceutical company at the centre of a Chinese corruption scandal, is facing protests from junior employees who say the company is refusing to reimburse them for bribes they were ordered to pay by their superiors.” While my initial thought was that these Chinese employees had quite a bit of ‘cheek’ in raising this claim, the more I read into the story, the more I think it may portend serious problems for GSK in any attempt to defend the company going forward. Waldmeir and Ward reported “some Chinese sales staff are complaining that GSK has denied bonuses, threatened dismissal or refused to reimburse them for bribes they say were sanctioned by their superiors to boost the company’s drug sales. In some cases, managers instructed them to purchase fake receipts that were used to cover up bribes paid in cash or gifts to doctors and hospitals, according to salesmen interviewed by the Financial Times.”

The article went on to highlight just how some of these fake invoices, used to gain funds from the corporate headquarters to facilitate bribery and corruption, were generated. “In some instances, managers disguised their involvement by using their personal email address to instruct staff to pay bribes and by ordering junior staff to claim on their personal expense accounts – even if the bribe was actually paid out by the manager – according to these people.” Last March, a group of current GSK employees sent a letter to the company that said, in part, ““All the expenses were approved by the company,” the group wrote in a letter to management. “The expenses were paid with our own money, and although the receipts were not compliant, it was our managers who told us to buy the fake receipts,” said one former GSK salesman.”

The article quoted that GSK said, “We have zero tolerance for unethical or illegal behaviour and anyone who conducts such behaviour has no place in our company. We believe the vast majority of our employees uphold our values and we welcome employees speaking up if they have concerns.” Talk about a ‘Speak Up’ culture at your company. Probably not exactly what the company had in mind when it invited employees to raise their concerns.

However, as damning as this is, and it would certainly appear to be quite damning, was the following revelation, which was also reported by Waldmeir and Ward, regarding witness prep during GSK’s internal investigation. They wrote, “Some staff were warned not to implicate their supervisors, according to a former salesman: “Our manager approached each person before they were questioned and asked them not to mention his name. He even prepared a story for them to tell the investigator.””

Dissecting all of the above, it would appear that GSK has several real problems on several fronts from this article. The first is that there appears to have been clear China business unit management participation in the bribery and corruption scheme. While it is still not clear whether the corporate home office was involved in the scheme, simply knew of it or choose to bury its collective head in the sand as to what was going on in China, if your in-country business unit management is involved, it is not too many steps to the corporate home office. Conversely, the question might be that if this fraud against the corporate home office was so open and obvious, why did the corporate office not detect it going forward?

Yet the real issue for the corporate office may be the information about employees being coached to hide evidence during the investigation. If such activity was limited to the ‘managers’ in the Chinese business units only, what does it say about a corporate office, which allows such witness intimidation? Think that is an investigation best practice? However, if the corporate office was involved in any way in such witness intimidation, it will bode extremely poorly in the eyes of the Chinese regulators, the UK Serious Fraud Office (SFO), which has opened an investigation into the GSK matter and probably the US Department of Justice (DOJ) as well, since GSK is still subject to the Corporate Integrity Agreement (CIA) it signed back in July of 2012; when it pled guilty and paid $3 billion to resolve fraud allegations and failure to report safety data in what the DOJ called the “largest health care fraud settlement in U.S. history” according to its press release. Think witness tampering or hiding of evidence might garner the attention of the DOJ for a company already under the equivalent of a Deferred Prosecution Agreement (DPA)?

In addition to all of the above conduct, it will be interesting to see the effect of this ongoing investigation on the stock value of GSK. In a Wall Street Journal (WSJ) article, entitled “FCPA Hits Companies Harder if they Committed Fraud”, Sam Rubenfeld reported “A study of U.S. Foreign Corrupt Practices Act enforcement issued by the Searle Civil Justice Institute, a research division of The Law & Economics Center at George Mason University School of Law found that public companies lost an average of 2.9% of market capitalization as a result of an investigation. But, the study found, the number masks an important distinction: Companies charged with bribery only suffered an initial 1.5% loss, while those charged with bribery and financial fraud saw a initial drop of 16.3% in market cap.” It will be interesting to see the effect the apparent fraudulent activities of GSK’s China employees will have on not only the overall penalty assessed against GSK but if there is any attendant drop in shareholder value.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

 

© Thomas R. Fox, 2014

Citibank: Multiple Failure of Compliance as the Hammer Drops

What is the cost of the failure to perform appropriate due diligence on a regular basis? What red flags should you look for when considering doing business with a customer, party in the sales channel or entity in the supply chain? All of these questions and more continue to swirl around Citigroup and its Mexican subsidiary Banamex over the ongoing investigation into allegations of fraud at Citi’s Mexico bank unit.

Citi had come to grief when there was a reported $400MM loss in Banamex involving the Mexican marine energy services company Oceanografía SA de CV. The problems arose after Banamex had extended $585MM in short-term credit to a company that Citi itself had warned its own bond investors was “from time to time subject to various accusations, including accusations of corrupt practices.” Oceanografía provided construction, maintenance and vessel-chartering services to the Mexican national energy company, Pemex’s exploration and production subsidiary. But Oceanografía’s fortunes, changed sharply in February of this year after it became the subject of a new government review that resulted in a suspension of Pemex contracts to Oceanografía for the next 20 months. Banamex had previously advanced as much $585 million to Oceanografía through an accounts receivable program, which would advance money to Oceanografía to provide services to Pemex. Pemex would then pay back Banamex, verifying invoices provided by Oceanografía to confirm that the work had been completed. In other words, Banamex was relying on Pemex’s ability to pay back the bank. But all of this ended when Pemex suspended its contracts with Oceanografía.

In a Wall Street Journal (WSJ) article, entitled “Citi Says Signs of Mexico Fraud Weren’t Escalated”, Christina Rexrode reported that Citi Chief Executive Officer (CEO) Michael Corbat told investors that employees “missed signs of trouble they should have recognized and elevated to superiors.” In a talk to investors Corbat was quoted as saying “There were telltales along the way” and he promised that “the bank would work on motivating and encouraging employees to raise their concerns when they notice potential problems.” But the problems ran deeper and were perhaps more systemic than simply the failure to escalate. Rexrode reported “People inside the bank have said the unit was allowed to operate as its own fiefdom, with New York employees struggling to get information about how the unit operated.” However, “A Citigroup spokesman said in a statement that “Banamex is absolutely subject to the same risk, control, anti-money-laundering and technology standards and oversight which are required throughout the company.””

These statements come on the heels of the dramatic firing of 11 Banamex employees just two weeks earlier. After meeting with the Citi Board of Directors, Corbat flew to Mexico City and terminated 11 employees. In an article in the New York Times (NYT), entitled “Citi Fires 11 More in Mexico Over Fraud”, Michael Corkery and Elisabeth Malkin reported that “Among those fired were four of the bank’s top executives in Mexico: its head of corporate banking, head institutional risk officer, head of trade finance and head of trade and treasury solutions. Some of the employees had worked at Banamex for as long as two decades and were not involved in the fraud directly. The bank fired many because they had not taken steps to detect the fraud or had ignored warning signs about the client.”

But apparently Citi expects there to be more disciplinary actions stemming form the matter. In an article in the Financial Times (FT), entitled “Citi fires 11 staff in Mexico unit”, Jude Webber, Camilla Hall and Kara Scannell reported that Corbat said in a memo to staff “Before our investigation concludes, we expect that several other employees, both inside and outside of Mexico, may receive forms of disciplinary action as well.” Two persons who may yet face such disciplinary action are “Manuel Medina-Mora, a Citi executive who oversees the Mexican operations and had his pay docked by $1.1m in March, or Javier Arrigunaga, Banamex chief executive.” Additionally, and perhaps more ominously for Citi, both the F.B.I. and prosecutors from the United States attorney’s office in Manhattan are investigating “Whether Citigroup willfully ignored possible warning signs”.

What red flags did Citi miss and for how long? One clue was reported in the NYT article, which noted that Oceanografía “is known among Mexican investors as politically connected but financially troubled. Credit rating firms in the United States, corporate bond investors and Mexican lawmakers have raised concerns about Oceanografía. In 2009, United States ratings firm Fitch warned about Oceanografía’s high leverage and poor cash flow generation. Fitch eventually withdrew its ratings because the company was not supplying enough information. In 2008, Standard & Poor’s noted that Mexico’s congress had investigated accusations of improper deals between Oceanografía and Pemex, though no wrongdoing was proved. Still, Oceanografía grew to become one of Banamex’s 10 largest corporate clients. The fraud erased 19 percent of the unit’s banking profits last year.”

These troubles were seemingly magnified in Mexico when the CEO of Oceanografía, Amado Yáñez Osuna, was arrested and charged with violating Mexican banking laws. In a WSJ article, entitled “Oil-Tinged Graft Scandal Roils Mexico”, Laurence Iliff and Amy Gutherie reported “The arrest deepens a scandal that has sent shock waves across Mexico’s political landscape. That put a spotlight on long-simmering allegations that the country’s former ruling National Action Party, known as PAN, used Pemex to favor Oceanografía and other contractors during the party’s 12 years in power, which ended with the 2012 election of President Enrique Peña Nieto of the Institutional Revolutionary Party (PRI).” Further, during those “12 years, Oceanografía’s contracts with the oil monopoly swelled from a few million dollars a year to hundreds of millions of dollars, according to a review of the contracts by The Wall Street Journal. Most of the contracts were obtained in public bids, although some were assigned directly without bids, including one contract for about $65 million in the final months of the Calderón administration.”

The case took a far more ominous turn when authorities when Mexican authorities announced last week that they had issued arrest warrants for multiple Banamex executives. In an article in the FT entitled, “Mexico issues fresh set of Banamex arrest warrants” Jude Webber reported that “Mexico has issues more arrest warrants – including an unspecified number for staff at Citigroup’s Banamex unit – a day after detaining the owner of the oil services company at the centre of a $400m alleged fraud scandal that has rocked the bank since its disclosure there months ago.” In an article in the NYT entitled, “Mexico Authorizes Arrests In Fraud at Citigroup Unit” Elisabeth Malkin and Michael Corkery reported, “Attorney General Jesús Murillo Karam of Mexico confirmed on Friday that the authorities were seeking the former executives. He declined to say how many were involved.” Yes, there are warrants, but I won’t say who,” Mr. Murillo Karam told reporters.” Apparently not even Citigroup knows whose arrests may be imminent.

What are the lessons for the compliance practitioner? Three keys points are controls, escalation and oversight. What type of internal controls, or lack thereof, allowed one company to obtain such credit on what were basically receivables financing? What about allowing the Banamex unit to basically run its own show with little to no oversight from the corporate headquarters? Corkery and Malkin reported, “Citigroup is keen to demonstrate to regulators and investigators in the United States and in Mexico that it is cracking down on its employees for not catching the fraud. But the breadth of the punishment could also suggest that the bank, despite assurances that the fraud is confined this case, has had widespread problems with controls and oversight across its Mexican unit.” Moreover, in his memo to staff, Corbat said, ““we are reviewing our controls and processes in Mexico and strengthening any area we think falls short of our global standards or best practices.”” Corbat also noted Citi was looking at ways to encourage employees to increase escalation of issues earlier.

Moreover with these now imminent arrests of Banamex executives, Citi may be facing more serious charges in the US. Leaving aside the inane argument of a ‘rogue business unit’ it may be that the US parent choose not to look too closely at its high-flying and very profitable Mexican subsidiary. If, as it seems from the newspaper accounts, that Oceanografía was well known for the business tactic of under-bidding for contract and then making up the differences in cost overruns, this may not bode well for the Banamex executives or Citigroup. Likewise if there was one company that Banamex did business with, which engaged in such behavior, there may other similarly situated companies once a detailed investigation of the Citigroup unit is concluded.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2014