Mifune Gets a Star on the Walk of Fame-the Petrobras Scandal Only Gets Worse

It was announced last week that actor Toshirō Mifune (1920-1997) will be honored with a star bearing his name on the Hollywood Walk of Fame. The Hollywood Chamber of Commerce will add the star in 2016, together with new stars in the motion picture category for Quentin Tarantino, Michael Keaton, Steve Carell, Bradley Cooper, Ashley Judd and Kurt Russell. For those of you who may not have heard of Mifune, he was a veteran of sixteen films directed by Akira Kurosawa as well as many other Japanese and international classics. His films with Kurosawa are considered cinema classics. They include Drunken Angel, Stray Dog, Rashomon, Seven Samurai, The Hidden Fortress, High and Low, Throne of Blood, Sanjuro, and Yojimbo. While there are many great, great performances in these films, my personal favorite is Yojimbo where Mifune plays an un-named Ronin, who cleans out a village infested by two warring clans. The film was the basis for the great first Sergio Leone/Clint Eastwood Spaghetti western, A Fistful of Dollars. 

I had always thought that the Hollywood Walk of Fame honors actors but it turns out that it honors a great many more performers. For instance, next year will also see names like LL Cool J, Cyndi Lauper, Shirley Caesar, Joseph B. “Joe” Smith, Itzhak Perlman, Adam Levine, and Bruno Mars added in the music category. I considered this category of entertainers wider than simply actors when I recently read more about the burgeoning scandal in Brazil around the state owned energy company Petrobras and its ever-growing fallout.

The fallout has extended far beyond Petrobras, Brazil and even the direct parties who may have been involved. In an article in the Financial Times (FT), entitled “Petrobras woes loom large in Shell deal for BG”, Joe Leahy, Jamie Smyth and Christopher Adams reported on how the ongoing matter is affecting the world of super sized mergers and acquisitions. The rather amazing thing about this issue is not that British Gas (BG) has been caught up in the scandal or even has been alleged to paying bribes to Petrobras.

Rather it is because of assets that BG has in its portfolio. The article said, “Brazil has the potential to become the location of the most troubled assets in BG’s portfolio because the UK company is partner to Petrobras in some of the vast pre-salt oilfields off the country’s east coast in the Santos Basin.” This has led to speculation that “There is a risk that Petrobras will struggle to fulfill its mandate as sole operator for all new pre-salt oilfields because of the corruption scandal, and that this leads to delays in developing the deepwater discoveries, including those involving BG.”

This development arising out of the Petrobras scandal is so significant that BG mentioned it in their annual report, saying “In Brazil, we are closely monitoring how the current corruption allegations affecting Petrobras may impact the cost and schedule of the Santos Basin [pre-salt] development because of supply chain disruption and/or capital and liquidity constraints placed on Petrobras.” Think about that statement for a moment. It is only in the annual report because it could have a ‘material’ effect on BG and BG is a company being acquired by Shell to the tune of £55 million. However, as noted in the FT article, “many analysts say that Petrobras, partly because of the magnitude of the scandal, does not have the capital or management bandwidth to be the sole operator of all new pre-salt fields.”

What if Petrobras becomes unable to develop enough resources to feed South America’s largest democracy’s need for energy? In 2014 alone, the company posted a new loss of $7.4 billion, of which $2.5 billion was attributable to the ongoing bribery and corruption scandal. How much will it cost the country of Brazil to bring in outsiders to develop its own natural resources? This is a real possibility and it was further driven home by another FT article by Joe Leahy, entitled “Petrobras plans 37% cut in investment”. Petrobras currently is required by Brazilian “government policy forcing it to import petrol at international prices and sell it in the domestic market at a subsidized rate.”

Things can only get worse as Leahy reported that the company announced it “was cutting its projection for investment in 2015-2019 to $130.3bn or by 37 percent in relation to its previous plan.” This would lead to a reduction in “domestic production to 2.8m barrels per day of oil equivalent by 2020 from the previous target of 4.2m.” The article ended by noting that Petrobras would “divest $15.1bn in assets and undertake additional restructuring and sales of assets totaling $42.6bn in 2017-18.”

All of this certainly bodes poorly for the citizens of Brazil. For those who claim that bribery is a victim-less crime; I would point to this as Contra-Example A. But this information is also of significance to any Chief Compliance Officer (CCO) or compliance practitioner for a US, UK or other western country. Not only must you review any contracts you had with Petrobras and any of its suppliers; now you must digger several levels deeper. If you are in an acquisition mode, you not only need to look at the contracts of your target to see if they may have been obtained through bribery and corruption, the simple fact of having a contract with Petrobras may put your potential portfolio asset base at risk. For if Petrobras has to cut back 37% on investments at this point, chances are it will only get much worse. This 37% reduction is based on only the first round of estimates of the cost to the company of the bribery scandal.

But more than simply contracts directly with Petrobras, if you are evaluating a target who has contracts with Petrobras suppliers, you may be at equal risk. Not only could those suppliers obtain their contracts with Petrobras through bribery and corruption, those same contracts, even if valid, may not be worth their estimated value if Petrobras cannot fulfill them or even worse, pay for the goods and services delivered thereunder. How about payment terms? Do think for one minute, Petrobras would not unilaterally extend payment dates out 30, 60, 90 even 180 days when it finds itself in more bribery and corruption hot water?

Finally, I think there is a very good chance the US Department of Justice (DOJ) or Securities and Exchange Commission (SEC) could come knocking, unannounced, for any US company doing business with Petrobras or even with significant operations in Brazil. The SEC could do something as simple as send a letter requesting clarification of your internal controls or books and records regarding subcontractors or other third parties in Brazil. If you received such a letter, would you be in position to respond from the requirements for a public company under the Foreign Corrupt Practices Act?

Toshirō Mifune had a long and distinguished acting career. While it is not clear how long, how far and how deep the Petrobras corruption scandal will reach, it is clear that its repercussions will extend far past the energy industry or even Brazil. You need to review and be prepared to respond now.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2015

Opinion Release 14-02: Dis-Linking The Illegal Conduct Going Forward

One of my favorite words in the context of Foreign Corrupt Practices Act (FCPA) enforcement is dis-link. I find it a useful adjective in explaining how certain conduct by a company must be separated from the winning of business. But it works on so many different levels when discussing the FCPA. Last week I thought about this concept of dis-linking when I read the second Opinion Release of 2014, that being 14-02. One of the clearest ways that the Department of Justice (DOJ) communicates is through the Opinion Release procedure. This procedure provides to the compliance practitioner solid and specific information about what steps a company needs to take in the pre-acquisition phase of due diligence. However, 14-02 directly answers many FCPA naysayers long incorrect claim about how companies step into FCPA liability through mergers and acquisitions (M&A) activity.

From the Opinion Release it was noted that the Requestor is a multinational company headquartered in the United States. Requestor desired to acquire a foreign consumer products company and it’s wholly owned subsidiary (collectively, the “Target”), both of which are incorporated and operate in a foreign country, never issuing securities in the United States. The Target had negligible business contacts in the US, including no direct sale or distribution of their products. In the course of its pre-acquisition due diligence of the Target, Requestor identified a number of likely improper payments by the Target to government officials of Foreign Country, as well as substantial weaknesses in accounting and recordkeeping. In light of the bribery and other concerns identified in the due diligence process, Requestor also detailed a plan for remedial pre-acquisition measures and post-acquisition integration steps. Requestor sought from the DOJ an Opinion as to whether the Department would then bring an FCPA enforcement action against Requestor for the Target’s pre-acquisition conduct. It was specifically noted that the Requestor did not seek an Opinion from the Department as to Requestor’s criminal liability for any post-acquisition conduct by the Target.

Improper Payments and Compliance Program Weaknesses

In preparing for the acquisition, Requestor undertook due diligence aimed at identifying, among other things, potential legal and compliance concerns at the Target. Requestor retained an experienced forensic accounting firm (“the Accounting Firm”) to carry out the due diligence review. This review brought to light evidence of apparent improper payments, as well as substantial accounting weaknesses and poor recordkeeping. The Accounting Firm reviewed approximately 1,300 transactions with a total value of approximately $12.9 million with over $100,000 in transactions that raised compliance issues. The vast majority of these transactions involved payments to government officials related to obtaining permits and licenses. Other transactions involved gifts and cash donations to government officials, charitable contributions and sponsorships, and payments to members of the state-controlled media to minimize negative publicity. None of the payments, gifts, donations, contributions, or sponsorships occurred in the US, none were made by or through a US person or issuer and apparently none went through a US bank.

The due diligence showed that the Target had significant recordkeeping deficiencies. Nonetheless, documentary records did not support the vast majority of the cash payments and gifts to government officials and the charitable contributions. There were expenses that were improperly and inaccurately classified. It was specifically noted that the accounting records were so disorganized that the Accounting Firm was unable to physically locate or identify many of the underlying records for the tested transactions. Finally, the Target had not developed or implemented a written code of conduct or other compliance policies and procedures, nor did the Target’s employees show an adequate understanding or awareness of anti-bribery laws and regulations.

Post-Acquisition Remediation

The Requestor presented several pre-closing steps to begin to remediate the Target’s weaknesses prior to the planned closing in 2015. Requestor aimed to complete the full integration of the Target into Requestor’s compliance and reporting structure within one year of the closing. Requestor has set forth an integration schedule of the Target that included various risk mitigation steps, dissemination and training with regard to compliance procedures and policies, standardization of business relationships with third parties, and formalization of the Target’s accounting and record-keeping in accordance with Requestor’s policies and applicable law.

DOJ Analysis

The DOJ noted black-letter letter when it stated, ““It is a basic principle of corporate law that a company assumes certain liabilities when merging with or acquiring another company. In a situation such as this, where a purchaser acquires the stock of a seller and integrates the target into its operations, successor liability may be conferred upon the purchaser for the acquired entity’s pre-existing criminal and civil liabilities, including, for example, for FCPA violations of the target. However this is tempered by the following from the 2012 FCPA Guidance, “Successor liability does not, however, create liability where none existed before. For example, if an issuer were to acquire a foreign company that was not previously subject to the FCPA’s jurisdiction, the mere acquisition of that foreign company would not retroactively create FCPA liability for the acquiring issuer.””

This means that because none of the payments were made in the US, none went through the US banking system and none involved a US person or entity that this would not lead to a creation of liability for the acquiring company. Moreover, there would be no continuing or ongoing illegal conduct going forward because “no contracts or other assets were determined to have been acquired through bribery that would remain in operation and from which Requestor would derive financial benefit following the acquisition.” Therefore there would be no jurisdiction under the FCPA to prosecute any person or entity involved after the acquisition.

The DOJ also provided this additional information, “To be sure, the Department encourages companies engaging in mergers and acquisitions to (1) conduct thorough risk-based FCPA and anti-corruption due diligence; (2) implement the acquiring company’s code of conduct and anti-corruption policies as quickly as practicable; (3) conduct FCPA and other relevant training for the acquired entity’s directors and employees, as well as third-party agents and partners; (4) conduct an FCPA-specific audit of the acquired entity as quickly as practicable; and (5) disclose to the Department any corrupt payments discovered during the due diligence process. See FCPA Guide at 29. Adherence to these elements by Requestor may, among several other factors, determine whether and how the Department would seek to impose post-acquisition successor liability in case of a putative violation.”

Discussion

Mike Volkov calls it ‘reading the tea leaves’ when it comes to what information the DOJ is communicating. However, sometimes I think it is far simpler. First, and foremost, 14-02 communicates that there is no such thing as ‘springing liability’ to an acquiring company in the FCPA context nor such a thing as simply buying a FCPA violation, simply through an acquisition only, there must be continuing conduct for FCPA liability to arise. Most clearly beginning with the FCPA Guidance, the DOJ and Securities and Exchange Commission (SEC) have communicated what companies need to do in any M&A environment. While many compliance practitioners had only focused on the post-acquisition integration and remediation; the clear import of 14-02 is to re-emphasize importance of the pre-acquisition phase.

Your due diligence must being in the pre-acquisition phase. The steps taken by the Requestor in this Opinion Release demonstrate some of the concrete steps that you can take. Some of the techniques you can use in the pre-acquisition phase include (1) having your internal or external legal, accounting, and compliance departments review a target’s sales and financial data, its customer contracts, and its third-party and distributor agreements; (2) performing a risk-based analysis of a target’s customer base; (3) performing an audit of selected transactions engaged in by the target; and (4) engaging in discussions with the target’s general counsel, vice president of sales, and head of internal audit regarding all corruption risks, compliance efforts, and any other major corruption-related issues that have surfaced at the target over the past ten years.

Whether you can make these inquiries or not, you will also need to engage in post-acquisition integration and remediation. 14-02 provides you with some of the steps you need to perform after the transaction is closed. If you cannot perform any or even an adequate pre-acquisition due diligence, the time frames you put in place after the acquisition closes may need to be compressed to make sure that you are not continuing any nefarious FCPA conduct going forward. But it all goes back to dis-linking. If a target is engaging in conduct that violates the FCPA but the target itself is not subject to the jurisdiction of the FCPA, you simply cannot afford to allow that conduct to continue. If you do allow such conduct to continue you will have bought a FCPA violation and your company will be actively engaging and participating in an ongoing FCPA violation. That is the final takeaway I derive from this Opinion Release; it is allowing corruption and bribery to continue which brings companies into FCPA grief. Opinion Release 14-02 provides you a roadmap of the steps you and your company can take to prevent such FCPA exposure.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2014

Mergers and Acquisitions Under the FCPA, Part II

Yesterday I began a three part series on mergers and acquisitions under the Foreign Corrupt Practices Act (FCPA). In Part I, I reviewed what you should accomplish in the pre-acquisition stage. Today I want to look at what you should do with the information that you obtain in your pre-acquisition compliance due diligence.

Jay Martin, Chief Compliance Officer (CCO) at BakerHughes Inc. suggests an approach that reviews key risk factors to move forward. Martin has laid out 15 key risk factors of targets under a FCPA analysis, which he believes should prompt a purchaser to conduct extra careful, heightened due diligence or even reconsider moving forward with an acquisition under extreme circumstances.

1. A presence in a BRIC (Brazil, Russia, India and China) country and other countries whose corruption risk is high, for example, a country with a Transparency International CPI rating of 5 or less;
2. Participation in an industry that has been the subject of recent anti-bribery or FCPA investigations, for example, in the oil and energy, telecommunications, or pharmaceuticals sectors;
3. Significant use of third-party agents, for example, sales representatives, consultants, distributors, subcontractors, or logistics personnel (customs, visas, freight forwarders, etc.)
4. Significant contracts with a foreign government or instrumentality, including state-owned or state-controlled entities;
5. Substantial revenue from a foreign government or instrumentality, including a state-owned or state-controlled entity;
6. Substantial projected revenue growth in the foreign country;
7. High amount or frequency of claimed discounts, rebates, or refunds in the foreign country;
8. A substantial system of regulatory approval, for example, for licenses and permits, in the country;
9. A history of prior government anti-bribery or FCPA investigations or prosecutions;
10. Poor or no anti-bribery or FCPA training;
11. A weak corporate compliance program and culture, in particular from legal, sales and finance perspectives at the parent level or in foreign country operations;
12. Significant issues in past FCPA audits, for example, excessive undocumented entertainment of government officials;
13. The degree of competition in the foreign country;
14. Weak internal controls at the parent or in foreign country operations; and
15. In-country managers who appear indifferent or uncommitted to U.S. laws, the FCPA, and/or anti-bribery laws.

In evaluating answers to the above inquiries or those you might develop on your own, you may also wish to consider some type of risk rating for the responses, to better determine is the amount of risk that your company is willing to accept to do so you will need to both assess risk and subsequently evaluate that risk. Borrowing from a matrix developed by Michele Abraham from Timken Co., I have found Timken’s matrix for risk rating and assessment useful. Risks should initially be identified and then plotted on a heat map to determine their priority. The most significant risks with the greatest likelihood of occurring are deemed the priority risks, which become the focus of the your post-acquisition remediation plan going forward. A risk-rating guide similar to the following can be used.

LIKELIHOOD

Likelihood Rating	Assessment	Evaluation Criteria
1	Almost Certain	High likely, this event is expected to occur
2	Likely	Strong possibility that an event will occur and there is sufficient historical incidence to support it
3	Possible	Event may occur at some point, typically there is a history to support it
4	Unlikely	Not expected but there’s a slight possibility that it may occur
5	Rare	Highly unlikely, but may occur in unique circumstances

 

‘Likelihood’ factors to consider: The existence of controls, written policies and procedures designed to mitigate risk capable of leadership to recognize and prevent a compliance breakdown; Compliance failures or near misses; Training and awareness programs. Product of ‘likelihood’ and significance ratings reflects the significance of particular risk universe. It is not a measure of compliance effectiveness or to compare efforts, controls or programs against peer groups.

The key to such an approach is the action steps prescribed by their analysis. This is another way of saying that the pre-acquisition risk assessment informs the post-acquisition remedial actions to the target’s compliance program. This is the method set forth in the FCPA Guidance. I believe that the DOJ wants to see a reasoned approach with regards to the actions a company takes in the mergers and acquisitions arena. The model set forth by Michele Abraham of Timken certainly is a reasoned approach and can provide the articulation needed to explain which steps were taken.

It is also important that after the due diligence is completed, and if the transaction moves forward, the acquiring company should attempt to protect itself through the most robust contract provisions that it can obtain, these would include indemnification against possible FCPA violations, including both payment of all investigative costs and any assessed penalties. An acquiring company should also include reps and warranties in the final sales agreement that the entire target company uses for participation in transactions as permitted under local law; that there is an absence of government owners in company; and that the target company has made no corrupt payments to foreign officials. Lastly, there must be a rep that all the books and records presented to the acquiring company for review were complete and accurate.

To emphasize all of the above, the DOJ stated in the Pfizer Deferred Prosecution Agreement (DPA), in the mergers and acquisition context, that a company is to ensure that, when practicable and appropriate on the basis of a FCPA risk assessment, new business entities are only acquired after thorough risk-based FCPA and anti-corruption due diligence is conducted by a suitable combination of legal, accounting, and compliance personnel. When such anti-corruption due diligence is appropriate but not practicable prior to acquisition of a new business for reasons beyond a company’s control, or due to any applicable law, rule, or regulation, an acquiring company should continue to conduct anti-corruption due diligence subsequent to the acquisition and report to the DOJ any corrupt payments or falsified books and records.

Tomorrow in Part III, I will take a look at your post-acquisition actions in the mergers and acquisition context.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2014

Mergers and Acquisitions Under the FCPA, Part I

Today, I begin a three-part series on mergers and acquisitions under the Foreign Corrupt Practices Act. Today I will review the pre-acquisition phase, focusing the information and issues you should review, tomorrow in Part II, I will look at how you should use that information in the evaluation process and in Part III, I will consider steps you should take in the post-acquisition phase.

The Foreign Corrupt Practices Act (FCPA) Guidance, issued in 2012, makes clear that one of the ten hallmarks of an effective compliance program is around mergers and acquisitions (M&A), in both the pre and post-acquisition context. A company that does not perform adequate FCPA due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps, most commonly, inadequate due diligence can allow a course of bribery to continue – with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. In contrast, companies that conduct effective FCPA due diligence on their acquisition targets are able to evaluate more accurately each target’s value and negotiate for the costs of the bribery to be borne by the target. But, equally important is that if a company engages in the suggested actions, they will go a long way towards insulating, or at least lessening, the risk of FCPA liability going forward.

Nat Edmonds, in an interview in the Wall Street Journal (WSJ) entitled, “Former Justice Official: How to Buy Corrupt Companies” said “I think most companies and their outside counsel believe any potential corruption problem should stop a deal from occurring. Companies would be surprised to learn that neither the Securities and Exchanges Commission nor the DOJ takes that position. In many ways the SEC and DOJ encourage good companies with strong compliance programs to buy the companies engaged in improper conduct in order to help implement strong compliance in companies that have engaged in wrongful conduct. What companies must do and what outside counsel should advise them to do is to have a realistic perspective of what effect that corruption or potential improper payment has on the value of the deal itself. Because of the concern that any corruption would stop the deal or implicate the buyers, many times companies don’t look as thoroughly as they should at potential corruption. There is often concern that if you start to look for something you may find a problem and it could slow down or stop the whole deal.”

The FCPA Guidance was the first time that many compliance practitioners focused on the pre-acquisition phase of a transaction as part of a compliance regime. However, the Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) made clear the importance of this step. In addition to the above language, they cited to another example in the section on Declinations where the “DOJ and SEC declined to take enforcement action against a U.S. publicly held consumer products company in connection with its acquisition of a foreign company.” The steps taken by the company led the Guidance to state the following, “The company identified the potential improper payments to local government officials as part of its pre-acquisition due diligence and the company promptly developed a comprehensive plan to investigate, correct, and remediate any FCPA issues after acquisition.”

In a hypothetical, the FCPA Guidance provided some specific steps a company had taken in the pre-acquisition phase. These steps included, “(1) having its legal, accounting, and compliance departments review Foreign Company’s sales and financial data, its customer contracts, and its third-party and distributor agreements; (2) performing a risk-based analysis of Foreign Company’s customer base; (3) performing an audit of selected transactions engaged in by Foreign Company; and (4) engaging in discussions with Foreign Company’s general counsel, vice president of sales, and head of internal audit regarding all corruption risks, compliance efforts, and any other corruption-related issues that have surfaced at Foreign Company over the past ten years.”

Pre-Acquisition Risk Assessment

It should all begin with a preliminary pre-acquisition assessment of risk. Such an early assessment will inform the transaction research and evaluation phases. This could include an objective view of the risks faced and the level of risk exposure, such as best/worst case scenarios. A pre-acquisition risk assessment could also be used as a “lens through which to view the feasibility of the business strategy” and help to value the potential target.

The next step is to develop the risk assessment as a base document. From this document, you should be able to prepare a focused series of queries and requests to be obtained from the target company. Thereafter, company management can use this pre-acquisition risk assessment to attain what might be required in the way of integration, post-acquisition. It would also help to inform how the corporate and business functions may be affected. It should also assist in planning for timing and anticipation of the overall expenses involved in post-acquisition integration. These costs are not insignificant and they should be thoroughly evaluated in the decision-making calculus.

Next is a five step process on how to plan and execute a strategy to perform pre-acquisition due diligence in the M&A context.

1. Establish a point of contact. Here you need to determine one point of contact that you can liaise with throughout the process. Typically this would be the target’s Chief Compliance Officer (CCO) if the company is large enough to have full time position.
2. Collect relevant documents. Obtain a detailed list of sales going back 3-5 years, broken out by country and, if possible, obtain a further breakdown by product and/or services; all Joint Venture (JV) contracts, due diligence on JVs and other third party business partners; the travel and entertainment records of the acquisition target company’s top sales personnel in high risk countries; internal audit reports and other relevant documents. You do not need to investigate de minimis sales amounts but focus your compliance due diligence inquiry on high sales volumes in high-risk countries. If the acquisition target company uses a sales model of third parties, obtain a complete list, including JVs. It should be broken out by country and amount of commission paid. Review all underlying due diligence on these foreign business representatives, their contracts and how they were managed after the contract was executed; your focus should be on large commissions in high risk countries.
3. Review the compliance and ethics mission and goals. Here you need to review the Code of Conduct or other foundational documents that a company might have to gain some insight into what they publicly espouse.
4. Review the seven elements of an effective compliance program as listed below:

a. Oversight and operational structure of the compliance program. Here you should assess the role of board, CCO and if there is one, the compliance committee. Regarding the CCO, you need to look at their reporting and access – is it independent within the overall structure of the company? Also, what are the resources dedicated to the compliance program including a review of personnel, the budget and overall resources? Review high-risk geographic areas where your company and the acquisition target company do business. If there is overlap, seek out your own sales and operational people and ask them what compliance issues are prevalent in those geographic areas. If there are compliance issues that your company faces, then the target probably faces them as well.

b. Policies/Procedures, Code of Conduct. In this analysis you should identify industry practices and legal standards that may exist for the target company. You need to review how the compliance policies and procedures were developed and determine the review cycles, if any. Lastly, you need to know how everything is distributed and what the enforcement mechanisms for compliance policies are. Additionally you need to validate, with Human Resources (HR), if there have been terminations or disciplines relating to compliance.cEducation, training and communication. Here you need to review the compliance training process, as it exists in the company, both the formal and the informal. You should ask questions, such as “What are the plans and schedules for compliance training?” Next determine if the training material itself is fit for its intended purpose, including both internal and external training for third parties. You should also evaluate the training delivery channels, for example is the compliance training delivered live, online, or through video? Finally, assess whether the company has updated their training based on changing of laws. You will need to interview the acquisition target company personnel responsible for its compliance program to garner a full understanding of how they view their program. Some of the discussions that you may wish to engage in include visiting with the target company’s General Counsel (GC), its Vice President (VP) of sales and head of internal audit regarding all corruption risks. You should also delve into the target’s compliance efforts, and any other corruption-related issues that may have surfaced.

c. Monitoring and auditing. Under this section you need to review both the internal audit plan and methodology used regarding any compliance audits. A couple of key points are (1) is it consistent over a period of time and (2) what is the audit frequency? You should also try and judge whether the audit is truly independent or if there was manipulation by the business unit(s). You will need to review the travel and entertainment records of the acquisition target company’s top sales personnel in high-risk countries. You should retain a forensic auditing firm to assist you with this effort. Use the resources of your own company personnel to find out what is reasonable for travel and entertainment in the same high-risk countries which your company does business.

d. Reporting. What is the company’s system for reporting violations or allegations of violations? Is the reporting system anonymous? From there you need to turn to who does the investigations to determine how are they conducted? A key here, as well as something to keep in mind throughout the process, is the adequacy of record keeping by the target.

e. Response to detected violations. This review is to determine management’s response to detected violations. What is the remediation that has occurred and what corrective action has been taken to prevent future, similar violations? Has there been any internal enforcement and discipline of compliance policies if there were violations? Lastly, what are the disclosure procedures to let the relevant regulatory or other authorities know about any violations and the responses thereto? Further, you may be required to self-disclose any FCPA violations that you discover. There may be other reporting issues in the M&A context such as any statutory obligations to disclose violations of any anti-bribery or anti-corruption laws in the jurisdiction(s) in question; what effect will disclosure have on the target’s value or the purchase price that your company is willing to offer?

f. Enforcement Practices/Disciplinary Actions. Under this analysis, you need to see if there was any discipline delivered up to and including termination. If remedial measures were put in place, how were they distributed throughout the company and were they understood by employees?

5. Periodically evaluate the M&A review procedures’ effectiveness benchmarked against any legal proceedings, FCPA enforcement actions, Opinion Releases or other relevant information.

Tomorrow, I will review how you use the information that you are able to obtain in the pre-acquisition process.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2014

Getting Your Company Ready for M&A Compliance Due Diligence

Who was the absolute worst general during the Civil War? While there are many worthy candidates for this dubious honor, on the Southern side my vote goes to General John Bell Hood. One of the prime proponents of the Southern attack and die strategy, Hood’s leadership led to the destruction of 90% of his Texas Brigade at Antietam. But Hood is most famous for his utter destruction of the Army of Tennessee. In five months, from July to November of 1864 Hood unsuccessfully attacked Union General William T. Sherman’s army three times near Atlanta, relinquished the city after a month-long siege, then took his army back to Tennessee in the fall to draw Sherman away from the Deep South. Sherman dispatched part of his army to Tennessee, and Hood lost two battles at Franklin and Nashville in November and December 1864. There were about 65,000 soldiers in the Army of Tennessee when Hood assumed command in July. By January 1, there were only 18,000 men in the army. To top it off, it was not Sherman who burned Atlanta but Hood.

My thoughts turned to General Hood when I listened to a very interesting panel on Day 2 of the ACI FCPA Boot Camp about getting your target company ready to be scrutinized from the compliance context in mergers and acquisition (M&A) due diligence. On the panel were Alberto Orozco from PricewaterhouseCoopers (PwC), Joseph Burke, from Dell Inc., and Christina Lunders from the law firm of Norton Rose Fulbright.

Building on a fundamental theme from day one of the conference, Burke said that relationship building is also important in the M&A context, from the perspective as a buyer. Representing an acquirer, the key questions from his perspective were two-fold: whether or not we trust the company we are looking at and how will they integrate into our company? He believed that trust is what gets the deal done or does not. He begins by sitting down with his counter-part, senior management and key legal department personnel in the target company and talking to them. If they can talk with authority about their compliance function he can determine how much he will dig into the documents and records.

Orozco agreed with this perception but came at it from his accounting angle. He said that if your books and records are in order, you really do not need to do anything more. The next step he looks at is if you have a compliance program and do the targets employees know about it. This is critical so that the buyer will have an understanding of what is needed from the compliance perspective from day one of the acquisition closing.

They then turned to the perspective of a target and what you should have in place for such an analysis. It all begins with a compliance focused risk assessment and this should be done first as this is a key starting point to determine not only if the target has an effective compliance program but also if the target is actually ‘doing compliance’. Of course it is important for a target to know about its relationships with foreign governments, whether as customers or representatives on the sales side or in the supply chain.

They posited that a target should make sure that it has a compliance program, which is consistent with an international standard for an anti-bribery or anti-corruption program, whether it is the Foreign Corrupt Practices Act (FCPA), UK Bribery Act or some other recognized international standard. The target should gather and verify the completeness of the following anti-corruption policies and procedures:

• Anti-corruption/anti-bribery;
• Petty cash;
• Travel, meals, and entertainment;
• Gifts, donations, sponsorships, political contributions, lobbying;
• Retention, use and compensation of intermediaries/third parties;
• Disbursements;
• Recording of intercompany transactions; and
• Authorization for expenditure/levels of authority.

They believe that it is important for a target to gather and verify the completeness of relevant books and records. They specifically listed the following:

• Monthly trial balances;
• Customer lists;
• Vendor lists;
• General ledger accounts for the following:
• Gifts, entertainment and hospitality;
• Travel;
• Donations, sponsorships, and political contributions;
• Marketing and commissions expenses;
• Consulting fees;
• Petty cash; and
• Miscellaneous expenses.

They next suggested the documents and records be readied for review from the compliance perspective, on the following topics:

• Facilitation payments;
• Advertising and marketing;
• Government tenders and bidding packages;
• Employee expense reports;
• Procurement;
• Licenses and permits;
• Records management;
• Transfer pricing; and
• Information on how policies/procedures are distributed and compliance acknowledged within the target organization.

Lastly, they provided a list of topics for which documents should be gathered and the target should be prepared to discuss early on with the compliance representative of the acquirer on the subject of any past corruption issues which may have arisen or been identified, together with their resolution. The target should be prepared to deliver factual details, relevant documents, and information on findings and how the matters were resolved. This group of documents should include internal or external reviews, audits or investigations over the past ten years, including any outstanding compliance issues, such as whistleblower and hotline complaints.

In the area of corporate governance they suggested that the target gather Board of Directors and any management meeting minutes from the past five years and have them available for review. A target should also be prepared to make available for interview key personnel including the General Counsel (GC), Chief Financial Officer (CFO), Chief Executive Officer (CEO) and the heads of Internal Audit, International Sales and Compliance.

From the perspective of the acquiring entity, they suggested that you take a close look at the files of as many of the target’s third parties as is reasonable for the size of the acquisition and the time frame you have. These include gathering and verifying the completeness of the following third party files: due diligence; contracts/agreements; records of compensation payment for past 5 years to determine whether compensation is reasonable, especially if in a high-risk area or for business involving foreign officials and, finally, make a determination of how to address any potential red flags.

They also discussed some of the potential red flags, which might be present in these documents. Some of these red flags could include a history of corruption in country where business occurs; numerous or frequent interactions with foreign officials; unusual payment patterns or arrangements with third parties or third parties which refuse to certify compliance, demand payment in cash, provide incomplete or inaccurate information, request payment made to someone else; a bank outside of country of domicile or is close with foreign government officials.

I thought Burke’s perspective was akin to trust but verify. He reiterated several times that it is reasonably straightforward to determine if a target company takes ‘doing compliance’ seriously. From there, you can use analytics to review the numbers and try and make a determination about obvious red flags and high-risk areas. This allows him to help to make a more accurate remediation plan to begin at closing. It also allows him to advise the business unit involved on what the cost for such integration would be, how long the business would be disrupted by such integration and the complexities of acquiring company’s compliance program implementation.

As to the cost for failing to do so, just think of the loss of the Army of Tennessee from the leadership of John Bell Hood.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2014

How Odysseus Can Inform Compliance Enhancement

What are your thoughts on Odysseus? Is he a villain or a hero? The ancient philosophers had many differing views on him. One view that struck me was held by Antisthenes, a disciple of Socrates. Antisthenes used the actions of Odysseus as a defense against those who attacked the discipline of philosophy as mere sophistry; that is focusing on words not deeds. Antisthenes presented Odysseus as someone whose words themselves were good deeds. Further, the actions of Odysseus showed his abilities as a team player, a cooperative hero. Recently, I thought about the concept of Odysseus and words as good deeds in the context of the post-acquisition requirements of the Foreign Corrupt Practices Act (FCPA).

Although not specifically stated in the recently released Department of Justice (DOJ)/Securities and Exchange Commission (SEC) FCPA Guidance, enforcement actions from 2011 and 2012 would seem to indicate that a company should have an integration completed in 12-18 months after the underlying transaction is concluded. I considered the post-acquisition integration issue when reading an article in the MIT Sloan Management Review Winter 2013 issue, entitled “Building Your Company’s Capabilities Through Global Expansion”, by authors Donald Lessard, Rafael Lucea and Luis Vives. The thesis of the article was that for companies to create and sustain global competitive advantages, they need to adopt a systematic approach to exploiting, renewing and enhancing their core capabilities.

While the focus of the article was on marketing and sales, as I read the article I came to believe that it has implications beyond marketing into the post-acquisition integration required by the DOJ under the FCPA. I believe that the framework which the authors have developed can be a way for companies to think through both FCPA post-acquisition integration but also which compliance enhancements need to be introduced in foreign operations. This second point is significant because one issue that seems to bedevil compliance practitioners is how to integrate and enhance your compliance program across the globe. There are both language and cultural differences which make a ‘one-size-fits-all’ approach sometimes problematic. The article also provides some valuable insight into how a company might make its US centric FCPA compliance program a value add for its foreign operations.

The authors provide a framework under which they believe a company can evaluate the potential for enhancing its current sources into capabilities for development in foreign markets and work for post-acquisition integration. So using the authors’ framework, I will adapt it into the compliance space.

1. Are the compliance capabilities developed relevant to the users in the foreign jurisdiction or in the acquired entity? Do the compliance enhancements or post-acquisition integration bring value to these diverse entities?
2. Are the compliance capabilities you are using as the basis for the enhancements or post-acquisition integration appropriate for these internal markets? Do they help or hinder the capture of value in the company?
3. Are the compliance capabilities that you have develop in the US transferrable to the foreign operations or acquired entities? Can you deploy these compliance enhancements to foreign operations or post-acquisition integration without sacrificing too much value creation?
4. Are the new enhancements that the company will develop through acquisition or foreign operation expansion of its compliance program complementary to existing capabilities within the company?
5. Are any of the compliance capabilities, that will be used in the enhancements or post-acquisition integration, complementary to existing compliance capabilities that currently exist in either of those two groups?
6. Are any of the compliance capabilities that currently exist in the foreign operations or acquired entities, transferable back to the US?

The initial goal should be that any compliance program augmentation, whether for an acquired company or a foreign operation, should result in “an overall enhancement of the company’s capabilities” and global position. This means that while it may initially appear that the compliance group of a company is the Land of No; such should not the case for the compliance enhancement or integration to succeed. The authors believe that a company should build on its existing capabilities to show that the new processes or policies will create greater value. The example I give in training is expense reports. I ask whether anyone does not have to fill out an expense report to be reimbursed. The answer is always the same; everyone has to fill out an expense report. I then go on to explain that the FCPA will require you to list who you took to dinner or provided a gift to, what their title is and how much you spent. In other words, the obligation of an individual employee to provide the basic information to be used by others is not much in addition to the information they are currently providing.

My colleague Jay Rosen of Merrill Brink often says that translation services are only part of the equation when his company translates a compliance program or policy. It is important to understand not only the cultural context but have cultural sensitivity to issues. The classic examples are mooncakes or the tradition of giving small gifts when meeting a person for the first time in the Far East. It is viewed as a ritual which has deeper and and greater meaning more than simply a handshake. While many companies worried about this issue or even prohibited the giving of such small gifts, the FCPA Guidance has made clear that the DOJ/SEC are not looking for violations relating to such small gifts unless they are a part of an overall systemic failure of your compliance program.

In the business world it is not always words v. deeds. Another way to look at it might be consider entrepreneurial people v. process people. Entrepreneurial people tend to make things happen in an organization. They can wear many hats at once. Process people tend to have a deeper focus in a particular area. You need a balance of both in an organization.

The authors have provided a framework for you to consider in your post-acquisition compliance program integration. Further, it provides a context for you to enhance your compliance program in foreign operations. Much like Antisthenes views on Odysseus, you can translate the words of compliance into the doing of compliance.

============================================================================================

Compliance Week needs your help! Compliance Week and Kroll Advisory have teamed up to undertake a major survey on corporate anti-corruption programs, and are asking compliance executives to participate. The survey itself—the 2013 ‘Global Anti-Bribery Benchmarking Report’—can be found here:

http://surveys.harveyresearch.com/se.ashx?s=0D146E2D11F8D225

The survey should take no more than 20 minutes to complete. It asks about the bribery risks you have, procedures you use to train employees and vet third parties, the size of  your compliance team, and more. Rest assured, all submissions will be secure and anonymous. The deadline to submit information is end of business on Friday, March 15.

Results of the survey will first be presented at the Compliance Week 2013 annual conference in Washington, May 20-22 (www.ComplianceWeek.com/conference), and later published in a special supplement of the Compliance Week magazine.

Anyone with questions can contact Compliance Week editor Matt Kelly at mkelly@complianceweek.com.

============================================================================================

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2013

Chadbourne’s Quarterly FCPA Report – The importance of pre-acquisition due diligence

There are several law firms which put out annual, semi-annual and quarterly reports on the Foreign Corrupt Practices Act (FCPA). One recent report is the Compliance Quarterly, Spring 2012 Report by Chadbourne & Parke LLP. Rather than compiling a list of cases with highlights and lessons learned for the compliance practitioner, Chadbourne focuses on one, or a few issues, with some depth. The spring report continues this trend with an article entitled “Are You Paying Too Much? How Smart Companies Use FCPA and UK Bribery Act Due Diligence to Ensure their Deals are Valued Correctly” by Scott Peeler.

The article begins with a review of the FCPA and Bribery Act and then moves into some of the costs for a FCPA investigation. The costs can include a drop in stock value after the announcement of an ongoing investigation; the cost of the internal investigation, including both legal and forensic accounting costs, and the tremendous amounts which companies have been fined. Further, if a company bases its deal value on sales which have been obtained through bribery and corruption the actual value of the company may be far less than paid for by an acquirer.

The report suggests that to avoid a loss in an acquisition’s value, an acquiring company must conduct careful anti-corruption due diligence that is specifically tailored to the company being acquired. Peeler urges that the level of risk should be assessed through a series of key questions, which he sets forth.

1. Are any employees, owners, or principals current or former government employees or closely affiliated with one?
2. What practices and safeguards are there regarding gifts, entertainment, hospitalities, charitable contributions, sponsorships, donations and other benefits?
3. What is the target’s relationship with intermediaries (distributors, agents, consultants, etc.)?
4. Have there been any past investigations/violations?
5. Does the target operate in a high-risk industry/high-risk country?
6. What is the target’s association with foreign governments? Does it provide them with goods and services? Is it government owned or controlled? Does it rely on government-issued licenses or permits?
7. Does the target have clear policies and procedures in place to detect; report and manage FCPA and UK Bribery Act violations?
8. Is there any suspicion of FCPA or UK Bribery Act violations in the target?
9. What does the Transparency International Corruption Perception Index reveal about the target?

Peeler also suggests that a target company’s internal controls and books and records should be evaluated in the following areas:

1. Use of agents and outside consultants;
2. Expense claims, payments and petty cash disbursements;
3. Contracting/contact points with government bodies;
4. Fraud response procedures/mechanisms;
5. Entertainment and gift practices;
6. Record-keeping practices and accuracy of books and records; and
7. Relationships with state-owned enterprises.

In a suggestion that is clear cutting edge best practices, Peeler recommends that in order to reduce the risk of potential FCPA and UK Bribery Act liability, an acquiring entity should consider (1) encouraging the target to undertake an internal compliance investigation prior to any potential investment; (2) insisting on the right to audit the books and records of the target; (3) insisting on anticorruption and compliance representations and warranties; and (4) requiring execution of FCPA and UK Bribery Act compliance certifications. Further, if the due diligence reveals FCPA or UK Bribery Act issues Peeler notes that a buyer has several options available, including (a) negotiating specific indemnification provisions; (b) self-reporting to the Department of Justice (DOJ) or Securities and Exchange Commission (SEC); (c) adjusting the deal price or walking away from the transaction; and (d) allocating potential fees and fines in the merger agreement.

The one thought that Peeler concluded the Report with struck me the most. It was that while corruption is expensive and it can certainly kill a deal, “Smart companies, however, turn those negatives to their advantage.” By engaging in an appropriate level of pre-acquisition due diligence a company can not only protect themselves from potential legal exposure but also get the closest and most accurate value for an acquisition. But most importantly, from my perspective, is that you know who and what you are acquiring. If an acquired company had a propensity for bribery and corruption, simply because you acquired them is probably not going to change that culture. That is the most important piece of intelligence that you can obtain from pre-acquisition due diligence.

———————————————————————————————————————————————————————-

The FCPA Blog and ethiXbase are offering a cool deal to help dispell that summer heat wave by offering readers of the FCPA Blog a free download of the Anti-Corruption Compliance Benchmarking Survey. Normally valued at $295, the survey can be downloaded at no cost for a limited time with email registration here.

———————————————————————————————————————————————————————

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2012

2012 First Half FCPA Enforcement Round-Up: Part II

In yesterday’s post we reviewed three of the most significant enforcement actions so far for 2012. In today’s post we conclude with the final three enforcement actions that I believe provide the best or most recent insights for the compliance practitioner.

IV.       Biomet

On March 26, 2012, both the Securities and Exchange Commission (SEC) and the Department of Justice (DOJ) announced the resolution of enforcement actions against Biomet Inc. a US entity which manufactures and sells global medical devices around the world. It is headquartered in Fort Wayne, Indiana. The Company admitted to a lengthy run of bribery and corruption of doctors to purchase its products and paid a criminal fine of $17.3MM to resolve charges brought by the DOJ. It also agreed with the SEC to settle civil charges by paying $5.5MM in disgorgement of profits and pre-judgment interest.

A.     Bribery and Corruption Facts

The Company engaged in an eight (8) year scheme to bribe and corrupt doctors in the countries of Argentina, Brazil and China to induce the physicians to purchase Biomet products. The SEC Complaint reported that “2000 to August 2008, Biomet Argentina employees paid bribes to doctors employed by publicly owned and operated hospitals in Argentina in exchange for sales of  Biomet’s medical device products. The doctors were paid approximately 15-20 percent of each sale.” In Brazil, the SEC Compliant reported that from 2001 until 2008, Biomet’s “Brazilian Distributor, paid bribes to doctors employed by publicly owned and operated hospitals to purchase Biomet’s implants. Brazilian Distributor paid the doctors bribes in the form of “commissions” of 10-20 percent of the value of the medical devices purchased.” In China, Biomet subsidiaries and its Chinese distributor paid from 5% up to 25% commissions to doctors for the sale of its products which were used during surgeries and also paid for Chinese surgeons to travel for training “including a substantial portion of the trip being devoted to sightseeing and other entertainment at Biomet’s expense.”

B.     Internal Audit Failures

The SEC Compliant reported that the Company’s Internal Audit was not only aware of the bribery program but discussed it in Memorandum to the Company’s home office, including the head of the Company’s Internal Audit Department. For instance in Argentina, the Company’s head of Internal Audit noted, as early as 2003, they “circulated an internal audit report on Argentina to Senior Vice President and others in Biomet in Indiana in which he stated, “[R]oyalties are paid to surgeons if requested. These are disclosed in the accounting records as commissions.” The Internal Audit report described the payments to surgeons, but only in the context of confirming that the amount paid to the surgeon was the amount recorded on the books.” However, the Company’s Internal Audit Department, took no steps to determine why royalties were paid to doctors or why the payments to the doctors were 15-20% of sales. Internal Audit did not obtain any evidence of services which the doctors might have performed entitling them to the payments. The SEC Complaint noted that Internal Audit “concluded that there were adequate controls in place to properly account for royalties paid to surgeons without any supporting documentation” and Internal Audit’s only recommendation was to change the journal entry from “commission expenses” to “royalties.”

The SEC Complaint also noted that “Biomet’s books and records did not reflect the true nature of those payments. The Company’s payments were improperly recorded as “commissions,” “royalties”, “consulting fees”, “other sales and marketing”, “scientific incentives”, “travel” and “entertainment.” The SEC Compliant concluded with the following “False documents were routinely created or accepted that concealed the improper payments.”

C.     Lessons Learned for Internal Audit

The SEC Complaint had some very clear guidance for the role of Internal Audit in detecting bribery and corruption in a best practices Foreign Corrupt Practices Act (FCPA) compliance program. First, if there are any types of commission payments being made, Internal Audit needs to review the documentation supporting why such payments are being made. A review of contracts or other legal requirements which may obligate a company to make such payments should be a basic undertaking in any internal audit. After an internal auditor has determined if commission payments are legally authorized, the internal auditor should review the evidence that such commission payments have been earned. Another role delineated in the SEC Complaint for Internal Audit is to correctly classify payments so that the books and records of the company accurately reflect them as expenses. As noted, the Director of Internal Audit instructed that bribes paid during clinical trials of the Company’s products should be reclassified as ‘expenses’.

Key Takeaway: This enforcement action lists the specific role of Internal Audit in a FCPA compliance program.

V. Morgan Stanley and Garth Peterson

This is the first instance of the public release of a Declination to Prosecute a company under the FCPA, where an employee agreed to an underlying FCPA violation. Morgan Stanley Managing Director Garth Peterson conspired with others to circumvent Morgan Stanley’s internal controls in order to transfer a multi-million dollar ownership interest in a Shanghai building to himself and a Chinese public official. Peterson encouraged Morgan Stanley to sell an interest in a Chinese real-estate deal to Shanghai Yongye Enterprise (Yongye) a state-owned and state-controlled entity through which Shanghai’s Luwan District managed its own property and facilitated outside investment. However, the DOJ declined to prosecute Morgan Stanley and noted in its Press Release, “After considering all the available facts and circumstances, including that Morgan Stanley constructed and maintained a system of internal controls, which provided reasonable assurances that its employees were not bribing government officials, the Department of Justice declined to bring any enforcement action against Morgan Stanley related to Peterson’s conduct. The company voluntarily disclosed this matter and has cooperated throughout the department’s investigation.”

A.     Declination to Prosecute

Both the DOJ and SEC went out of their way to praise the Morgan Stanley compliance program. This written praise demonstrated that not only do company’s receive credit from the DOJ for having a compliance program in place but also gave solid information as to why the DOJ declined to prosecute Morgan Stanley. In other words, it was a very public pronouncement of a declination to prosecute.

The SEC Complaint detailed the compliance program it had in place and how it directly related to Peterson.

(1) Morgan Stanley trained Peterson on anti-corruption policies and the FCPA at least seven times between 2002 and 2008.

(2) Morgan Stanley distributed to Peterson written training materials specifically addressing the FCPA.

(3) A Morgan Stanley compliance officer specifically informed Peterson in 2004 that employees of Yongye, a Chinese state-owned entity, were government officials for purposes of the FCPA.

(4) Peterson received from Morgan Stanley at least thirty five FCPA-compliance reminders.

(5) Morgan Stanley required Peterson on multiple occasions to certify his compliance with the FCPA.

(6) Morgan Stanley required each of its employees, including Peterson, annually to certify adherence to Morgan Stanley’s Code of Conduct.

(7) Morgan Stanley required its employees, including Peterson, annually to disclose their outside business interests.

(8) Morgan Stanley had policies to conduct due diligence on its foreign business partners, conducted due diligence on the Chinese Official and Yongye before initially conducting business with them, and generally imposed an approval process for payments made in the course of its real estate investments.

B.        Compliance Program as Compliance Defense

If it was not clear that a company receives credit for having a best practices compliance program it is now. Recognizing that a compliance program is not available as a formal affirmative defense, it is clear that Morgan Stanley was able to use not only their written compliance program, but its ongoing maintenance, communication and due diligence aspects to shield the employer from liability. The bottom line is what the DOJ and SEC representatives have been saying all along and that is that companies with best practices compliance programs receive credit in negotiating with the government.

Key Takeaway: The compliance defense is alive and well.

Key Takeaway II (for the DOJ): Publicize Declinations to Prosecute. It is solid information for the compliance practitioner to use and it will help companies do business in compliance with the FCPA.

VI. DS&S

Last, but certainly not least, we end our Top 6 of 2012, to date, with the Data Systems & Solutions LLC (DS&S) case.

A.     The Bribery Scheme

The bribery scheme involved payments made to officials at a state-owned nuclear power facility in Lithuania, named Ignalina Nuclear Power Plant (INPP). The payments were made to allow DS&S to obtain and retain business with INPP. The Information listed contracts awarded to DS&S in the amount of over $30MM from 1999 to 2004. Significantly, DS&S did not self-disclose this matter to the DOJ but only began an investigation after receiving a DOJ Subpoena for records.

The bribery scheme used by DS&S recycled about every known technique there is to pay bribes. The Information listed 51 instances of bribes paid or communications via email about the need to continue to pay bribes. The bribery scheme laid out in the Information reflected the following techniques used:

• Payment of bribes by Subcontractors to Officials on behalf of DS&S;
• Direct payment of bribes by DS&S into US bank accounts controlled by INPP Officials;
• Creation of fictional invoices from the Subcontractors to fund the bribes;
• Payment of above-market rates for services allegedly delivered by the Subcontractors so the excess monies could be used to fund bribes;
• Payment of salaries to INPP Officials while they were ‘employed’ by Subcontractor B;
• Providing travel and entertainment to Officials to Florida, where DS&S has no facilities and which travel and entertainment had no reasonable business purpose;

and last but not least…

• Purchase of a Cartier watch as a gift.

B.     The Discounted Fine

DS&S received a discount of 30% off the low end of the penalty range as calculated under the US Sentencing Guidelines, which specified a fine between $25MM down to $12.6MM. The ultimate fine paid by DS&S was only $8.82MM, which the Deferred Prosecution Agreement (DPA) states is “an approximately thirty-percent reduction off the bottom of the fine range…” In addition to its real-time internal investigation and extraordinary cooperation, the DPA reports that DS&S took the following extensive remediation steps:

• Termination of company officials and employees who were engaged in the bribery scheme;
• Dissolving the joint venture and then reorganizing and integrating the dissolved entity as a subsidiary of DS&S;
• Instituting a rigorous compliance program in this newly constituted subsidiary;
• Enhancing the company’s due diligence protocols for third-party agents and subcontractors;
• Chief Executive Officer (CEO) review and approval of the selection and retention of any third-party agent or subcontractor;
• Strengthening of company ethics and compliance policies;
• Appointment of a company Ethics Representative who reports directly to the CEO;
• The Ethics Representative provides regular reports to the Members Committee (the equivalent of a Board of Directors in a LLC); and
• A heightened review of most foreign transactions.

1. C.     Mergers & Acquisitions

There were two new additions are found on items 13 & 14 on Schedule C of the DPA that dealt with mergers and acquisitions (M&A). They draw from and build upon the prior Opinion Release 08-02 regarding Halliburton’s request for guidance during an attempted acquisition and the Johnson and Johnson (J&J) Enhanced Compliance Obligations which were incorporated into its DPA. The five keys under these new items are: (1) develop policies and procedures for M&A work prior to engaging in such transactions; (2) full FCPA audit of any acquired entities “as quickly as practicable”; (3) report any corrupt payments or inadequate internal controls it discovers in this process to the DOJ; (4) apply DS&S anti-corruption policies and procedures to the newly acquired entities; and (5) train any persons who might “present a corruption risk to DS&S” on the company’s policies and procedures and the law.

Key Takeaway: Minimum best practices evolve so you should stay abreast of them. IN the M&A arena, the DOJ continues to listen to comments on ‘buying a FCPA violation’ and provide guidance to manage the risk.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2012

The DOJ Listens: the Evolution of FCPA Compliance in M&A

Earlier this week the US Department of Justice (DOJ) released a Deferred Prosecution Agreement (DPA) with the company Data Systems & Solutions (DS&S). I explored the factual allegations against DS&S and the highlights of the DPA in yesterday’s post. Today I want to discuss the DS&S DPA in the context of the DOJ’s evolution in thinking regarding what a company can do to protect itself under the Foreign Corrupt Practices Act (FCPA) when it purchases another entity or otherwise engages in mergers and acquisitions (M&A) work. In other words, forces the evolution of best practices.

Previously many compliance practitioners had based decisions in the M&A context on DOJ Opinion Release 08-02 (08-02), which related to Halliburton’s proposed acquisition of the UK entity, Expro. In the spring of 2011, the Johnson & Johnson (J&J) DPA changed the perception of compliance practitioners regarding what is required of a company in the M&A setting related to FCPA due diligence, both pre and post-acquisition. On June 18, the DOJ released the DS&S DPA which brought additional information to the compliance practitioner on what a company can do to protect itself in the context of M&A activity.

Opinion Release 08-02 began as a request from Halliburton to the DOJ from issues that arose in the pre-acquisition due diligence of the target company Expro. Halliburton had submitted a request to the DOJ specifically posing these three questions: (1) whether the proposed acquisition transaction itself would violate the FCPA; (2) whether, through the proposed acquisition of Target, Halliburton would “inherit” any FCPA liabilities of Target for pre-acquisition unlawful conduct; and (3) whether Halliburton would be held criminally liable for any post-acquisition unlawful conduct by Target prior to Halliburton’s completion of its FCPA and anti-corruption due diligence, where such conduct is identified and disclosed to the Department within 180 days of closing.

I.                   08-02 Conditions

 

Halliburton committed to the following conditions, if it was the successful bidder in the acquisition:

Within ten business days of the closing, Halliburton would present to the DOJ a comprehensive, risk-based FCPA and anti-corruption due diligence work plan which would address, among other things, the use of agents and other third parties; commercial dealings with state-owned customers; any joint venture, teaming or consortium arrangements; customs and immigration matters; tax matters; and any government licenses and permits. The Halliburton work plan committed to organizing the due diligence effort into high risk, medium risk, and lowest risk elements.

a)      Within 90 days of Closing. Halliburton would report to the DOJ the results of its high risk due diligence.

b)      Within 120 days of Closing. Halliburton would report to the DOJ the results to date of its medium risk due diligence.

c)      Within 180 days of Closing. Halliburton would report to the DOJ the results to date of its lowest risk due diligence.

d)     Within One Year of Closing. Halliburton committed full remediation of any issues which it discovered within one year of the closing of the transaction.

Many lawyers were heard to exclaim, “What an order, we cannot go through with it.” However,  we advised our clients not to be discouraged because 08-02 laid out a clear road map for dealing with some of the difficulties inherent in conducting sufficient pre-acquisition due diligence in the FCPA context. Indeed the DOJ concluded 08-02 by noting, “Assuming that Halliburton, in the judgment of the Department, satisfactorily implements the post-closing plan and remediation detailed above… the Department does not presently intend to take any enforcement action against Halliburton.”

II.                Johnson & Johnson “Enhanced Compliance Obligations”

Attachment D of the J&J DPA, entitled “Enhanced Compliance Obligations”, is a list of compliance obligations in which J&J agreed to undertake certain enhanced compliance obligations for at least the duration of its DPA beyond the minimum best practices also set out in the J&J DPA. With regard to the M&A context, J&J agreed to the following:

 

7. J&J will ensure that new business entities are only acquired after thorough FCPA and anti-corruption due diligence by legal, accounting, and compliance personnel. Where such anti-corruption due diligence is not practicable prior to acquisition of a new business for reasons beyond J&J’s control, or due to any applicable law, rule, or regulation, J&J will conduct FCPA and anti-corruption due diligence subsequent to the acquisition and report to the Department any corrupt payments, falsified books and records, or inadequate internal controls as required by … the Deferred Prosecution Agreement.

8. J&J will ensure that J&J’s policies and procedures regarding the anti-corruption laws and regulations apply as quickly as is practicable, but in any event no less than one year post-closing, to newly-acquired businesses, and will promptly, for those operating companies that are determined not to pose corruption risk, J&J will conduct periodic FCPA Audits, or will incorporate FCPA components into financial audits.

a. Train directors, officers, employees, agents, consultants, representatives, distributors, joint venture partners, and relevant employees thereof, who present corruption risk to J&J, on the anticorruption laws and regulations and J&J’s related policies and procedures; and

b. Conduct an FCPA-specific audit of all newly-acquired businesses within 18 months of acquisition.

These enhanced obligations agreed to by J&J in the M&A context were less time sensitive than those agreed to by Halliburton in 08-02. In the J&J DPA, the company agreed to following time frames:

A.     18 Month – conduct a full FCPA audit of the acquired company.

B.     12 Month – introduce full anti-corruption compliance policies and procedures into the acquired company and train those persons and business representatives which “present corruption risk to J&J.”

So there is no longer a risk based approach as set out in 08-02 and the tight time frames are also relaxed. Once again we applaud the DOJ for setting out specific information for the compliance practitioner through the release of the J&J DPA. As many have decried 08-02 is a standard too difficult to satisfy in the real world of time constraints and budget cuts, the “Acquisition” component of the J&J DPA should provide those who have made this claim with some relief.

III.             DS&S

In the DS&S DPA there are two new items listed in the Corporate Compliance Program, attached as Schedule C to the DPA, rather than the standard 13 items we have seen in every DPA since at least November 2010. The new additions are found on items 13 & 14 on page C-6 of Schedule C and deal with mergers and acquisitions. They read in full:

13. DS&S will develop and implement policies and procedures for mergers and acquisitions requiring that DS&S conduct appropriate risk-based due diligence on potential new business entities, including appropriate FCPA and anti-corruption due diligence by legal, accounting, and compliance personnel. If DS&S discovers any corrupt payments or inadequate internal controls as part of its due diligence of newly acquired entities or entities merged with DS&S, it shall report such conduct to the Department as required in Appendix B of this Agreement.

 14. DS&S will ensure that DS&S’s policies and procedures regarding the anticorruption laws apply as quickly as is practicable to newly acquired businesses or entities merged with DS&S and will promptly:

a. Train directors, officers, employees, agents, consultants, representatives, distributors, joint venture partners, and relevant employees thereof, who present corruption risk to DS&S, on the anti-corruption laws and DS&S’s policies and procedures regarding anticorruption laws.

b. Conduct an FCPA-specific audit of all newly acquired or merged businesses as quickly as practicable.

 This language draws from and builds upon the prior Opinion Release 08-02 regarding Halliburton’s request for guidance and the J&J Enhanced Compliance Obligations incorporated into its DPA. While the DS&S DPA does note that it is specifically tailored as a solution to DS&S’s FCPA compliance issues, I believe that this is the type of guidance that a compliance practitioner can rely upon when advising his or her clients on what the DOJ expects during M&A activities.

FCPA M&A Box Score Summary

Time Frames	Halliburton 08-02	J&J	DS&S
FCPA Audit	High Risk Agents – 90 days Medium Risk Agents – 120 Days Low Risk Agents – 180 days	18 months to conduct full FCPA audit	As soon “as practicable”
Implement FCPA Compliance Program	Immediately upon closing	12 months	As soon “as practicable”
Training on FCPA Compliance Program	60 days to complete training for high risk employees, 90 days for all others	12 months to complete training	As soon “as practicable”

I believe that the DOJ does listen to the concerns of US companies about issues relating to FCPA enforcement, which is consistent with its duty to uphold that law. Last month we saw the issue of the Morgan Stanley declination in the context of the Garth Peterson FCPA prosecution. With the DS&S DPA, there is clearly more flexible language presented in the context of M&A work and potential liability for ‘buying a FCPA claim.’

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2012

Achieving Compliance in the Post Acquisition Context – The Key to Which is Building Trust

In a recent article in the Houston Business Journal (HBJ), entitled “Building strong relationships critical to building strong companies”, HBJ Mergers and Acquisitions Columnist Connie Barnaba focused on the nature of trust within a company to posit that “strong businesses are built on strong relationships between the business, its leaders, employees, customers, suppliers, lenders and advisors.” Trust cascades down each level of a company; beginning from the Board of Directors down to employees and then out the door to customers. She believes that this issue of trust is equally important in the Mergers and Acquisition (M&A) context. I believe her ideas are very useful for the compliance practitioner, when integrating a new acquisition into an existing compliance culture.

Barnaba writes that “trusting relationships are developed person to person as individuals in a company gradually develop a network of contacts, associates and advisors inside and outside the company.” But more than this it is “the by-product of responsiveness, reliability and candor or those we reach out to.” Successful companies work to focus on “sustaining and developing new relationships” as a key to the continued growth and successful performance of a business.

I.                   Trust in the M&A Context

In the M&A context, this trust relationship begins with the Letter of Intent (LOI), which should include warranties, representations, covenants and any penalties which might occur if one side pulls out of the transaction. The pre-acquisition due diligence process is designed to “confirm the accuracy of the representations and viability of commitments.” This should lead to a successful merger agreement between the parties and now the work to continue to build trust really begins.

Barnaba notes that the biggest roadblock initially is the element of surprise. Most merger deals are done with some amount of confidentiality. However, one of the hardest issues to manage is the lack of time. There is never enough time to perform all the due diligence that you desire. This is always true in the compliance arena as well. Further Securities and Exchange Commission (SEC) regulations prohibit certain unauthorized disclosures about such transactions and there is usually great sensitivity to timing around any public disclosure regarding the transaction.

This not only impedes the ability to fully vet during the due diligence process but it may impeded company leaders from announcing to their own stakeholders that the company is in such negotiations. This can certainly negatively affect an employee base as top leaders may be confronted with “managing the impact of the (M&A) surprise on stakeholders.” This can also damage the efforts going forward as it can appear as a “top-down imposition of change.”

II.                Compliance in the Post-Acquisition Context

Given the two Department of Justice (DOJ) pronouncements on Foreign Corrupt Practices Act (FCPA) compliance in the M&A context, Opinion 08-02 (the Halliburton Opinion Release) and the Johnson and Johnson (J&J) Deferred Prosecution Agreement (DPA), all of the factors that Barnaba listed may be significantly acerbated and accelerated.

A.     The Halliburton Opinion Release

In this Opinion Release, the DOJ approved Halliburton’s commitment to the following post acquisition conditions to a proposed transaction:

1)      Within ten business days of the closing. Halliburton would present to the DOJ a comprehensive, risk-based FCPA and anti-corruption due diligence work plan which would address, among other things, the use of agents and other third parties; commercial dealings with state-owned customers; any joint venture, teaming or consortium arrangements; customs and immigration matters; tax matters; and any government licenses and permits. The Halliburton work plan committed to organizing the due diligence effort into high risk, medium risk, and lowest risk elements.

a)      Within 90 days of Closing. Halliburton would report to the DOJ the results of its high risk due diligence.

b)      Within 120 days of Closing. Halliburton would report to the DOJ the results to date of its medium risk due diligence.

c)      Within 180 days of Closing. Halliburton would report to the DOJ the results to date of its lowest risk due diligence.

d)     Within One Year of Closing. Halliburton committed to full remediation of any issues which it discovered within one year of the closing of the transaction.

B.    Johnson & Johnson Deferred Prosecution Agreement and Enhanced Compliance Obligations

In the April 2011 released J&J DPA there is a list of compliance obligations J&J agreed to take on in the acquisition context:

7.        J&J will ensure that new business entities are only acquired after thorough FCPA and anti-corruption due diligence by legal, accounting, and compliance personnel. Where such anti-corruption due diligence is not practicable prior to acquisition of a new business for reasons beyond J&J’s control, or due to any applicable law, rule, or regulation, J&J will conduct FCPA and anti-corruption due diligence subsequent to the acquisition and report to the Department any corrupt payments, falsified books and records, or inadequate internal controls as required by … the Deferred Prosecution Agreement.

8.        J&J will ensure that J&J’s policies and procedures regarding the anti-corruption laws and regulations apply as quickly as is practicable, but in any event no less than one year post-closing, to newly-acquired businesses, and will promptly: For those operating companies that are determined not to pose corruption risk, J&J will conduct periodic FCPA Audits, or will incorporate FCPA components into financial audits.

1. Train directors, officers, employees, agents, consultants, representatives, distributors, joint venture partners, and relevant employees thereof, who present corruption risk to J&J, on the anti-corruption laws and regulations and J&J’s related policies and procedures; and
2. Conduct an FCPA-specific audit of all newly-acquired businesses within 18 months of acquisition.

In the J&J DPA, the company agreed to following time frames:

1. 18 Month – conduct a full FCPA audit of the acquired company.
2. 12 Month – introduce full anti-corruption compliance policies and procedures into the acquired company and train those persons and business representatives which “present corruption risk to J&J.”

These very tight time frames, even with the expanded one in the J&J DPA, may well test trust issues in any newly acquired organization. Similarly, the acquiring organization may be under great pressure to uncover and report anything which may even whiff of a FCPA violation. Barnaba concludes her article by warning that if the short term disruption in trust will undermine the long-term changes to the organization; it may not be in either party’s interest to go forward with the merger. Business mergers require linkages at all levels within an organization and this is particularly true with compliance.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2012