Interview with Scott Moritz

Ed. Note-today we continue with our series on thought leaders and practitioners in the compliance arena. Today, we have an interview with Scott Moritz, who is a Managing Director, Protiviti (www.protiviti.com)

============================================================================================

1. Where did you grow up and what were your interests as a youngster? 

I grew up on the North Shore of Long Island, the youngest of six kids. Our father owned a swimming pool construction company whose workforce at various times consisted of my legendary grandfather, brothers, many cousins, a wide variety of parolees and, for a few summers during high school, me. Since I can remember, I was always fascinated with police work and detective stories and grew up watching TV shows like Baretta, The Rockford Files and Police Story. From an early age, people thought I looked like a cop. When I was 16, some of my knuckleheaded friends brought me along to New York City as “security,” because they wanted to buy fireworks, which were illegal at the time. In fact, I played the security role a lot with my friends, because they always seemed to attract the kind of attention that necessitated someone securing their safety. Our misadventure in the city was my first exposure to a recurring theme in my law enforcement experience: even if something is illegal to make, sell or possess, it is still readily available. In no time, one of my friends was in negotiation with a gang member who took one look at me and said “He’s a cop, get lost.” My undercover career was over before it started.

2. Where did you go to college and what experiences there led to your current profession?

I graduated from Jacksonville University in Jacksonville, Florida with a double major in marketing and management and a minor in psychology. Throughout college, I worked as a bouncer, bartender, DJ and eventually manager at a rock nightclub. As a 5’8” bouncer in Jacksonville, where the average male is 6’3,” I quickly developed negotiation, persuasion, de-escalation and other crisis-related skills. I also had to be able to read body language and know when a  negotiation had broken down, and it was time to take action. I prided myself on how frequently I was able to get people out of the club peacefully. I witnessed more violent crimes, including shooting incidents, in my four years as a nightclub employee than I did in nearly 10 years as an FBI agent.

3. How did you come to join the FBI? What were your duties as an agent?

After college, I applied to take the NYPD entrance exam. At the time, my sister Stacey was an Assistant U.S. Attorney in the Southern District of New York. When I mentioned to her that I had applied to take the police exam, she asked “What about the FBI?” She put me in touch with her friend, who was a Special Agent in the New York Field Office. This was in 1985. I called the number she gave me and a deep, booming voice answered, “TERRORISM!” I was so startled, I nearly fell off my chair! Whatever preconceptions I had in terms of how the FBI might answer the phone, that one didn’t make the mental checklist. I collected myself and had a great conversation with the agent, who encouraged me to apply to the FBI.

The FBI recruitment process is very involved, with many aspects to it, and candidates fall by the wayside at every stage. Back then, there was an initial application, a written exam, the completion of a very detailed application, a panel interview with three FBI Special Agents and finally a background check investigation, and as far as I know, that’s still the case today. Completing the application was quite an undertaking because you had to provide very detailed information about you, your siblings, their spouses, your parents and every roommate you’ve ever had. The application was used as the roadmap for the intensive background investigation that follows.

I entered on duty as an FBI Special Agent in October, 1986. Special Agent trainees lived at the FBI Academy for four months, and academy training was divided equally between academics (minimum passing grade is 85%), physical training/defensive tactics and firearms training.

FBI Special Agents investigate and enforce an incredibly wide variety of criminal violations, counter-intelligence and counter-terrorism. My first assignment was the Memphis, Tennessee field office. At the time, Memphis was a relatively small FBI office, so agents had much broader responsibilities than in the larger field offices where agents tend to be more specialized. For most of my time in Memphis, I was assigned to a White Collar Crime squad, which also had responsibility for the Civil Rights and Fugitive programs. I worked on a wide array of primarily financial crime investigations, including on the bank robbery response team and worked with the narcotics task force. While white collar crime was my primary focus, each agent on the squad carried multiple fugitive cases. The FBI has primary jurisdiction to enforce Unlawful Flight to Avoid Prosecution (UFAP) in support of state and local law enforcement when there is evidence that violent offenders have fled their jurisdictions.

In 1991, I was transferred to NYC and assigned to the money-laundering and asset forfeiture squad.  There, the entire mission was to conduct parallel financial investigations alongside the largest, most complex criminal cases being investigated by the New York FBI. I worked on many organized crime, narco-laundering, and trafficking and white collar crime cases, and our squad seized and forfeited nearly $1 billion during my five years there.

4. How have you utilized the skills you learned in law enforcement in your current profession?

I use the skills I learned as an FBI Special Agent every day in my current profession and have since the day I left the Bureau nearly 17 years ago. Many crimes are revenue-generating crimes; making cases against criminal defendants and their criminally-derived assets means painstaking financial analysis. Tracing criminal proceeds back to their source provides evidence of the crime, quantifies it and enables the government to dismantle criminal organizations by seizing assets obtained by the specified unlawful activity or used to facilitate the laundering of criminal proceeds. I am usually surrounded by mountains of banking records and financial records. However, reviewing banking and financial records alone often doesn’t reveal the full picture. While at the FBI, I developed the ability to use publicly available information to identify the financial holdings and business interests of criminal subjects and their associates, as well as any prior illegal conduct or civil disputes that could help build the case against them. These same background investigation techniques can be used in a commercial context both after the fact as part of the ensuing financial crime investigation and also to vet prospective relationships in an effort to determine whether a company would make a suitable business partner. Likewise, interviewing and interrogation skills are something you use in a variety of settings. Unlike interviews depicted on many TV crime dramas, interviewing is often all about building a rapport and establishing some common ground, no matter how despicable the subject of the interview may be. People also give off hidden cues that signal when they are uncomfortable with your questions and when they are outright lying. These same skills are very helpful when conducting interviews of executives and employees, whether in the course of evaluating a corporate compliance program, conducting anti-corruption due diligence or interviewing a suspect.

5. You recently changed companies, moving from Navigant to Protiviti. What can you tell us about your new position and some of the things that you would like to achieve?

I’m incredibly excited about my new role at Protiviti. I’ve joined an established and very experienced firm whose professional staff includes investigators, forensic accountants, anti-corruption practitioners and technologists in over 70 offices in 23 countries. Protiviti also has a very powerful technology platform in its Governance Portal. The Portal manages data intake, risk scoring, work-flow management, case management and decision-making ‑ so that all the aspects of an overall ethics and compliance program, or a single aspect of it, such as managing third-party anti-corruption programs, can be brought together on a single platform. (The Portal has received industry recognition: Protiviti has been positioned as a “Challenger” by Gartner in the October 2012 Magic Quadrant for Enterprise Governance, Risk and Compliance Platforms.)

I really look forward to continuing to help clients apply their limited resources strategically on a risk basis and also to better position them so that they can manage their regulatory risk proactively and deploy investigative and forensic resources rapidly when issues emerge.

============================================================================================

Scott Mortiz can be reached at scott.moritz@protiviti.com.

============================================================================================

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. 

NYPD Community Policing as Model for Your FCPA Compliance Program

For those of you who do not know Scott Moritz, you should take an opportunity to do so. I first met Moritz (virtually) through his article in the FCPA Blog, entitled “Risk-Based Compliance”. In this post, Moritz looked at the language of Opinion Release 08-02 (the “Halliburton Opinion Release”) in the context of the risk based approach of which the Department of Justice (DOJ) approved Halliburton’s proposed acquisition of Expro. These risk based concepts were used by the UK Financial Services Authority (FSA) in its January, 2009, settlement with Aon. Moritz is a retired FBI special agent, with over 25 years of complex investigative, forensic accounting, regulatory compliance and law enforcement experience. He is now a Managing Director for Global Investigations & Compliance at Navigant Consulting.

I have had the opportunity to speak with Moritz on a couple of webinars, jointly author papers with him and hear him speak at leading Foreign Corrupt Practices Act (FCPA) conferences. I can assure you that he knows his stuff. Recently Moritz published yet another piece in his continuing education for the rest of us compliance practitioners in the area of risk based assessments. In an article entitled “Walking a Beat to Reduce Corruption”, Moritz analogized  “the concept of community policing that has been used to reduce crime in many major cities across the world” in his innovative approach of “a growing corporate culture of mutual transparency that is having a very positive effect on overall awareness regarding anti-corruption” for third party due diligence under both the FCPA and UK Bribery Act.

Moritz talked about community policing in the context of new thinking which holds that more “successful third-party anti-corruption programs depend upon effective two-way communication between the company and its third parties.” He advocates that companies “engage directly with third parties to build trust” and to communicate a company’s ethical values to both those third parties in its Sale and Supply Chains. The starting point for any trust is communications. He believes that for a compliance program to be truly effective, “it must create communication channels between compliance, its internal clients within the organization and the third parties whose actions could lead to corruption liability.” This communication should begin by making a company’s key employees, whose responsibilities include engagement with third parties i.e. business sponsors, “to the potential risks of these commercial relationships, how to recognize them, what they may mean in terms of their continuing compliance obligations and how to convey this information to the third parties in a way that is not construed to be offensive in any way.”

One of the most important roles of these business sponsors is to take the message of compliance to the company’s third party representatives. Many companies will have this first message be the company’s FCPA compliance questionnaire but Moritz advocates it is “the business sponsor’s responsibility to explain the company’s third-party anti-corruption program, the rationale behind it, to emphasize the mutual benefits of the relationship and to serve as the company liaison going forward. That initial conversation should also highlight the fact that the vast majority of such steps result in a strengthening of the relationship between the company and its third parties.”

This business sponsor should stress at least three key factors. The first is that the company lives by its anti-corruption values and those are embedded in its anti-corruption, FCPA Compliance Program and the questionnaire is a necessary part of that Compliance Program. Second, that your company’s Compliance Program is similar “to those in place at an increased number of organizations and it would be reasonable to expect it to be part of the process whenever their company engages with a global company.” Third, that by asking for what may seem as unusually sensitive information, it is not a lack of trust but that the request “actually signals the importance of the relationship and the company’s willingness to make a substantial investment in it to ensure that any issues that may be out there are put to rest at the outset thereby eliminating any future barriers to the relationship between the parties.” Concluding this section Moritz opines that by “Spending a fair amount of time setting the tone will provide a solid foundation for the relationship going forward.”

So how does this relate to a community policing program? At least as the theory is practiced by the New York Police Department (NYPD) it is based upon the precept of the “broken window theory” whereby if a window is allowed to be broken and stay broken it sends a signal that no one in the neighborhood cares about crime and this in turn leads to more crime. The NYPD took to having more foot patrols so that the officers could build trust in the neighborhoods which they were assigned, rather than driving around in squad cars. This signaled to the community that the police cared and many neighborhoods responded with actions, such as fixing broken windows, which showed they cared as well.

Moritz concludes his article by noting that “business sponsors act as the cops on your beat”. Just as community policing fosters two-way communication between the NYPD and the community; the business sponsor can effectively take the place of these police officers who are walking a beat in a community. The “business sponsors are on the front lines of your anti-corruption program building long-term relationships that are critically important components of your anti-corruption program and your commercial success as a whole.”

I found the Moritz piece quite interesting and continued his long line of thoughtful, best practices and leading edge commentary. I would add that a key is the business sponsor, your selection and training of this employee is a critical element. I commend the full Moritz piece to you.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2012

How To Risk-Base Supply Chain Vendors Under The FCPA

What are the methods to assess the risks of your Supply Chain vendors? Other than perhaps financial due diligence, such as through Dun & Bradstreet or quality control through your QHSE group, the Supply Chain probably does not command your Compliance Department attention as do other types of third party business partners such as agents, distributors and joint venture partners. This may be coming to an end as most Compliance Professionals recognize that third parties which supply goods or services to a company should be scrutinized similarly to other third party business partners. In the recently released Deferred Prosecution Agreement with Panalpina and six other oil-field service companies, the Department of Justice specifically noted that regarding business partners, such as Supply Chain vendors, a company should, ”it should institute appropriate due diligence” so as to help ensure compliance with the FCPA.

However to initiate “appropriate due diligence” a company must first rate the compliance risk of any third party, such as a Supply Chain vendor. The risk rating will inform the level of due diligence required. There are several methods that could be used to assess risk in the area of supply chain and vendors. The approach suggested by the UK’s Financial Services Authority (FSA) in its settlement of the enforcement action against the insurance giant AON would refer “to an internationally accepted corruption perceptions index” such as is available through Transparency International or other recognized authority. The approach suggested by the Department of Justice, in Release Opinion 08-02 would provide categories of “High Risk, Medium Risk and Low Risk”. Finally, writing in the FCPA Blog, Scott Moritz of Daylight Forensic & Advisory LLC has suggested an approach that incorporates a variety of risk-assessment tools, including, “the strategic use of information technology, tracking and sorting the critical elements”.

This commentary proposes an approach which would incorporate all three of the above cited analogous compliance areas into one risk-based assessment program for supply chain vendors. Based upon the assessed risk, an appropriate level of due diligence would then be required. The categories suggested are as follows:

1. High Risk Suppliers;
2. Low Risk Suppliers;
3. Nominal Risk Suppliers; and
4. Suppliers of General Goods and Products.

A.        High-Risk Suppliers

A High-Risk Supplier is defined as a supplier which presents a higher level of compliance risk because of the presence of one or more of the following factors:

1. It is based in or supplies goods/services from a high risk country;
2. It has a reputation in the business community for questionable business practices or ethics; or
3. It has been convicted of, or is alleged to have been involved in, illegal conduct and has failed to undertake effective remedial actions.

B.        Low-Risk Suppliers

A Low-Risk Supplier is defined as an individual or private entity located in a Low-Risk Country which:

1. Supplies goods or services in a Low-Risk Country;
2. Is based in a low risk country where the goods or services are delivered, it has no involvement with any foreign government, government entity, or Government Official; or
3. Is subject to the US FCPA and/or Sarbanes-Oxley compliance.

C.        Minimum Risk Suppliers

A Minimum Risk Supplier is an individual or entity which provides goods or services that are non-specific to a particular job or assigment and the value of each transaction is USD $10,000 or less. These types of vendors include office and industrial suppliers, equipment leasing companies and such entities which may supply routinely used services.

D.      Suppliers of General Goods and Products

A Supplier of General Goods and Products is an individual or entity which provides goods or services that are widely available to the general public and do not fall under the definition of Minimal-Risk Supplier. These types of vendors include transportation, food services and educational services providers.

This proposed rating is but one method to allow a company to assess its risks involving its Supply Chain vendors. As has been noted in both the Consultative Guidance to the United Kingdom Bribery Act and in the Panalpina settlements, both documents list the risk rating as a key component of a best practices anti-corruption and anti-bribery compliance program. A company need not engage in full due diligence for all Supply Chain vendors. However it must implement and follow a system to rate each vendor for that vendor’s FCPA compliance risk and evaluate and manage that relationship accordingly.

This publication contains general information only and is based on the experiences and research of the author. The author is not, by means of this publication, rendering business, legal advice, or other professional advice or services. This publication is not a substitute for such legal advice or services, nor should it be used as a basis for any decision or action that may affect your business. Before making any decision or taking any action that may affect your business, you should consult a qualified legal advisor. The author, his affiliates, and related entities shall not be responsible for any loss sustained by any person or entity that relies on this publication. The Author gives his permission to link, post, distribute, or reference this article for any lawful purpose, provided attribution is made to the author. The author can be reached at tfox@tfoxlaw.com.

© Thomas R. Fox, 2010

RISK-BASED DUE DILIGENCE FOR SUPPLY CHAIN VENDORS UNDER THE FCPA

Quick, as the Compliance Professional within your organization, which department or group of your company spends the most money annually? Did Supply Chain immediately come to mind? Probably not. Now just as quickly, how much of your compliance efforts are focused on the Supply Chain within your organization? Other than perhaps financial due diligence, such as through Dun & Bradstreet or quality control through your QHSE group, the Supply Chain probably does not command your Compliance Department attention as do other types of third party business partners such as agents, distributors and joint venture partners. This may be coming to an end as most Compliance Professionals recognize that third parties which supply goods or services to a company should be scrutinized similarly to other third party business partners.
There are several methods that could be used to assess risk in the area of supply chain and vendors. The approach suggested by the UK’s Financial Services Authority (FSA) in its settlement of the enforcement action against the insurance giant AON would refer “to an internationally accepted corruption perceptions index” such as is available through Transparency International or other recognized authority. The approach suggested by the Department of Justice, in Release Opinion 08-02 would provide categories of “High Risk, Medium Risk and Low Risk”. Finally, writing in the FCPABlog, Scott Moritz of Daylight Forensic & Advisory LLC has suggested an approach that incorporates a variety of risk-assessment tools, including, “the strategic use of information technology, tracking and sorting the critical elements”.
This commentary proposes an approach which would incorporate all three of the above cited analogous compliance areas into one risk-based assessment program for supply chain vendors. Based upon the assessed risk, an appropriate level of due diligence would then be required. The categories suggested are as follows:
1. High Risk Suppliers;
2. Low Risk Suppliers;
3. Nominal Risk Suppliers; and
4. Suppliers of General Goods and Products.
A. High-Risk Suppliers
A High-Risk Supplier is defined as a supplier which presents a higher level of compliance risk because of the presence of one or more of the following factors:
1. It is based in or supplies goods/services from a high risk country;
2. It has a reputation in the business community for questionable business practices or ethics; or
3. It has been convicted of, or is alleged to have been involved in, illegal conduct and has failed to undertake effective remedial actions.
B. Low-Risk Suppliers
A Low-Risk Supplier is defined as an individual or private entity located in a Low-Risk Country which:
1. Supplies goods or services in a Low-Risk Country;
2. Is based in a low risk country where the goods or services are delivered, it has no involvement with any foreign government, government entity, or Government Official; or
3. Is subject to the US FCPA and/or Sarbanes-Oxley compliance.
C. Minimal-Risk Suppliers
A Minimal-Risk Supplier is an individual or entity which provides goods or services that are non-specific to a particular job or assignment and the value of each transaction is USD $10,000 or less. These types of vendors include office and industrial suppliers, equipment leasing companies and such entities which supply such routinely used services.
D. Suppliers of General Goods and Products
A Supplier of General Goods and Products is an individual or entity which provides goods or services that are widely available to the general public and do not fall under the definition of Minimal-Risk Supplier. These types of vendors include transportation, food services and educational services providers.