Tag: Anti-Bribery & Corruption

The past few months have seen some interesting developments in context of the U.S. Foreign Corrupt Practices Act (FCPA). I get more questions on anti-bribery and corruption than any other compliance topic in my GRC research, these developments particularly should interest compliance professionals.

The change is not a brand new direction, but a continual evolution of focus on FCPA enforcement. In a nutshell, the US Department of Justice (DoJ) in the recent Yates Memorandum stated a renewed focus on prosecuting individuals over corporations in context of bribery and corruption. If organizations self-report wrong-doing, cooperate with investigators, and can demonstrate that they have an effective compliance the focus shifts to prosecuting the individuals and not the corporation (though in cases in which corruption is pervasive and executive management is involved this may not be the case).

The element of an organization having an effective compliance program actually comes from the DoJ recently hiring a compliance counsel to facilitate the evaluation of compliance programs to support the shift in focus.

These changes have a significant impact on legal risk and corporate liability for organizations governed by FCPA. While self-reporting and cooperation are somewhat easily understood, the grey area that many are asking about is what constitutes an effective compliance program?

The standard answer is to point to the seven elements of an effective compliance program as established in the U.S. Sentencing Commission Organizational Sentencing Guidelines. This is good and something organizations should be familiar with. At a more practical level, I would encourage organizations to look at the details of the one company that the DoJ did not prosecute and went after the individual, Mr. Peterson. This is the Morgan Stanley case in 2012.

Consider this excerpt from the press release on the DoJ website:

Morgan Stanley maintained a system of internal controls meant to ensure accountability for its assets and to prevent employees from offering, promising or paying anything of value to foreign government officials.  Morgan Stanley’s internal policies, which were updated regularly to reflect regulatory developments and specific risks, prohibited bribery and addressed corruption risks associated with the giving of gifts, business entertainment, travel, lodging, meals, charitable contributions and employment.  Morgan Stanley frequently trained its employees on its internal policies, the FCPA and other anti-corruption laws.  Between 2002 and 2008, Morgan Stanley trained various groups of Asia-based personnel on anti-corruption policies 54 times.  During the same period, Morgan Stanley trained Peterson on the FCPA seven times and reminded him to comply with the FCPA at least 35 times.  Morgan Stanley’s compliance personnel regularly monitored transactions, randomly audited particular employees, transactions and business units, and tested to identify illicit payments.  Moreover, Morgan Stanley conducted extensive due diligence on all new business partners and imposed stringent controls on payments made to business partners.

Using this real-world example of a company that was not prosecuted and was praised for having an effective compliance program, we learn that an effective compliance program has the following elements:

• Internal controls. The organization has to have a system of internal controls to address compliance and that is maintained.
• Policies. The organization has to have established written policies that are kept current as regulations and risk change.
• Training. The organization has to train relevant employees on policies and how to comply.
• Reminders/awareness. Beyond training, the organization should show that it regularly reminds individuals of their responsibilities to follow policies and comply.
• Compliance evidence/audit trail. The organization should be ready to demonstrate how often policies are communicated, training completed, and reminders sent.
• Compliance monitoring. The organization needs to monitor transactions and activities for improper behavior.
• Compliance audits. The organization should provide audits of compliance.
• 3^rd party due diligence. The organization should conduct due diligence on business partner relationships.
• 3^rd party controls. The organization should impose controls on transactions and activities in context of 3^rd party relationships.

These changes should have organizations evaluating their compliance programs and determining how their compliance program maps to what is understood as effective in both the USSC Organizational Sentencing Guidelines and the Morgan Stanley detail from the DoJ.

In the next few weeks, GRC 20/20 is teaching in several activities that reinforce these concepts, these include:

• Webinars
  • Critical Capabilities to Address Bribery & Corruption, December 3^rd, 10:00a to 11:00a CST
  • To Buy or Not to Buy? How to Make Your Case for Compliance Software, December 3^rd, 12:00p to 1:00p CST
  • How to Manage the Growing Array of Audits, December 15^th, 8:00a to 9:00a CST
• Workshop
  • Policy Management by Design: Blueprint for an Effective, Efficient & Agile Policy Management Program, December 4^th, New York, NY USA
• Research Briefings
  • How to Purchase 3^rd Party Management Solutions, December 7^th, 11:00a to 12:00p CST
  • How to Purchase Compliance Management Solutions & Platforms, December 21^st, 11:00a to 12:00p CST

Compliance must be an active part of the organization and culture to prevent and detect corruption, bribery and fraud. This continuous and ongoing process must be monitored, maintained and nurtured. The challenge is establishing corruption prevention and detection activities that move the organization from a reactive fire-fighting mode to one that actively manages, monitors, prevents and detects risk.

The distributed and dynamic nature of business makes anti-bribery, corruption, and fraud compliance a challenge. Compliance in the context of a complex and dynamic business environment is particularly challenging as organizations face broadening anti-bribery and corruption laws and regulations. Ultimately, the best offense is a good defense. Regardless of the models, technologies and strategies enabled to help, organizations must be prepared to show they have a strong compliance program in place to mitigate or risk exposure to investigations, penalties and possible prosecution. This is the example that the DoJ and SEC put forward when they praised Morgan’s Stanley’s compliance program in result of their FCPA investigation.

This requires technology to manage anticorruption compliance. Technology can help organizations manage and monitor anti-bribery, corruption, and fraud compliance by enabling and automating:

• Compliance program management: The organization needs a 360-degree view of compliance activities and reporting. This requires a system for managing compliance activities, metrics and reports. From this system the organization should be able to produce reports and metrics relevant to the board of directors and executives, to assure them they are meeting fiduciary obligations to have a compliance program for anticorruption in place. All compliance management personnel and employees should be able to access the system and see contextually relevant tasks and items.
• Regulatory intelligence and change management: The integration of regulatory content feeds and technology enables the compliance program to determine how new developments — such as new anti-bribery and corruption laws, requirements, enforcement actions, and other matters and decisions — impact business. Organizations should leverage technology to integrate legal and regulatory feeds and route them to the correct subject matter expert for review and business impact analysis.
• Compliance risk assessment: Risk assessments are mandatory for compliance initiatives. The organization needs technology to manage risk surveys, assessments, and related risk information to report, analyze, model, and treat anti-bribery and corruption risk.
• Policy management: A core component of a compliance program is the ability to document policies and procedures to maintain a state of compliance. All policies for anti-bribery, corruption and fraud should be documented, maintained, communicated and attested to, with a robust audit trail and content management. This includes code of conduct, anticorruption and other related policies.
• Training and communication: It is not enough to make written policies available — the organization also needs to train individuals on policies. Organizations increasingly use online training to deliver courses on anticorruption and to test employee understanding of policies and requirements. Some organizations are building portals of anti-bribery and corruption information that integrate policies, training, games, scenarios, and more in an intuitive interface to educate employees.
• Third-party management and due diligence: Central to an anti-bribery and corruption compliance program is the ability to manage risk presented by third-parties such as agents. Due diligence processes are built upon review of third-parties and checking against databases of known politically exposed persons. Technology and integration of content feeds enables ongoing due diligence to monitor and score vendor and third-party risk, communicate policies, deliver training, track attestations and deliver surveys and assessments.
• Internal Control Monitoring: Anti-bribery and corruption also requires (e.g., FCPA enforcement has a books and records and internal control provisions) that the organization have defined and operating controls over financial reporting. This includes a control environment that covers approvals, authorizations, reconciliations, transactions, master data, and segregation of duties.
• Forms processing and automation: A critical component of an anti-bribery and corruption program is the ability to process and automate forms related to policies and procedures. Transactions and requests for gifts, entertainment, travel, customs and cross-border shipping, charitable giving, political contributions, conflicts of interest, and facilitated payments should be managed through online forms and workflow for approvals with integration into the transaction environment to review history in the course of approval.
• Issue reporting & investigations management: Technology enables the organization to manage and monitor issues and incidents and collaborate and document investigations. This includes the ability to record issues reported from hotlines and other mechanisms, what actions were taken and the results of the investigation.

Some related GRC 20/20 events happening in October are:

• New York: Addressing Anti-Bribery and Corruption Workshop, October 07, 2014 7:00 am to October 07, 2014 11:00 amAt New York, NY, USA Categories: Workshops
• New York: Effective 3rd Party Management Workshop, October 07, 2014 12:00 pm to October 07, 2014 4:00 pmAt New York, NY, USA Categories: Workshops
• The Intersection of Legal and Compliance, October 15, 2014 12:00 pm to October 15, 2014 1:00 pmAt Online Webinar Categories: Webinars

To effectively prevent and detect issues of corruption, bribery and fraud in business, compliance has to be an active part of the organization and culture. It is a continuous and ongoing process that must be monitored, maintained and nurtured. This requires a new paradigm that moves away from reactive fire-fighting to managing, monitoring for, preventing and detecting corruption and compliance risks: a paradigm to effectively manage anti-bribery and corruption (ABC) across global or domestic business.

There are two primary models to manage compliance to anticorruption obligations:

1. One approach is build-your-own, ad hoc and ultimately labor-intensive, and produces significant manual processes and documents. Siloed ABC initiatives never see the big picture. An ad hoc approach to ABC results in poor visibility across the organization and its control environment, because there is no framework or architecture for managing bribery and corruption risk and compliance. When the organization uses scattered documents and processes that do not collaborate, there is no way to be intelligent about risk and understand its impact.
2. A more strategic approach focuses on technology designed to manage the complex and diverse needs of anticorruption compliance. In a mature ABC program, the organization has an integrated process in an information and technology architecture that provides visibility across compliance tasks and interactions.

The best offense in anticorruption is a good defense. In today’s complex business environment, incidents do happen. The organization defends itself by demonstrating it uses appropriate compliance measures to prevent and detect corruption and noncompliance. The goal is to have preventive measures in place to avoid corruption issues, while at the same time having detective measures to monitor for instances of corruption and respond quickly and efficiently. This includes reporting and cooperating with authorities in investigations.

An integrated view of the U.S., U.K. and OECD guidance requires that the following compliance elements be in place:

• Understand your risk: An organization must have a risk-based approach to managing anticorruption. This includes periodic assessment (e.g., annual) of corruption and unethical conduct. However, the risk-assessment process should also be dynamic — completed each time there is a significant business change that could lead to exposure (e.g., mergers and acquisitions, new strategies and new markets). Risk assessments should cover exposure to corruption in specific markets, business partners and geographies.
• Approach compliance in proportion to risk: How an organization implements compliance procedures and controls is based on the proportion of risk it faces. If a certain area of the world or a business partner carries a higher risk for corruption, the organization must respond with stronger procedures and controls. Proportionality of risk also applies to the size of the business — smaller organizations are not expected to have the same measures as large enterprises.
• Tone at the top: The compliance program must be fully supported by the board of directors and executives. Communication with top-level management must be bidirectional. Management must communicate that they support the anticorruption compliance program and will not tolerate corruption in any form. At the same time, they must be well-informed about the effectiveness and strategies for compliance and anticorruption initiatives.
• Know who you do business with: It is critical to establish a risk-monitoring framework that catalogs third-party relationships, markets and geographies. Due diligence efforts must be in place to make sure the organization is contracting with ethical entities. If there is a high degree of corruption risk in a relationship, additional preventive and detective controls must be established in response. This includes knowing your employees and conducting background checks to understand if they are susceptible to corruption and unethical conduct.
• Keep information current: Due diligence and risk assessment efforts must be kept current. These are not point-in-time efforts; they need to be done on a regular basis or when the business becomes aware of conditions that point to increased risk.
• Compliance oversight: The organization needs someone who is responsible for the oversight of anticorruption compliance processes and activities. This person should have the authority to report to independent monitoring bodies, such as the audit committees of the board, to report issues of corruption.
• Established policies and procedures: Organizations need documented and up-to-date policies and procedures. The code of conduct filters down to other policies that address anticorruption, gifts, hospitality, entertainment and expenses, customer travel, political contributions, charitable donations and sponsorships, facilitation payments and solicitation and extortion. These requirements and processes must be clearly documented and adhered to.
• Effective training and communication: Written policies are not enough — individuals need to know what is expected of them. Organizations must implement anticorruption training to educate employees and business partners at risk of exposure to bribery, corruption and fraud. This includes getting acknowledgements from employees and business partners to affirm their understanding, and attestation of their commitment to behave according to established policies and procedures.
• Implement communication and reporting processes: The organization must have channels of communication where employees can get answers on policies and procedures. This could take the form of a help line that allows an individual to ask questions, or a FAQ database, or via form processing for approval on activities and requests. The organization must also have a hotline reporting system for individuals to report misconduct — in the U.S. this is called a whistleblower system, and in the U.K. it is referred to as a speak-up line.
• Assessment and monitoring: In addition to periodic risk assessment, the organization must also have regular compliance assessment and monitoring activities to ensure that policies, procedures and controls to prevent corruption and bribery are in place and working.
• Investigations: Even in the best organization, things go wrong. Investigation processes (hotlines, surveys, management reports and exit interviews) must be in place to quickly identify potential incidents of corruption, and quickly and effectively investigate and resolve issues. This includes reporting and working with outside law enforcement and authorities.
• Internal accounting controls: Organizations must keep detailed records that fairly and accurately reflect transactions and disposition of assets. This includes contract-pricing review, due diligence and verification of foreign business representatives, accounts payable, financial account reconciliation and commission payments.
• Manage business change: The organization must monitor for changes that introduce greater risk of corruption. The organization must document changes that result from observations and investigations and address deficiencies through a careful program of change management. This requires that business change be monitored by compliance personnel to prevent corruption.

With increased exposure to anti-corruption laws and investigations, and defined anti-corruption practices, how does an organization go about using technology to manage anti-corruption compliance?

Compliance needs to be an active part of the organization and culture to prevent and detect corruption, bribery, and fraud. This continuous and ongoing process must be monitored, maintained, and nurtured. The challenge is establishing corruption prevention and detection activities that move the organization from a reactive fire-fighting mode to one that actively manages, monitors, prevents, and detects risk. This requires the organization to implement technology to manage anti-corruption compliance.

• Compliance program management: The organization needs a 360-degree view of compliance activities and reporting. This requires an end-to-end system for managing compliance activities, metrics, and reports. From this system the organization should be able to produce reports and metrics relevant to the board of directors and executives, to assure them they are meeting fiduciary obligations to have a compliance program for anti- corruption in place. All compliance management personnel and employees should be able to access the system and see contextually relevant tasks and items.

• Regulatory intelligence and change management: The integration of regulatory content feeds and technology enables the compliance program to monitor changes in anti-corruption laws, requirements, and cases to determine how new developments impact the business. The organizations must use technology to take in legal and regulatory feeds and route them to the correct subject matter expert for review and business impact analysis.

• Compliance risk assessment: Risk assessments are mandatory for compliance initiatives. The organization needs a technology platform to manage risk surveys, assessments, and related risk information and report, analyze and model risk.

• Policy and procedure management: A core process of a compliance program is the ability to document policies and procedures to maintain a state of compliance. All relevant policies related to anti-corruption should be documented, maintained, communicated, and attested to within a technology platform with a robust audit trail and content management capability. This includes code of conduct, anti-corruption, and other related policies.

• Training and communication: It is not enough to make written policies available — the organization also needs to train individuals on policies. Organizations are increasingly using the economies of online training to deliver courses on anti-corruption, and to test employee understanding of policies and requirements.

• Third-party management: Central to an anti-corruption compliance program is the ability to manage the risk of third-party entities you interact and do business with. Technology, and the integration of content feeds, enables the ongoing due diligence effort to monitor and score vendor/third-party risk, communicate policies to vendors, track attestations, and deliver surveys and assessments.

• Forms processing and automation: A critical component of an anti-corruption program is the ability to process and automate forms related to compliance policies and procedures. Interactions for contributions, gift, entertainment, and facilitated payments should be managed through online forms and workflow for approval or disapproval.

• Investigations management: Technology enables the organization to manage and monitor issues and incidents, and collaborate and document investigations. This includes the ability to record the range of issues reported from hotlines and other mechanisms, what actions were taken, and the results of the investigation.

With increased exposure to anti-corruption laws and investigations, how does an organization respond to anti-corruption compliance obligations?

The best offense in anti-corruption is a good defense. Organizations must be prepared to show that they have a strong compliance program in place to mitigate or avoid exposure to penalties. In today’s complex business environment, incidents do happen — the organization defends itself by demonstrating it has implemented appropriate compliance measures to prevent and detect issues of corruption and noncompliance. The goal is to have preventive measures in place to avoid corruption issues, while at the same time having detective measures to monitor for instances of corruption and respond quickly and efficiently. This includes reporting and cooperating with authorities in investigations.

While there are different laws around the world aimed at anti-corruption, the compliance aspects to these laws are based on common requirements that are the backbone of any good compliance program. From a U.S. perspective, the best defense is to show that the organization has met the elements of an effective compliance program as established by the United States Sentencing Commission Organizational Guidelines.[2] The U.S. guidelines compliment and coordinate well with the U.K.’s guidance requiring a company to demonstrate adequate procedures to prevent bribery. It is a full defense in the U.K. Bribery Act when an organization proves that despite a particular incident of bribery it nevertheless has proper compliance practices in place to prevent corruption and bribery. Both the U.S. and U.K. guidance aligns with and supports OECD Good Practice on Internal Controls, Ethics, and Compliance.

An integrated view of the U.S., U.K., and OECD guidance requires that an organization have the following compliance elements in place:

• Understand your risk: An organization must have a risk-based approach to managing anti-corruption. This includes periodic assessment (e.g., annual) of the exposure to the organization for corruption and unethical conduct. However, the risk-assessment process should also be dynamic — completed each time there is a significant business change that could lead to exposure (e.g., mergers and acquisitions, new strategies, and new markets). Risk assessments should cover exposure to corruption in specific markets, business partners, and geographies.
• Approach compliance in proportion to risk: How an organization implements compliance procedures and controls is based on the proportion of risk it faces. If a certain area of the world or business partner carries a higher risk for corruption, the organization must respond with stronger compliance procedures and controls. Proportionality of risk also applies to the size of the business — smaller organizations are not expected to have the same measures as large enterprises.
• Tone at the top: The compliance program must be fully supported by the board of directors and executives. Communication to and from top-level management must be bidirectional. Management must communicate that they support the anti-corruption compliance program and will not tolerate corruption in any form. At the same time, they must be well-informed about the effectiveness and strategies for compliance and anti-corruption initiatives.
• Know who you do business with: It is critical to establish a risk-monitoring framework that catalogs third-party relationships, markets, and geographies. Due diligence efforts must be in place to make sure the organization is contracting with ethical entities. If there is a high degree of corruption risk in a relationship, additional preventive and detective controls must be established in response. This includes knowing your own employees and conducting background checks to understand if they are susceptible to corruption and unethical conduct.
• Keep information current: Due diligence and risk assessment efforts need to be kept current. These are not point-in-time efforts that happen once; they need to be done on a regular basis or when the business becomes aware of conditions that point to increased risk of corruption.
• Compliance oversight: The organization needs someone who is responsible for the oversight of anti-corruption compliance processes and activities. This person should have the authority to report to independent monitoring bodies, such as the audit committees of the board, to report issues of corruption.
• Established policies and procedures: Organizations must have documented and up-to-date policies and procedures that address corruption. The code of conduct is the governing policy that filters down to other policies that address anti-corruption, gifts, hospitality, entertainment and expenses, customer travel, political contributions, charitable donations and sponsorships, facilitation payments, and solicitation and extortion. Compliance requirements and processes must be clearly documented and adhered to.
• Effective training and communication:Written policies are not enough — individuals need to know what is expected of them. Organizations must implement anti-corruption training programs to educate employees and business partners at risk of exposure to bribery, corruption, and fraud. This includes getting acknowledgements from employees and business partners to affirm their understanding, and attestation of their commitment to behave according to established policies and procedures.
• Implement communication and reporting processes:The organization must have channels of communication where employees can get answers on policies and procedures. This could take the form of a help line that allows an individual to ask questions, or a FAQ database, or via form processing for approval on activities and requests. The organization must also have a hotline reporting system for individuals to report misconduct — in the U.S. this is called a whistleblower system, and in the U.K. it is referred to as a speak-up line.
• Assessment and monitoring:In addition to periodic risk assessment, the organization must also have regular compliance assessment and monitoring activities to ensure that policies, procedures and controls to prevent corruption and bribery are in place and working.
• Investigations:Even in the best organization, things go wrong. Investigation processes (hotlines, surveys, management reports, and exit interviews) must be in place to quickly identify potential incidents of corruption, and quickly and effectively investigate and resolve issues. This includes reporting and working with outside law enforcement and authorities.
• Internal accounting controls: Organizations must keep detailed books, records and accounts that fairly and accurately reflect transactions and disposition of assets that could be implicated in corruption issues. This includes contract-pricing review, due diligence and verification of foreign business representatives, accounts payable payments, financial account reconciliation, and commission payments.
• Manage business change: The organization must monitor the business environment for changes that introduce greater risk of corruption. The organization must document changes required to business practices as a result of observations and investigations, and address deficiencies through a careful program of change management. This requires that business change be monitored by compliance personnel to proactively prevent corruption.