CHAPTER 1
Managing Corruption Risk
William P. Olsen
Ā
Ā
I magine that you are the chief financial officer (CFO) of a Global 1000 company. You are a large and quickly growing company with worldwide operations. Recognizing the risks inherent in conducting business on a global scale, you previously instituted various controls to minimize risks due to unethical and illegal business practices. In spite of this, some concerns have now been raised about the integrity of management at your Latin American operation. In response, you initiate a special investigation to look into the matter. The findings are shocking.
In the course of a few short days, you discover that, despite the controls you installed, a legal minefield of unethical business practices has been uncovered. Over the course of the investigation, the investigative auditors have uncovered a scheme between local management and outside agents to bribe employees of competitors to obtain their proprietary information. They also uncovered a scheme whereby payments were made to government officials overseeing a bid that your company was participating in. The investigation also uncovers evidence of massive vendor kickbacks as well as substantial conflicts of interest in your subsidiaryās business dealings. If that is not enough, it is also discovered that the organization was infiltrated by individuals with close ties to organized crime. You now have two questions: (1) how did this happen?, and (2) how can I prevent it from happening again?
The scenario you have just read is based on an actual investigation. As one can see, virtually every element of business corruption was uncovered. The fact that these events took place despite the existence of a corporate code of conduct underscores the need for ongoing monitoring and auditing to assure adherence to the policies and procedures included in the code of conduct and ethics program. In fact, if a program that required proper compliance monitoring had been instituted, the investigation described in the foregoing scenario could have been avoided and the illegal activity certainly would have been discovered earlier.
You Are Not Alone
A recent survey performed by a global business consulting firm discovered that only 50 percent of senior corporate executives are āhighly confidentā that business control systems are managing their organizationsā business risks effectively.
The survey also revealed that fewer than 10 percent of these senior executives rated their control systems as āexcellentā in providing early warning signs to catastrophic risks. In an increasingly competitive global marketplace, this could mean trouble for U.S. businesses competing on an uneven international playing field, where foreign competition does not have to adhere to such laws as the Foreign Corrupt Practices Act (FCPA). In fact, there are still many countries that allow āgrease paymentsā as business tax deductions. In addition, there are several other federal initiatives that highlight other areas in which U.S. corporations must address compliance risks.
Bribery and Kickbacks
The greatest threat of business corruption to U.S. companies exists in the emerging markets and developing countries. Corruption and cronyism can have a paralyzing effect on a developing country. The FCPA was adopted in response to scandals involving bribery of foreign officials by U.S. multinational corporations. The FCPA makes it a crime for any U.S. entity or individual to obtain or retain business by paying bribes to foreign government officials. Until recently, the United States was alone in prohibiting such actions. However, groups such as the Organization for Economic Cooperation and Development (OECD) have become more involved in the fight against corruption. In fact, the OECD Convention on Combating Bribery of Foreign Public Officials in International Business Transactions has had the effect of causing many more countries to have criminalized improper payments made to public officials. However, U.S. organizations cannot expect government agencies or international organizations to protect their interests. It is up to the private sector to set the tone and create an environment for integrity.
Economic Espionage
The Economic Espionage Act criminalizes the unauthorized use, access, copying, purchase, sale, and theft of trade secrets, so long as the owner took reasonable steps to protect them. An effective compliance program coupled with sound procedures that are routinely monitored and updated is the most effective tool to limit an organizationās potential liability under the act and also an important first step in protecting proprietary information. Organizations must protect against the illicit outflow of their own information as well as the inflow of information from their competitors.
Money Laundering
In an effort to crack down on money laundering transactions, since 9/11 the federal government has enacted new reporting regulations for the banking and financial industry and is planning to extend such regulations to cover money brokers and other businesses and organizations involved in the transfer of large sums of money. The āSuspicious Activity Reportā requires financial institutions and other businesses that transfer large amounts of cash to report patterns of suspicious activity by customers. New proposed regulations also call for the development of āCustomer Identification Programs,ā which call for financial institutions to establish procedures and adopt steps to reduce the risk of money laundering under the Bank Secrecy Act, Patriot Act, and other anti-money laundering laws. If implemented correctly, these preventive measures should help financial institutions prevent and detect illegal activity being perpetrated against their organization. It will also assist them in complying with government regulations.
Developing Effective Compliance Programs
These federal initiatives, along with the Sentencing Guidelines for Organizations, have applied increased pressure on all U.S. organizations to develop effective business ethics and anti-corruption programs. The problem, as illustrated at the outset of this chapter, is that many organizations have a false sense of security from current programs that are inadequate.
In the event of a potential violation, the existence of an effective compliance program has proved to be effective in fending off further government inquiry. An effective anti-corruption program must have the foundation of a strong code of conduct that communicates the organizationās position on conflicts of interest, bribery, kickbacks, confidentiality of proprietary information, and compliance with all applicable laws and regulations. To be effective, the program must have the support and oversight of top management. The communication of the organizationās policies and procedures is also critical in this type of program. Employees need to be constantly apprised of industry trends and new regulations through ongoing training programs.
Once a program is in place, ongoing monitoring is essential. This will not only ensure adherence to established policies and procedures, but will also help prevent fraudulent activity and detect patterns typical of money laundering and other suspicious or corrupt activity when it occurs. Auditors should look for strange or unusual patterns and vary their audit approach so as not to become predictable. The use of exception reporting audit software is becoming a basic tool utilized by auditors to detect patterns of suspicious activity.
Performing Due Diligence
Auditors should utilize a risk-based approach when preparing their audit plans. They should be able to identify the āred flagsā of fraud and plan their audit tests accordingly. Companies doing business in countries that are havens for money laundering operations or where bribery and kickbacks are accepted business practice should be extra vigilant.
The performance of background checks to screen key employees, customers, agents, potential partners, and vendors is also an effective tool to identify conflicts of interests, identify government officials, and deter fraudulent activity. What better way to assess the risk of a merger or acquisition than to review the business history of the company and its principal officers for indicators of fraudulent activity, bankruptcy, pending litigation, or even ties to organized crime. Vendor and consulting contracts should point out clearly the organizationās expectation that they adhere to all company policies and procedures with regard to business ethics. A āright to audit clauseā in the contracts can be a valuable tool if there are ever any allegations of wrongdoing.
Many organizations provide an āethics hotlineā for employees to report suspicions of illegal or unethical activity. If this type of activity becomes apparent, an organization must be prepared to investigate each allegation or suspicion of fraud and take the appropriate action based on results of the investigation.
In summary, the benefits of an effective anti-corruption program are unmistakable: a reduction in the risk of fraud; mitigation of fines and penalties; increased control over business risks; and peace of mind in an increasingly competitive global marketplace.
CHAPTER 2
What Is Anti-Corruption?
William P. Olsen
Corruption has a corrosive impact on both overseas market opportunities and the broader business climate. It also deters foreign investment, stifles economic growth and sustainable development, distorts prices, and undermines legal and judicial systems. More specifically, corruption is a problem in international business transactions, economic development projects, and government procurement activities.
As a result of this problem, and to obtain a competitive advantage in the global markets of the 21st century, a growing number of businesses are taking proactive steps to detect and prevent corruption.
Anti-Corruption Detection and Prevention
Since the Foreign Corrupt Practices Act (FCPA) was enacted in 1977, U.S. law has prohibited offers, promises, or payments to foreign officials, political parties, political officials, and candidates to secure business. A company running afoul of the FCPA, or recently enacted anti-corruption laws of other countries, may subject itself to criminal charges and substantial fines.
Companies in these situations may also face loss of financing and insurance from national or international institutions and debarment from public contracting. Companies committing FCPA violations may also sustain damage to their reputations and their ability to compete for international business. The financial losses incurred due to the loss in reputation can be far more costly than the fine and penalties leveled against companies for FCPA violations.
Developing a comprehensive āanti-corruptionā compliance program as part of your companyās standard business practiceāand that of your foreign subsidiariesāmay limit your companyās risk and help avoid potential costs. An anti-corruption compliance strategy can also help to protect your companyās reputation, minimize its liability, and maintain its long-term viability.
Critical Elements of an Effective Compliance Program
An effective corporate compliance program, according to the U.S. State Department, is one that ultimately yields intended results: education, detection, and deterrence.
In structuring your corporate compliance program, you may want to consider the following general elements typically found in successful compliance programs. The Federal Sentencing Guidelines for Organizations that were established in 1991 are the benchmark that most organizations utilize to develop compliance programs. The following steps are critical to a successful program.
Tone from the Top
⢠It is crucial that all of the elements of your companyās corporate compliance program receive the full support of upper management.
⢠The corporate compliance program must be enforced at all levels within the company.
⢠If upper-level management does not take efforts to combat corruption seriously, then neither will employees.
Code of Conduct
⢠Corporate directors, officers, employees, and agents put themselves at risk of incurring criminal or civil liability when they do not adhere to the FCPA or similar anti-corruption laws of other countries.
⢠A corporate code of conduct generally consists of a clearly written set of legal and ethical guidelines for employees to follow.
⢠A comprehensive and clearly articulated code of conduct, as well as clear policies and procedures relative to seeking guidance and making disclosures, may reduce the likelihood of actionable misconduct by your employees.
⢠It is important that a companyās code of conduct be distributed to everyone in the company and, if necessary, translated into the languages of the countries abroad where your company operates.
⢠Finally, developing a code of conduct should not be the final act. The code must be effectively implemented and enforced at all times.
Compliance Monitoring
⢠A compliance program may be run by one person or a team of compliance or ethics officers, depending on the size of your business.
⢠Implementation and responsibility for a corporate compliance program by high-level management employees are vital for accountability.
⢠Corporate compliance officers and committees can play key roles in drafting codes of conduct and educating and training employees on compliance procedures. Committee compliance members may include senior vice presidents for marketing and sales, auditing, operations, human resources, and other key offices.
⢠Past experience has shown that empowering compliance officers with access to senior members of management and with the capacity to influence overall company policy on integrity issues can be of utmost importance.
Training and Communication
⢠The overall success of a compliance program depends on promoting legal and ethics training at every level of t...