The Institute of Internal Auditors Detroit Chapter Presents...Questions will be answered after the...
48
1 The Institute of Internal Auditors Detroit Chapter Presents
The Institute of Internal Auditors Detroit Chapter Presents...Questions will be answered after the presentation portion is concluded 3 Earning CPE Credit In order to receive CPE credit
– If necessary,exit Full Screen Viewby pressing the Esc key
– Submit questionsthrough the“Ask a Question” button
– Questions will be answered after the presentation portion is concluded
3
Earning CPE Credit
In order to receive CPE credit for this webcast, participants must:
Attend the webcast on individual computers (one person per computer)
Answer polling questions asked throughout the webcast
When answering polling questions, select your answer and the click “Vote” button (next to the “Ask a Question” button) to submit / save your answer.
CPE certificates will be sent to the e-mail address on your BrightTALK account within two weeks of this webinar.
4
Please tell us your member status
A) Member Detroit ChapterB) Member – Central Region District 2 (Fort Wayne,
Toledo, Michiana, W. Mich., Lansing) C) Member – Other DistrictD) Non-member
Agenda
Overview of Foreign Corrupt Practices Act (“FCPA”)
Recent Trends in Enforcement Actions Red Flags Compliance Methodologies and Frameworks Common Pitfalls and Considerations
5
Presenter
Presentation Notes
MT Overview (5 - 10min) – MT Recent Trends (5 - 10min) – Scott Red Flags (5 - 10min) - Scott Compliance Methodologies (15mins) – MT Common Pitfalls (5 mins) - Scott
OVERVIEW OF THE FCPA
Presenter
Presentation Notes
MT
How did it start?
Foreign Corrupt Practices Act was enacted in 1977 after over 400 U.S. companies admitted to making questionable or illegal payments in excess of $300 million to foreign government officials, politicians, and political parties
Prohibits making improper payments to foreign government or officials
Jointly enforced by the U.S. Department of Justice (“DOJ”) and the Securities and Exchange Commission (“SEC”)
7
Presenter
Presentation Notes
MT Most widely enforced anti corruption law, enacted in 1977 when 400+ US companies actually admitted to making questionable or illegal payments to foreign officials and politicians. The FCPA is the first to introduce corporate liability, responsibility for 3rd parties, and extra territoriality for corruption offenses. Meaning companies or persons can be held criminally and civilly responsible for offenses committed abroad.
Key Elements
Anti-Bribery
Prohibit offering or giving anything of value to a foreign official or political candidate, directly or indirectly, to obtain or retain business.
Foreign Official - Any officer or employee of a foreign government or any department agency or instrumentality thereof, or of a public international organization, or any person acting in an official capacity or on behalf of any such government, department, agency or instrumentality or for, or on behalf of any such public international organization.
(a) Books & Records and (b) Internal Controls
Require that companies maintain proper internal books and records that reasonably reflect all transactions and dispositions of assets.
Mandate internal accounting controls to assure that expenditures are authorized
8
Presenter
Presentation Notes
MT Anti bribery – illegal to corruptly offer or provide money or anything of value to officials of foreign governments or foreign political parties with the intent to obtain or retain business. Books & Records – requires issuers to make and keep accurate books and records and accounts that in reasonable detail, accurately and fairly represent the issuers transactions and disposition of assets. Internal Controls – requires issuers to devise and maintain reasonable internal accounting controls aimed at preventing and detecting FCPA violations
Prohibited Payments
The FCPA prohibits not only actual payments, but also any offer, promise, or authorization of the provision of anything of value
No payment needs to be made nor benefit bestowed for liability to attach.
An offer to make a prohibited payment or gift, even if rejected, is a violation of the FCPA.
The FCPA also prohibits indirect corrupt payments
The FCPA imposes liability if a U.S. company authorizes a payment to a third party while “knowing” that the third party will make a corrupt payment.
Third parties include local agents, consultants, attorneys, subsidiaries, etc.
Political or Charitable contributions can violate the FCPA
9
Presenter
Presentation Notes
MT Prohibited payments can be: Actual payments and any offer to make a prohibited payment or gift (even if it is rejected) Indirect payments – a company who authorizes a 3rd party to make a payment on its behalf Political or charitable contributions can violate the FCPA as well
Permissible Payments
Small payment to low-level foreign officials that serve only to expedite or secure “routine governmental action.”
Can include securing basic services such as telephone, water and mail, processing visas, obtaining permits
Must be reasonable, well-documented and appropriately recorded
Sometimes referred to as “Grease Payments”
Payments permitted by local law
Be aware that all local laws prohibit bribery
Local law defense has never been applied in US courts
“Reasonable and bona fide” business expense payments to foreign officials. 11
Presenter
Presentation Notes
MT Source: http://www.business-anti-corruption.com/anti-corruption-legislation/fcpa-foreign-corrupt-practices-act There is a narrow exception for facilitation payments. Applies only to payments made to foreign officials with the purpose “facilitation” or expediting routine transactions. These payments must be properly documented, otherwise it may violate the FCPA’s accounting provisions.
Domestic Concerns Other PersonsIssuersAny company whose securities are registered in the U.S. or that is required to file periodic reports with the SEC. Applies to stockholders,
officers, directors, employees, and agents acting on behalf of the issuer. Issuers must adhere to both
the FCPA’s Anti-Bribery and Accounting Provisions.
Any individual who is a U.S. citizen, national, or resident of the United States, or any business organization that has its principal place of business in the U.S or which is organized in the U.S.
Applies to stockholders, officers, directors, employees, and agents acting on behalf of the domestic concern. “Domestic Concerns” must
adhere to the FCPA’s Anti-Bribery Provision.
Anyone who takes any act in furtherance of a corrupt payment while within the territory of the U.S.
11
Who does it apply to?
Presenter
Presentation Notes
MT Provisions apply to issuers, domestic concerns and other persons. Issuers: Any business entity with securities registered w/the or reports to the SEC. Domestic concerns: BROADER: any US Citizen, national or resident as well as any business entity that is organized under the laws of the US State or principal business in the US. Other: any agents or others acting on behalf of the company.
Criminal Penalties & Fines
Anti-Bribery
Individuals - fines up to $250,000 per violation and imprisonment up to five years
Entities - fines up to $2,000,000 per violation (or more under alternative fine rules) and disgorgement of resulting profits
Books and records:
Individuals - fines up to $5,000,000 per violation and imprisonment up to 20 years
Entities - fines up to $25,000,000 per violation (or more under alternative fine rules)
12
Presenter
Presentation Notes
MT Source: http://www.business-anti-corruption.com/anti-corruption-legislation/fcpa-foreign-corrupt-practices-act Criminal Penalties and Fines based on the provision violated Anti-bribery provision: Individuals: can face fines up to $250K per violation and imprisonment up to five years Entities: Fines up to $2M per violation Books and Records: Individuals: Fines up to $5M per violation and imprisonment up to five years Entities: Fines up to $25M per violation
Civil Penalties & Fines
Anti-Bribery
Officers, directors, employees, and agents
Fines up to $10,000 per violation for any willful act
Entities
Fines up to $10,000 per violation and injunction
The SEC may seek disgorgement of profits resulting from illegal activity
Possible denial of export licenses and other tax consequences
13
Presenter
Presentation Notes
MT Source: http://www.business-anti-corruption.com/anti-corruption-legislation/fcpa-foreign-corrupt-practices-act Civil Penalties and Fines Officers, directors, employees and agents: Individuals: Fines up to $10K per violation Companies: Fines up to $10K per violation and injunction May seek disgorgement of profits resulting from the illegal activity
Polling Question #1“Grease payments” are a type of prohibited payment.
A. TrueB. False
14
Presenter
Presentation Notes
MT Answer: False. “Grease payments” are a type of permissible payment. They are small payments to low-level foreign officials that serve only to expedite or secure “routine governmental action.”
Largest FCPA Enforcement Penalties
15
# Company Total Resolution
DOJ Component
SEC Component
Date
1 Siemens AG $800,000,000 $450,000,000 $350,000,000 12/15/2008
$965 million payments made in Uzbekistan and Keppel Offshore was assessed $422 million in penalties
Presenter
Presentation Notes
SCOTT Sources: https://corpgov.law.harvard.edu/2017/01/19/2016-year-end-fcpa-update/ http://www.fcpablog.com/blog/2017/12/26/keppel-offshore-lands-seventh-on-our-top-ten-list.html Telia violated the FCPA anti-bribery provisions. Biggest FCPA enforcement action ever. Their FCPA offenses date back to 2007 when Telia bought Coscom LLC (a company formed to provide telecom services in Uzbekistan). Paid a government official $80M to acquire mobile phone assets. That Government Official used a portion of those funds to pay Telia for a 26% ownership stake in Coscom. Siemens –At least 4,200 allegedly corrupt payments were made over the course of 6 years to foreign officials in numerous countries. Violated the internal controls, and books & records provisions. Merely adopted a “paper program” – distributed anti corruption circulars and policies. Insufficient tone at the top emphasizing adherence to policies. Failed to stablish a sufficiently empowered and competent compliance department and lacked sufficient anti bribery compliance policies and procedures.
RECENT TRENDS IN ENFORCEMENT ACTIONS
Presenter
Presentation Notes
SCOTT
Increase in Enforcement Actions
17
Presenter
Presentation Notes
SCOTT Source: https://www.gibsondunn.com/2017-year-end-fcpa-update/ KEY TAKEAWAYS: - Graphs show the number of initiated enforcement actions each year (corporate and individual) - 1977-2000: The U.S. government averaged three FCPA prosecutions per year. 2000-2005: The number of prosecutions increased ten-fold.�2010: The U.S. government initiated 74 enforcement actions in one year. 2012 – 2015: Slight dip 2016 & 2017: 53 and 39 total enforcement actions, respectively. DOJ typically has more enforcement action due to individual prosecutions 2016 had a larger # of actions from the SEC due to the end of the Obama Admin Overall – gradual increase in enforcement actions and penalties (penalty amounts not showed on the graph)
Top Trends Based on 2017 Actions
1. Increased multi-jurisdictional 2. Increased focus on culpable individuals3. The “Trump Effect”4. Continued Importance of Effective
Compliance Programs5. Awards for Whistleblowers
18
Presenter
Presentation Notes
SCOTT Source: https://www.foley.com/5-things-to-watch-for-in-fcpa-enforcement-this-year-01-01-2018/ 5 Things To Watch For In FCPA Enforcement This Year By David Simon, Rohan Virginkar and Hayley Wells - Increased cooperation between US government and foreign governments pertaining to multi-jurisdictional enforcement Focus on individuals The Trump Effect Continued importance of compliance programs Awards for Whistleblowers
Dr. Raj Aggarwal
Multi-jurisdictional Anti-corruption Enforcement
19
Presenter
Presentation Notes
SCOTT Source: https://www.gibsondunn.com/2017-year-end-fcpa-update/ Table shows largest combined penalties across multiple jurisdictions Historically, there has been a focus on China and Healthcare Late 2016/2017 saw a focus on Latin America (but multiple industries) and even an uptick netherlands 3 new laws in Latin America: 1) Peru passed the Corporate Corruption Act, which went into effect on January 1, 2018; 2) Mexico’s General Law for Administrative Responsibility, which went into effect in July 2017; and 3) Most recently, Argentina passed the Law on Corporate Criminal Liability and Compliance Programs.
Focus on Individuals
The 2015 “Yates Memo” was a key signal that DOJ and SEC would look to punish those individuals responsible for corporate misconduct
In 2017, 20 individual FCPA prosecutions by the DOJ (~70%) -second highest number (2010 had the largest)
Look to prosecute both domestic and foreign citizens/nationals
20
Presenter
Presentation Notes
SCOTT Sources: https://www.gibsondunn.com/2017-year-end-fcpa-update/ https://www.foley.com/5-things-to-watch-for-in-fcpa-enforcement-this-year-01-01-2018/ Yates memo sent out in 2015 to asst attorney generals and US attorney that prioritized prosecution of individuals In 2017, increase in the # of indiv enforcement action resolutions (22) vs only 16 in 2016. Yet there were 34 corp resolutions in 2016 vs only 14 in 2017. Of the 22, 60% were foreign citizen / nationals. Continue to identify the individuals, even in international jurisdictions (while cooperating with foreign governments)
Recent Enforcement Actions (2017)
Jan Mar Sept Nov
Keppel Offshore and its US subsidiary agree to pay a total penalty of $422 million due to the company paying $55 million in bribes to Brazilian officials between 2001 and 2014
The DOJ imposed $422 million in total penalties to SBM Offshore and its US subsidiary for bribing foreign officials in multiple countries including Brazil, Angola, Kazakhstan, and other countries
Dec
FCPA charges were taken against 5 individuals relating to the charge against Rolls-Royce from January 2017 and 4 of the individuals pleaded guilty (sentencing not yet finalized)
Telia Company AB agrees to pay a combined total penalty of $965 million due to various managers and employees of the company and affiliated entities paying $331 million in bribes to an Uzbek government official from 2007 through 2010
Individual is ordered to pay $590k and sentenced to 18 months in prison for attempting to pay $2 million in bribes in order to win aircraft service and maintenance contracts in Mexico
Cadbury Limited agrees to pay $13 million due to one of its subsidiaries in India making illicit payments to obtain government licenses and approvals for a chocolate factory
Nov
21
Presenter
Presentation Notes
SCOTT Some of the major enforcement actions in 2017 (2nd highest since 2010) Telia Co – 965million SBM offshore – 422 million A 6 month “quiet” period after the Obama administration Multiple actions pertaining to activity in Latin America Last 2 of on the timeline pertain to Oil and Gas
The “Trump Effect”
Only 6 corporate FCPA resolutions during the last 49 weeks 2017, lower than the number of resolution in the first 3 weeks (25 resolutions in 2016)
17 prosecutions of individuals brought by the Trump Administration (overall increase)
Announcement of new FCPA Enforcement Policy
Significant enforcement action against Telia ($965 million)
US Supreme Court limited SEC’s ability to collect disgorgement to 5 year statute of limitation
CONCLUSION: To Be Determined
22
Presenter
Presentation Notes
SCOTT Key Takeaways: Although there were only 6 resolutions during the Trump Admin time period, there was still a significant amount of FCPA enforcement actions initiated (on par with prior years). Temporary dip for a new administration is nothing new. Increased focus on individuals (as previously discussed) new FCPA enforcement policy that builds on the 2016 FCPA Pilot Program presumption of declination absent “aggravating circumstances”: companies will not face criminal prosecution or other DOJ enforcement actions based on self-disclosed FCPA violations, full cooperation, and timely and appropriate remediation. 50% reduction on the lower end of the penalty scale (vs. up to 50%) 19 declinations in 2017 vs. 12 in 2016 19 Publically reported FCPA declination in 2017, vs 12 in 2016 CONCLUSION: TBD. Change in FCPA Enforcement Leadership. As discussed below, key FCPA enforcement positions within the DOJ and SEC either remain unfilled, with staffers serving in an acting capacity, or were not filled until later in 2017. The unsettled nature of enforcement leadership may have affected 2017 FCPA enforcement. Sources: https://wp.nyu.edu/compliance_enforcement/2018/02/02/the-new-doj-fcpa-corporate-enforcement-policy-highlights-the-continued-importance-of-anti-corruption-compliance/ FCPA 2017 Year in Review – Jones Day FCPA 2017 Year in Review – Paul Weiss 5 Things To Watch For In FCPA Enforcement This Year By David Simon, Rohan Virginkar and Hayley Wells https://youtu.be/-LatP4LQJtU. – watch K&E presentation where he provides the budget and total penalties in 2015 and 2016
Importance of Compliance Programs
DOJ Initiated FCPA Pilot Program in 2016
Voluntary disclosure of misconduct may result in declination of criminal prosecution
Eligible for up to a 50% reduction of applicable fines
During the 18 months of the pilot program, DOJ received 30 voluntary disclosures, a 66% increase over the prior 18 months
In February 2017, DOJ released the “Evaluation of Corporate Compliance Program” questionnaire in order to provide a detailed approach for evaluating compliance programs
23
Presenter
Presentation Notes
SCOTT Sources: https://www.foley.com/5-things-to-watch-for-in-fcpa-enforcement-this-year-01-01-2018/ FCPA 2017 Year in Review – Jones Day FCPA 2017 Year in Review – Paul Weiss Lots of activity and updates over the past two years which speak to the importance of Compliance Programs: FCPA Pilot Program initiated in 2016 Feb 2017 – eval of corporate compliance program (to be discussed) Nov 2017 – New Corp FCPA Policy - DOJ/SEC do consider the effectiveness of your FCPA compliance program in determining credits/penalties and in providing declinations. Also, focuses on actions and actual programs in place (not just check the box)
Awards for Whistleblowers
In FY 2017, the SEC ordered whistleblower awards of nearly $50 million to 12 individuals that either led to the start of an investigation or contributed to a successful enforcement action.
24
Presenter
Presentation Notes
SCOTT Sources: https://www.foley.com/5-things-to-watch-for-in-fcpa-enforcement-this-year-01-01-2018/ https://www.sec.gov/files/sec-2017-annual-report-whistleblower-program.pdf Key Takeaways: Largest aware – in 2014 In 2016, SEC issued awards of approx. 80m to 15 whistleblowers, 2017 had 50m to 12 whistleblower – so still significant but in line with the resolutions/initiations Total SEC Whistleblower tips increase every year but FCPA Tips in 2016 – 238, 2017 – 210 (Paul Weiss), ending the trend of increased tips each year.
Polling Question #2There is a(n) ________ focus on individuals as it pertains to FCPA prosecutions.
A. IncreasedB. DecreasedC. Unchanged
25
Presenter
Presentation Notes
SCOTT Answer: A. Increased
RED FLAGS & COUNTRY RISKS
Presenter
Presentation Notes
SCOTT
Watch out for payments made by third parties…
FCPA expressly prohibits corrupt payments made through third parties or intermediaries
A significant number of enforcement actions for FCPA violations resulted from payments made by third parties acting on behalf of corporations, including: Lobbyists
Consultants
Brokers
Freight forwarders
Distributors
Sales representatives
27
Presenter
Presentation Notes
SCOTT A # of the 2017 enforcement actions involved an alleged bribery scheme that utilized 3rd party distributors or consultants. While the use of third-party intermediaries to funnel bribes is not a new concept, the DOJ’s and SEC’s emphasis on these types of bribery schemes shows that enforcement agencies continue to believe that third-party due diligence is a fundamental part of effective compliance programs. In the cases of Mondelez and Las Vegas Sands, neither the DOJ nor the SEC alleged that the companies had paid bribes to foreign officials. However, the companies paid money to a third-party, without knowing how the third-party would use the funds, which was sufficient to trigger liability under the accounting provisions of the FCPA. The need to ensure that companies can adequately check and confirm that their third-parties are not improperly using funds will always be a critical element of FCPA compliance.
Other Red Flags / Schemes
Use of sham vendors to pay bribes to employees of government-owned entities
Make payments to a charity to entice a government official to intervene in any on-going agency investigations
Use third-party sales promoters to make improper payments to government officials
Use “pay-to-prescribe” schemes in order to increase sales by providing gifts, improper travel and entertainment, and cash and record these transactions as legitimate business expenses
Provide bribes in the form of meals, gifts, and cash to government officials in order to obtain sales
28
III
IV
II
V
I
Presenter
Presentation Notes
SCOTT Source: http://www.fcpablog.com/blog/2017/1/3/the-2016-fcpa-enforcement-index.html Johnson Controls Inc.’s China subsidiary used sham vendors to pay bribes of $4.9 million to employees of Chinese government-owned shipyards, ship-owners and others Nu Skin Enterprises, Inc.’s subsidiary made $150,000 payment to a charity so a high-ranking Chinese communist party official would intervene in an on-going provincial agency investigation Anheuser-Busch used third-party sales promoters to make improper payments to government officials in India� GlaxoSmithKline pcl china-based subsidiaries spent millions on “pay-to-prescribe” schemes in order to increase sales by providing gifts, improper travel and entertainment, shopping excursions and cash and recorded these transactions as legitimate business expenses NCH Corporation’s Chinese subsidiary provided approximately $45k in meals, gifts, and cash to government officials in order to obtain sales
Emerging Trends – Heat Map
29
Presenter
Presentation Notes
SCOTT Corruption Perceptions Index Between 2016 and 2017, a majority of countries are making little or no progress in ending corruption Rating scale used: 0 = highly corrupt 100 = very clean Two thirds of countries score below 50
Polling Question #3Which country/territory is perceived to be the most corrupt according to Transparency International’s 2016 Corruption Perception Index:
A. DenmarkB. North KoreaC. United StatesD. Somalia
Top Elements of an Effective Anti-Bribery Framework
32
7 Elements of an Effective Compliance Program
Where is IAtypically
Involved?
Evaluation of Corporate Compliance Programs (Feb 2017)
Adequate Tone at the Top Not involved Autonomy and ResourcesSenior and Middle Management
Adequate anti-corruption policies and procedures Involved Policies and Procedures
Incentives and Disciplinary MeasurePerform an anti-bribery & anti-corruption
(“ABAC”) risk assessment Lead Risk Assessment
Third-party due diligence procedures Involved Third-Party Management
Implement a reporting mechanism (e.g. Compliance Hotline) Involved
Confidential Reporting and InvestigationAnalysis and Remediation of Underlying
Misconduct
Provide anti-corruption trainings Not involved Training and Communications
Perform anti-corruption audits Lead Continuous Improvement, Periodic Testing Review
Involved Mergers & Acquisitions
Presenter
Presentation Notes
MT Sources: http://complianceandethics.org/key-elements-anti-briberyanti-corruption-framework/ http://www.ey.com/Publication/vwLUAssets/Building_an_anti_corruption_program/$FILE/Building_an_anti-corruption_program.pdf https://wp.nyu.edu/compliance_enforcement/2018/02/02/the-new-doj-fcpa-corporate-enforcement-policy-highlights-the-continued-importance-of-anti-corruption-compliance/ Key Takeaways: 7 elements pulled from 2012 FCPA Resource guide and number of other publications Feb 2017, DOJ published the Eval of Corp Compliance program, 119 specific questions organized into 11 topics. These are questions DOJ may ask in an “individualize determination” of the effectiveness of a company’s compliance program. There is a notable emphasis on process and evidence (also emphasized in the New Enforcement Policy). I.e. what actions have you under taken? Internal Audit and Compliance can be effective partners Most relevant to internal audit: Adequate policies and procedures Performing a risk assessment Third Party Due Diligence Procedures Performing Anti-Corruption/FCPA audits
Autonomy and Resources &Senior and Middle Management How have senior leaders, through their words and actions, encouraged or
discouraged the type of misconduct in question? What concrete actions have senior management taken to demonstrate
leadership in compliance efforts?
33
Internal AuditMay not have a
significant role but can assist in assessing
effectiveness
Have the compliance and relevant control functions had direct reporting lines to anyone on the board of directors?
What compliance expertise has been available on the board of directors?
What information have the board examined in their exercise of oversight?
How has senior leadership modelled proper behavior to subordinates?
Presenter
Presentation Notes
MT Generally speaking, Internal Audit doesn’t play a significant role in this area, although they can support compliance and be aware of these types of questions. Leverage these types of questions in your interviews/surveys. IA should ensure that the board has the necessary financial information (i.e. transaction data, example, etc.) that is expected based on the questions outlined in the Evaluation Criteria (does the board have access to adequate financial information/data when necessary). This would be done by teaming with Compliance. IA can serve as a member of the Compliance Committee.
Policies and ProceduresIncentives and Disciplinary Measures
Prepare a distinct policy that provides operational guidance on: Dealing with government officials Misreporting and concealment in the company’s accounting records Use of third-party agents and consultants Facilitating payments Travel, entertainment and gifts Other areas of high risk (customs, M&A, petty cash)
34
Internal AuditPrior to planning
audits, review policies to help identify high
risk areas and criteria for testing
How has the company assessed whether these policies and procedures have been effectively implemented?
How has the company incentivized compliance and ethical behavior?
Have the disciplinary actions and incentives been fairly and consistently applied across the organization?
Presenter
Presentation Notes
MT Key takeaways: Policies and Procedures: Distinct Policy or Policies covering the areas listed on the slide Internal Audit would want to have access to and review these policies before performing any specific audits / testing. The Audit Plan (whether in operations/financial/ABAC) should consider these procedures and processes, as there is no materiality consideration around FCPA After performing controls testing, remediation may include changes or updates to these policies. Internal Audit should provide recommendations for any process/procedural changes around controls or perform a review of changes to the policy Policies should include a policy for 3rd parties/intermediaries that has been signed-off on Incentive & Disciplinary Measures: - More of an HR/compliance role. IA may not get heavily involved
Risk AssessmentStage 1:
Assess bribery and corruption risks by specifically looking at geographic locations, business partners, and nature of business activities
Consider and assess the degree of business and interactions with government officials
35
Internal AuditTeam with compliance,
legal and other functions in performing
the risk assessment
Stage 2:
Identify the policies and controls in place to mitigate corruption risk
Analyze the effectiveness of the policies and controls and determine the residual corruption risk still facing the company
Stage 3:
Prepare a plan to remediate identified gaps and implement additional controls where needed
Presenter
Presentation Notes
MT The process here is similar to other risk assessments, but focused on bribery and corruptions risks: Stage 1: Identify Risks (discussed in 2012 Resource Guide and Sentencing Guidelines) through interviews/policies/prior reports/hot line. Risks should include Geographic locations (heat map) Business partner risk Nature of business Government touch points Prior audit findings Hotline reports # of payments to 3rd parties / government affiliated entities 2. Identified policies and controls to mitigate risk. - Assess the effectiveness of those controls and determine residual corruption risks 3. Prepare a plan to remediate the identified gaps and implement additional controls where needed
Third Party Management How has the company’s third-party management process
corresponded to the nature and level of the enterprise risk identified by the company?
What types of background searches are performed on third parties?
36
Internal AuditImplement testing around third party due diligence
procedures, including signing off on company’s code of conduct and anti-
corruption policy
What company policies are third parties required to sign-off on?
How has the company trained the relationship managers about what the compliance risks are and how to manage them?
Were red flags identified from the due diligence of the third parties?
Presenter
Presentation Notes
MT Internal audit can play a role and be involved in regards to third party risk management – Ensure there is due diligence procedures performed AND follow up on the due diligence procedures and resolution of any potential issues. Ensure the company requires sign off on the company’s code of conduct and anti corruption policies Ensure the relationship managers are trained on compliance risks
Third Party Management (cont.)Internal audit should consider the following controls and processes:
37
Required trainings for employees and
agents
Vendor Approval and Payment
3rd Party sign-off on Code of Conduct or
FCPA Policy
Bidding Process Due Diligence Procedures
Follow up on Red Flags
Contractual Language and Right to Audit
Presenter
Presentation Notes
MT Internal Audit would want to test the existence and effectiveness of the following controls: Review and test controls around the bidding process, including due diligence procedures Review and test controls pertaining to any red flags identified from due diligence of 3rd parties Review and test process and controls around vendor approval and payment processes Review language in contracts, and any separate FCPA policies/code of conducts, signed by third parties (including a right to audit provision) Assess whether anti bribery anti corruption trainings are given to third parties
Confidential Reporting and InvestigationAnalysis and Remediation of Underlying Misconduct
How has the company collected, analyzed, and used information from its reporting mechanisms?
How has the company ensured that the investigations have been properly scoped, and were independent, objective, appropriately conducted, and properly documented?
How high up in the company do investigative findings go?
38
Internal AuditCertain types of issues, such as those involving accounting and finance,
can be directed to Internal Audit for
review
Were there prior opportunities to detect the misconduct in question, such as audit reports identifying relevant control failures or allegations, complaints, or investigations involving similar issues?
What is the company’s analysis of why such opportunities were missed?
Presenter
Presentation Notes
MT Is IA involved or at least aware of the triage process Determine the types of issues/misconduct/investigation that should be directed by IA vs. partnering vs. using IA as a resource, including: Recording of improper transactions (revenue, a/p, expenses, accruals, etc.) to the GL Unknown disbursements/payments to third parties Bypassing controls (management override) Reimbursement of improper business expenses Theft of cash or other assets (inventory, fixed, etc.) Corruption / conflict of interest (team between Legal/Compliance/Internal Audit) After conducting the investigation… Who is responsible for communicating any observations or findings to the board? Did prior audit reports cover the issue that was being investigated? (Was it missed or simply not in scope, non material)? Has the audit committee/board of directors been given the necessary information. IA will want to communication Remediation/recommendations and then test those remediation efforts at some point in the near future The next audit of that region/area should include re-testing of the controls, etc.
Training and Communications What training in relevant control functions are required? Has the company provided tailored training for high-risk and control
employees? What analysis has the company undertaken to determine who should be
trained and on what subjects?
39
Internal AuditNot a significant role but
can provide input on trainings involving
accounting, finance or internal controls
How has the company measured the effectiveness of the training?
What has senior management done to let employees know the company’s position on the misconduct that occurred?
What resources have been available to employees to provide guidance relating to compliance policies?
Presenter
Presentation Notes
MT Source: http://complianceandethics.org/key-elements-anti-briberyanti-corruption-framework/ Consider testing controls around any fcpa trainings or account specific (facilitation payments) trainings Are the right individuals (Sales, third parties, accounting, finance) participating in trainings If not a formal test, should be asked in interviews and surveys IA should report on any observations or identified gaps in trainings IA can act as an advisor within these trainings
Continuous Improvement, Periodic Testing and Review
40
Gifts & Entertainment
Travel
Rebates
Refunds
Commissions
Donations
Professional Fees / Services
Events
Credit Card Advances
“Discretionary” accounts Petty Cash
Other / Miscellaneous
Facilitation Promotional / Marketing
License Fees
Agent Fees
Example of high risk accounts:
Internal AuditLeverage data analytics and testing to update and prepare for future
risk assessments targeted audits
Presenter
Presentation Notes
MT What types of audits have identified issues? Did those audits occur and what were the findings? How have management and the board followed up? How often does internal audit generally conduct assessments in high-risk areas? Has the company reviewed and audited its compliance program in the area relating to the misconduct, including testing of relevant controls, collection and analysis of compliance data, and interviews of employees and third-parties? How often has the company updated its risk assessments and reviewed its compliance policies, procedures, and practices? Continuous Monitoring of GL accounts; Internal Audit can perform data analytics on the data of these accounts to look for potential indicators of suspicious activity. Identify: Payments made to foreign remit addresses Payments made to companies / suppliers / vendors registered in countries with a higher risk of corruption Key word searches: gifts, facilitation, commissions, services rendered, cash, bribe Repeat and even dollar transactions Payments to payees on the OFAC / GSA lists (office of foreign asset control or general services administration0
Mergers and Acquisitions (M&A) Was risk of misconduct identified during due diligence? Who conducted the risk review for the acquired/merged entities and how
was it done? What has been the M&A due diligence process generally?
41
Internal AuditPerforming testing or
review of relevant transactions and
accounts impacted by the merger/acquisition
How has the compliance function been integrated into the merger, acquisition, and integration process?
What has been the company’s process for tracking and remediating misconduct or misconduct risks identified during the due diligence process?
What has been the company’s process for implementing compliance policies and procedures at new entities?
Presenter
Presentation Notes
MT Testing of relevant accounts and transactions Was IA involved in the due diligence / risk review of the acquired entity After completion of a merger, is it considered in IA’s audit plan and are due diligence procedure tested by IA? Were any red flags identified, and if so, how were they reported/handled?
Polling Question #4The FCPA is enforced by:
A. DOJB. SECC. Both DOJ and SECD. Neither DOJ or SEC
42
Presenter
Presentation Notes
MT Answer: C. Both DOJ and SEC
COMMON COMPLIANCE PITFALLS AND CONSIDERATIONS
Presenter
Presentation Notes
Scott
Leading Practices andCommon Pitfalls
Leverage outside expertise where appropriate
Constant monitoring, assessment and benchmarking of the program
Risk-based Approach
Spotting state-owned companies
Underestimating the Cost of Compliance
Risk of Third-Party Corruption
Fixating on Tone at the Top (and not involving middle management)
44
Presenter
Presentation Notes
Scott Sources: http://www.corporatecomplianceinsights.com/8858-2/ https://www.law.com/almID/523fd3cc140ba0dc01000106/?slreturn=20180128130714 Key Takeaways: Audit doesn’t use a risk based approach. Become more of a check the box / compliance visit and not very effective The real risk might be a different location, but materiality doesn’t really come into play from an FCPA perspective. Internal audit can help develop questionnaires / integrity due diligence and send those to vendors and agents Forgetting about third parties – remember pre-contract related policies, such as setting up rights to audit Forgetting to involve middle management and focusing too much on “Tone at the TOP”
Investigation Considerations Delayed Response
Ignoring Complaints
Inappropriate Planning
Mishandling Evidence
Losing Objectivity
Destroying Credibility
Evidence Collection and Review Challenges –Most Costly Part of an Investigation
Not Following up on Key Issues
Overly Aggressive Tactics
45
Presenter
Presentation Notes
Scott The most important considerations based on my experience: Ignoring complaints (too many come through the ethics hotline so they get lost) Inappropriate Planning – not bringing in the right level of experience/expertise from the get go Losing Objectivity – “he/she would never do that” or “we have controls in place that wouldn’t allow that” Evidence collection and review – significant cost (collect emails, hard drives, phones, shared folder, SharePoint sites, etc.) and then processing and reviewing take significant level of effort but may be necessary Mishandling evidence – deletion of emails or hardrive data before a lit hold is put in place
Confidentiality and Privilege Considerations
Communicating with Regulators and Privilege Considerations:
Waiving Privilege
Sharing Work Product
Dealing With Other Stakeholders:
Shareholders
Auditors
Report Considerations:
Report Format – Written vs. Verbal
Who Sees the Report?
Careful Consideration when Sharing Report
46
Presenter
Presentation Notes
Scott Privilege Considerations: Get outside counsel involved early to help drive discussions with Regulators Retain a forensic accountant/consultant through outside counsel to maintain privilege Ensure a safe/reliable method for sharing work products/documents (eRooms with proper privileges/access rights) Report: Tend to go for Verbal/PPT format to guide discussions with SEC Limit the individuals who view the report and who can edit
