Tag Archives: Foreign Corrupt Practices Act

Working Toward Non-Prosecution

Posted by on September 23, 2019 Comments Off on Working Toward Non-Prosecution

A recent major article in the financial trade press alluded to the importance of the U.S. Foreign Corrupt Practices Act as a piece of US government regulation of which it behooves all fraud examiners to be aware. The reference got me to thinking about the confusion that still persists regarding certain provisions of the Act among corporate players as reported in the article in question following several high profile prosecutions. Enacted to great fanfare in 1977, the purpose of the FCPA was to prevent the bribery by the agents of US corporations of foreign government officials when those agents were negotiating overseas contracts. The FCPA imposes heavy fines and penalties for both organizations and individuals. The two major provisions address: 1) bribery violations and 2) improper corporate books and records as well as maintenance of inadequate internal controls. Methods of enforcement and interpretation of the law in the US have continued to evolve to the present day.

From the first, the FCPA spawned questions of definition and interpretation for those trying to comply, i.e., who is a “foreign official?” What is the difference between a “facilitation” payment and a bribe? Who is considered a third party? How does the government define “adequate” internal controls to detect and deter bribery and corruption?

The United Kingdom enacted its UK Bribery Act in July 2010 which really represented the first real attempt at an anti-bribery law to address some of these issues. The UK Bribery Act introduced the concept of “adequate procedures”, that if followed could allow affirmative defense for an organization under investigation for bribery. The UK Bribery Act recommended several internal controls for combating bribery and offered the incentive of a more favorable result for those who could document compliance. Among the controls:

• Establish anti-bribery procedures;
• A top corporate level commitment to prevent bribery;
• Periodic and documented risk assessments;
• Proportionate due diligence;
• Communication of bribery prevention policies and procedures to all involved parties to corporate transactions;
• Monitoring of anti-bribery procedures.

The concept of an affirmative defense for adequate procedures creates quite a contrast to the US FCPA which only offers affirmative defense for payments of bona fide expenses or small gifts within the legal limits of the foreign countries involved. The UK Bribery Act simply equates all facilitation and influence payments to bribery, thus eliminating much confusion. Finally, the UK Bribery Act dealt with the problem of defining a foreign official by making it illegal to bribe anyone regardless of government affiliation. Several countries such as Russia, Canada and Brazil have enacted or updated their anti-bribery regulations to parallel the guidelines presented in the UK Bribery Act. The key to the effectiveness remains enforcement.

Then, in 2010, the US Department of Justice and the Securities Exchange Commission released a guide book introducing several hallmarks of an effective FCPA compliance program. The publication of the guidebook is a development which, according to the article I was reading, many auditors and CFE’s remain unaware, even today. The Resource Guide provides our client companies with the tools to demonstrate a proactive approach to the deterrence of bribery and corruption. Companies found out of compliance may receive some consideration during the fines and penalty stage of their cases.

The guidebook recommends that companies doing business overseas:
• Establish a code of conduct that specifically addresses the risk of bribery and corruption;
• Set the tone by designating a Chief Compliance Officer to oversee all anti-bribery and anti-corruption activities;
• Train all employees to be thoroughly prepared to address bribery and corruption risk and document that the training took place;
• Perform fraud risk assessments of potential bribery and corruption pitfalls by country and industry;
• Review the anti-corruption program annually to assess the effectiveness of policies, procedures and controls;
• Perform audits (routine and surprise) and monitor foreign business operations to assure strict compliance with the published code of conduct;
• Ensure proper legal contractual terms exist within agreements with third parties that address compliance with anti-bribery and corruption laws and regulations;
• Investigate and respond promptly and appropriately to all allegations of bribery and corruption;
• Take proper disciplinary action for violations of anti-bribery and corruption laws and regulations;
• Perform adequate due diligence that addresses the risk of bribery and corruption performed by third parties prior to entering into any business relationship.

Fraud examiners should make their clients aware that a company which can provide evidence of compliance with these recommendations is afforded many advantages if they’re ever charged with a violation of the Act. Among them is a Deferred Prosecution Agreement (DPA). Under a Deferred Prosecution Agreement the Department of Justice files a court document charging the organization while simultaneously requesting that prosecution be deferred in order to allow the company to demonstrate good conduct going forward. The DPA is an agreement by the organization to: cooperate with the government, accept the factual findings of the investigation, and admit culpability if so warranted. Additionally, companies may be directed to participate in compliance and remediation efforts, e.g., a court-appointed monitor. If the company completes the term of the DPA the DOJ will dismiss the charges without imposing fines and penalties!

The DOJ and the company may alternatively even enter into a Non-Prosecution Agreement. Under such an agreement the DOJ retains the right to file charges against the organization at a later time should the organization fail to comply. The NPA is not filed with the courts but is maintained by both the DOJ and the company and posted on the DOJ website. Similar to the DPA, the organization agrees to monetary penalties, ongoing cooperation, admission to relevant facts, as well as compliance and remediation of policies, procedures and controls. If the company complies with the agreement, the DOJ will, again, drop all charges.

The good news is that, since publication of the guidebook, corporate compliance programs have continued to mature, and are now generally accepted as just another cost of conducting business in a global marketplace. The US government is continuing to clarify expectations with regard to corporate responsibility at home and abroad, and working with international partners and their compliance programs.

Increased cooperation between the public and private sectors to address these issues will assist in leveling the playing field in the global marketplace. Non-government and civil society organizations, i.e. World Bank and Transparency International, are playing a key role in this effort. These organizations set standards, apply pressure on foreign governments to enact stricter anti-bribery and corruption laws, and enforce those laws. Coordination and cooperation among government, business and civil entities, reduce the incidences of bribery and corruption and increase opportunities for companies to compete fairly and ethically in the global marketplace. Hence, every fraud examiner and assurance professional should strongly support these efforts while strongly encouraging our clients to become familiar with and comply with the provisions of the recently updated 2010 guidebook.

Facilitation or Bribe?

Posted by on November 22, 2015 Comments Off on Facilitation or Bribe?

LondonBridge2During our recent live training event on November 12th , Tom Gober, our speaker, alluded to the importance of the U.S. Foreign Corrupt Practices Act as a piece of US government regulation of which it behooves all fraud examiners to be aware. Tom’s reference got me to thinking about the confusion that still persists regarding certain provisions of the Act among corporate players (as reported in the financial trade press following several recent high profile prosecutions). Enacted to great fanfare in 1977, the purpose of the FCPA was to prevent the bribery by the agents of US corporations of foreign government officials when those agents were negotiating overseas contracts. The FCPA imposes heavy fines and penalties for both organizations and individuals. The two major provisions address: 1) bribery violations and 2) improper corporate books and records as well as maintenance of inadequate internal controls. Understandably, methods of enforcement and interpretation of the law in the US have continued to evolve to the present day.

From the first, the FCPA spawned questions of definition and interpretation for those trying to comply, i.e., who is a “foreign official?” What is the difference between a “facilitation” payment and a bribe? Who is considered a third party? How does the government define “adequate” internal controls to detect and deter bribery and corruption?

The United Kingdom enacted its UK Bribery Act in July 2010 which really represented the first real attempt at an anti-bribery law to address some of these issues. The UK Bribery Act introduced the concept of “adequate procedures”, that if followed could allow affirmative defense for an organization under investigation for bribery. The UK Bribery Act recommended several internal controls for combating bribery and offered the incentive of a more favorable result for those who could document compliance. Among the controls:

• Establish anti-bribery procedures;
• A top corporate level commitment to prevent bribery;
• Periodic and documented risk assessments;
• Proportionate due diligence;
• Communication of bribery prevention policies and procedures to all involved parties in corporate transactions;
• Monitoring of anti-bribery procedures.

The concept of an affirmative defense for adequate procedures creates quite a contrast to the US FCPA which only offers affirmative defense for payments of bona fide expenses or small gifts within the legal limits of the foreign countries involved. The UK Bribery Act simply equates all facilitation and influence payments to bribery, thus eliminating much confusion. Finally, the UK Bribery Act dealt with the problem of defining a foreign official by making it illegal to bribe anyone regardless of government affiliation. Several countries such as Russia, Canada and Brazil have enacted or updated their anti-bribery regulations to parallel the guidelines presented in the UK Bribery Act. The key to their effectiveness remains enforcement.

Then, in 2010, the US Department of Justice and the Securities Exchange Commission released a guide book introducing several hallmarks of an effective FCPA compliance program. The publication of the guidebook is a development which, according to Tom Gober, many auditors and CFE’s remain unaware, even to this day. The Resource Guide provides our client companies with the tools to demonstrate a proactive approach to the deterrence of bribery and corruption. Companies found out of compliance may receive some consideration during the fines and penalty stage of their cases.

The guidebook recommends that companies doing business overseas:

• Establish a code of conduct that specifically addresses the risk of bribery and corruption;
• Set the tone by designating a Chief Compliance Officer to oversee all anti-bribery and anti-corruption activities;
• Train all employees to be thoroughly prepared to address bribery and corruption risk and document that the training took place;
• Perform fraud risk assessments of potential bribery and corruption pitfalls by country and industry;
• Review the anti-corruption program annually to assess the effectiveness of policies, procedures and controls;
• Perform audits (routine and surprise) and monitor foreign business operations to assure strict compliance with the published code of conduct;
• Ensure proper legal contractual terms exist within agreements with third parties that address compliance with anti-bribery and corruption laws and regulations;
• Investigate and respond promptly and appropriately to all allegations of bribery and corruption;
• Take proper disciplinary action for violations of anti-bribery and corruption laws and regulations;
• Perform adequate due diligence that addresses the risk of bribery and corruption performed by third parties prior to entering into any business relationship.

Fraud examiners should make their clients aware that a company which can provide evidence of compliance with these recommendations is afforded many advantages if they’re ever charged with a violation of the Act. Among them is a Deferred Prosecution Agreement (DPA). Under a Deferred Prosecution Agreement the Department of Justice files a court document charging the organization while simultaneously requesting prosecution be deferred in order to allow the company to demonstrate good conduct going forward. The DPA is an agreement by the organization to: cooperate with the government, accept the factual findings of the investigation, and admit culpability if so warranted. Additionally, companies may be directed to participate in compliance and remediation efforts, e.g., a court-appointed monitor. If the company completes the term of the DPA the DOJ will dismiss the charges without imposing fines and penalties!

The DOJ and the company may alternatively even enter into a Non-Prosecution Agreement. Under such an agreement the DOJ retains the right to file charges against the organization at a later time should the organization fail to comply. The NPA is not filed with the courts but is maintained by both the DOJ and the company and posted on the DOJ website. Similar to the DPA, the organization agrees to monetary penalties, ongoing cooperation, admission to relevant facts, as well as compliance and remediation of policies, procedures and controls. If the company complies with the agreement, the DOJ will, again, drop all charges.

The good news is that, since publication of the guidebook, corporate compliance programs have continued to mature, and are now generally accepted as just another cost of conducting business in a global marketplace. The US government is continuing to clarify expectations with regard to corporate responsibility at home and abroad, and working with international partners and their compliance programs. Increased cooperation between the public and private sectors to address these issues will assist in leveling the playing field in the global marketplace. Non-government and civil society organizations, i.e. World Bank and Transparency International are playing a key role in this effort. These organizations set standards, apply pressure on foreign governments to enact stricter anti-bribery and corruption laws, and enforce those laws. Coordination and cooperation among government, business and civil entities, reduce the incidence of bribery and corruption and increase opportunities for companies to compete fairly and ethically in the global marketplace. Hence, every fraud examiner and assurance professional should strongly support these efforts while strongly encouraging our clients to comply with the provisions of the 2010 guidebook.

Folding Client Business Partners into the Fraud Risk Assessment

Posted by on July 22, 2014 Comments Off on Folding Client Business Partners into the Fraud Risk Assessment

SeattleAs regular readers of the InnerAuditor blog know, out of town members of our RVA ACFE Chapter are encouraged to submit speaker questions via e-mail for use during our live training sessions. A reader asked a series of questions related to ethical practice for our August 28, 2014 event, Ethics 2014 for CPA’s and Fraud Examiners that we’re co-sponsoring with the Virginia State Police and the President of the Tidewater Virginia Chapter of the Institute of Internal Auditors. One of the questions concerned various ethical exposures involving compliance with the U.S. Foreign Corrupt Practices Act and extending to the business partners of the CPA’s audit client. Should a CFE’s fraud risk assessment include due diligence performed on the business partners of the fraud examiner’s client? Turns out there are a number of interesting ethical and due-diligence considerations.

There is certainly such a thing as third party risk, traditionally represented only by a few key suppliers and agents, and now significantly expanded in today’s global market place by technology firms, joint venture partners, foreign stakeholders, consultants and co-marketers and a whole host of others. Joining with every one of these partner types can expose our clients to significant categories of collateral risk. An overseas consultant can pay a bribe on our client corporation’s behalf to a foreign corporation without our client even knowing it; foreign joint venture partners of one of our client’s domestic suppliers can engage in unethical behavior thereby exposing the client to significant corruption accusations and reputational risk; the client’s law firm can pay for expensive vacations for foreign officials during off-shore tax negotiations; and the list of risks and exposures can go on and on, limited only by our imaginations.

Clearly, then, the net of the CFE’s fraud risk assessment has to be cast widely enough to encompass a thorough understanding of the histories and practices of all the business partners conducting business on our client’s behalf. The recent Target corporation example of on-going data breaches facilitated by hacker use of an infrastructure and maintenance supplier to penetrate Target’s customer systems should be enough to convince any practitioner of the degree of fraud risk represented by business partners, whether ethically challenged or not. The idea that customers, agents, resellers and other parties are not part of a client’s operating or risk profile is no longer a defensible position; a new era of corporate and social responsibility (and the stepped up number of prosecutions recently undertaken under legislation like the Foreign Corrupt Act) has changed that notion forever.

I’m sure all our readers are familiar with the basic mechanics of conducting a fraud (or any type) of risk assessment by now. Although criteria may vary from one assessment to the next, each risk assessment requires the steps of information gathering, analysis and interpretation. In the case of the assessment of the degree of risk represented by third party business partners, the first step is critical; that is to schedule up a list of just who those third parties are (sometimes, in the case of medium to large companies, a daunting task in itself). After your list is complete, for each of the partners you’ve identified, see if you can document an answer for a set of questions like these:

–does your risk assessment client have a formal business contract with this partner? If so, read the contract carefully and make a copy for your work paper file;
–what requirements and rights regarding ethical compliance and anti-corruption are contained in the contract or (absent a contract) in any documentation you can obtain bearing on the exact relationship between the parties;
–does the contract include an audit clause;
–try to find out exactly who owns each listed business partner;
–as far as you can determine, has the partner disclosed to your client all the partner’s relevant third party relationships;
–have all the partner’s operating locations, foreign and domestic, been disclosed;
–does this partner have on-going litigation or governmental relationships that might create an adverse impression among the existing customers of your client or among external regulators?

Following the information gathering phase, the examiner should look for and resolve any apparent red flags involving individual and/or combined partners during the analysis and interpretation phases. Red flags can include limited information about one or more partners, inconsistent or contradictory data, and operations in politically charged locales, prior regulatory sanctions as well as connection to or ownership by politically exposed individuals. Look especially for involvement in non-domestic environments with uncertain economic or commercial requirements. The due diligence process involves fraud examiner/management evaluation of each of the key business partner risk factors identified. A table can be prepared of potential identified risks localized by partner and a remediation plan for management consideration of recommended steps management can take to address potential threats should be written.

Lastly, try to get client management to commit to performance of a formal approval process before engaging with any new, significant business partner and then for on-going review of existing partnerships as a component part of the annual Enterprise Risk Management (ERM) process.

FCPA Compliance Assessment as a Service for Fraud Examiners

Posted by on November 9, 2013 Comments Off on FCPA Compliance Assessment as a Service for Fraud Examiners

Education2In today’s increasingly interconnected world, more and more companies involved in ever more business sectors are finding themselves employing a wider range of intermediaries and partners than they ever thought possible to manufacture, test, sell and market their products outside the U.S.  A small domestic start-up with a website and a few good products can find itself, almost overnight,  involved in an elevated level of interaction with foreign officials for approvals, permits, licenses and certifications.  Accompanying all this regulatory complication and unfamiliar interaction comes the heightened risk of becoming, wittingly or unwittingly,  involved in corruption.

As many of our Chapter members are aware from reading about recent, high profile cases like that of Wal-Mart Mexico, the U.S. Foreign Corruption Practices Act (FCPA) prohibits all U.S. companies, as well as their subsidiaries, from making or promising to make payments to foreign government officials.  The Act also requires companies to maintain accurate and reasonably detailed books and records pertaining to transactions and to dispositions of assets.  Assessing and reporting on our client’s FCPA compliance readiness is a real opportunity for fraud examiners since many company employed financial auditors (internal and external) lack adequate training to detect potential violations and few small or medium sized firms ever conduct standalone FCPA audits or risk assessments.

Fraud examiners can begin to address this need by making their clients doing overseas business aware that corporate lack of compliance with FCPA regulations  constitutes a substantial financial and reputational risk; since a lot of the work we currently do for companies is at the behest of corporate counsel, talking to counsel is often a good place to start.  Request permission to talk to the Chairman of the Audit Committee or to the CEO about adding some of  the following types of services to your annual fraud risk assessments:

–a broad risk assessment of the client’s current level of FCPA compliance targeted at identifying potential high risk areas featuring analysis of quantitative  and qualitative risk factors of all company businesses and international locations;

–assessing management’s FCPA knowledge and current compliance activities (if any); this service can be a very effective lead-in to the provision of management training since National ACFE can partner with you to provide both live and on-line management level instruction on this topic;

–testing existing company policies and procedures (both documented and simply cultural)  for FCPA awareness and effectiveness; this can be done by accumulating electronic data and conducting interviews with the staff overseeing international operations;

–advising management on the application of automated controls and proactive financial data anomaly detection tools to scan for patterns of irregular payments;

–testing transactions to determine whether FCPA controls are working as intended;

— reporting fraud assessment findings to compliance officers, audit committees and legal counsel in a format designed to enhance compliance and reward corrective action on identified FCPA related issues;

–driving FCPA policy and procedural changes using identified risks and gaps;

–training foreign employees about FCPA requirement compliance including on the red flags signaling possible compliance problems;

–sharing with client employees lessons learned from prior situations involving the FCPA.

The long term goal is to work toward making you,  the fraud examiner,  an equal partner  with the corporate compliance and legal functions on the FCPA compliance team; you can help clients design better policies and procedures, develop a more robust risk assessment framework and stronger controls and build your own practice while playing a vital role in the risk based approach to FCPA compliance.