FCPA Due Diligence. One Size Does Not Fit All. Jeffrey M. Klink, CEO/President Klink & Co., Inc. SCCE, Boston March 24, 2017

Transcription

1 FCPA Due Diligence One Size Does Not Fit All Jeffrey M. Klink, CEO/President Klink & Co., Inc. SCCE, Boston March 24, 2017 What will we cover? FCPA Due Diligence Requirements for Third-Parties Risk v. Check-the-Box Assessing the Third-Party through diligence 2 1

2 What will we cover? Hotlines and other mechanisms for report suspected or actual misconduct Properly funding your organization s compliance initiatives What should you require of the Third-Party? 3 What will we cover? Case examples Improving Internal Controls Monitoring Evolving processes as the organization changes 4 2

3 The Foreign Corrupt Practices Act The FCPA essentially has two parts: One - Anti-bribery. Businesses and individuals under US jurisdiction cannot offer or provide benefits to make corrupt payments to foreign officials to get or keep business Interpreted very broadly by courts, and the DOJ and SEC 5 The Foreign Corrupt Practices Act Two - Books and records/accounting requirements: Issuers (of stock) must keep accurate books and records Issuers must have sufficient internal controls to assure that the books and records of the organization are accurate and fairly reflect the activities of the organization 6 3

4 The Foreign Corrupt Practices Act We care about Third Parties - they create the most risk of bribery and misconduct The history of FCPA enforcement shows that most bribes are funneled through third parties Organizations and individuals must perform due diligence on third parties that assist them in activities outside the United States 7 The Foreign Corrupt Practices Act Who/what are third-parties? Customs brokers, accountants, lawyers, consultants, sales agents, distributors, freight forwarders, lobbyists, contractors, and more The name/designation of the Third-Party doesn t really matter, it is the activities of the Third-Party that matter 8 4

5 The Foreign Corrupt Practices Act Third-Party diligence activities must be risk-based That means focusing upon the Third-Party s country as a starter using Transparency.org to assess whether bribery in the nation where the Third-Party is operating is likely or unlikely That also means analyzing the size and nature of the transaction, and method and amount of Third-Party compensation 9 Risk The best way to understand these FCPA mandates is read: A Resource Guide to the U.S. Foreign Corrupt Practices Act issued by the Department of Justice The concepts are fairly simple, but are often ignored by organizations. In a nutshell: focus on risk, devote resources according to risk, evolve as needed, be prepared to show why you did what you did 10 5

6 Risk As the DOJ Resource Guide notes: A $50 million contract with a government agency in a high-risk country warrants greater scrutiny than modest and routine gifts and entertainment. Similarly, performing identical due diligence on all thirdparties, irrespective of risk factors, is often counterproductive. 11 Risk Assessment One-size-fits-all compliance programs are disfavored Appropriate diligence should be based upon the risks associated with the role of the Third-Party, the country where the Third-Party is operating, whether the Third- Party is working with government officials, and other factors, including payment structures which readily allow for excess monies to be paid to government officials 12 6

7 Bribery is Common in Emerging Markets GDP Growth (Source IMF-2016) 10% or More 6 to 10% 13 DOJ and Third-Party Diligence? Understand qualifications and associations Assess business reputations Relationships with government officials? As red flags emerge, scrutiny must increase Document what you are doing, and why you are doing what you are doing 14 7

8 Third-Party Diligence Why is the Third-Party included? Payment to the Third-Party, market-based, up-front fees? Sent to offshore jurisdictions? How did the Third-Party become involved? Activities of the Third-Party, are they real? 15 Requiring Third-Parties To: Understand and adhere to your code of conduct Agree to an audit Certifying that no misconduct is occurring or will occur Providing information as requested 16 8

9 Due Diligence Methods Have the vendor execute a questionnaire to identify beneficial owners, activities, government registration and tax I.D. numbers, directors, and locations, proper name of company in local language(s) Utilize the executed questionnaire much like one would do with a resume when assessing a job candidate to verify the information (or not) 17 Research Options Simple tools can be effective, check LinkedIn, other social media, to readily identify red flags/cross check the information Database research to identify red flags, including watch listings, sanctions listings, PEP listings, global media, corporate affiliations 18 9

10 Research Options Media research in the local language Site visits. More on this later, but often most important internal control. Can assess whether the vendor is actually a manufacturer, customs broker, lawyer, and suitable Interviews of industry sources 19 Properly Funding? The DOJ and SEC mandate that compliance functions be funded appropriately Compliance funding should be allocated based upon risk Best practice is to avoid having business units dictate diligence fees and practices 20 10

11 Why Hotlines? Hotlines are an important part of all compliance activities, including due diligence Vendors, employees, and others should understand how and when to use the hotline Acts as a vital internal control to prevent, identify, and mitigate bribery, corruption, and vendor collusion 21 Case example: Why Site Visits? Vendor (allegedly a manufacturer) was operating out of a one room office and paid $40 million annually Trading company marked up goods sold to client 50 to 100% Vendor controlled by Senior Plant Manager Bribes paid to Chinese government officials with excess monies 22 11

12 Case example: China labor agency Western businesses in China must utilize labor agencies (Similar to Adecco, Manpower) Labor agencies must be registered with the government and collect the Chinese equivalent of social security funds from employers 23 Case example: China labor agency After hotline calls were made, we found that Social Insurance Funds ( SIF ) being split among employer HR Director/Labor Agency/Government Officials Labor agencies paid corrupt labor bureau officials to ignore SIF required payments No due diligence on labor agencies other than watch lists, sanctions lists, and PEP database research 24 12

13 Case example: South Africa fake invoice Audit revealed potential bribery and fraud schemes Manager conspired with vendor Vendor issued fake invoices Money from invoices used to bribe government inspector 25 Subsidiary Risks Accounting integration Operations in emerging markets often not integrated into SAP or other accounting systems, enabling vendor fraud Other considerations: Ethics training for all employees and vendors in certain higher-risk markets 26 13

14 Woody Allen and Compliance In the Academy Award winning film Annie Hall, Woody Allen s character said that relationships were like sharks, if they don t move forward they die ( What we got here is a dead shark ) Compliance is like relationships, if you don t change how you do things as you grow the business, move into new markets, add products, retain Third-Parties, you will end up with the FBI at your door 27 Evolution If your company was previously manufacturing primarily in Europe, and North America, and now is going to start making things in India and China, where bribery and corruption are much more common, compliance must change and quickly 28 14

15 Monitoring Continual review of watch lists, sanctions, and other easy to use tools Audit activities on Third-Parties (exercise your right to audit) Additional risk-based due diligence over the course of time 29 Conclusion Third-Party diligence must be based upon risk analysis Third-Party diligence includes research on the targets, but also analysis of the role, payment, and activities of the targets Other compliance tools, including hotlines, training, and audits, are vital parts of the process 30 15

16 Questions? Jeffrey M. Klink Klink & Co., Inc. Tel: