Lessons Learned

Recent enforcement activities, both in the United States and internationally, show that companies with foreign operations cannot treat payoffs to foreign officials as the “cost of doing business.” There has been a significant spike in FCPA investigations and prosecutions by the Department of Justice and the SEC in recent years — from nine in 2003 to 91 in 2008. As the number of FCPA enforcements and the size of the penalties levied continue to grow, knowing how to mitigate the risks and put in place effective anti-corruption controls is critical. It is not enough for a company to point to the mere existence of a compliance program — regulators and prosecutors also are looking for evidence of an effective program.

Typically, an effective compliance program will include:

• Anti-bribery compliance standards and procedures, including regular and comprehensive auditing, as well as procedures for reporting potential violations.
• Identification of an authoritative senior company officer who is responsible and accountable for anti-bribery compliance.
• A risk assessment of projects involving business with other countries.
• Extensive due diligence on projects involving business with other countries.
• A communication strategy, including training programs for employees and officers.
• Monitoring and review of relationships with foreign governments and business partners to establish and document compliance with anti-bribery legislation.

Auditors can help combat various forms of corruption by:

• Performing corruption exposure risk assessments.
• Identifying gaps between risk and anti-corruption controls.
• Advising management on setting up a sustainable compliance office (e.g., definition of roles and assistance with training materials for management and staff).
• Developing issue-resolution mechanisms and a communication strategy for reporting to management, the board of directors, and other stakeholders regarding anti-corruption activities.
• Designing and periodically testing and evaluating the effectiveness of anti-corruption controls, including remediation, where necessary.

When performing these tasks, auditors should consider several questions:

• Controls. What current controls, due diligence, and training programs are in place? Are they being taken seriously? Do employees follow these procedures? What is the level of engagement of senior management? What is the history of compliance in this area?
• Locale. How are those countries ranked on indices, such as Transparency International’s Corruption Perceptions Index? What is the level of political stability and democracy in these locations? Does a significant risk or vulnerability exist for regime change? How does legislation from potentially aggressive anti-bribery regimes, such as the United States or the host country, apply to business activities?
• Government interaction. What are the government interaction points through all stages of business operations?What permits and licenses are required? Are the entities dealt with government-owned or controlled? How and with whom are concession or royalty agreements negotiated? Are goods, equipment, and heavy machinery imported for operations, and how are customs authorities dealt with in that process?
• Employees. Which executives or employees have responsibilities for dealing with government officials or authorizing related expenditures? How are they compensated? What financial incentives exist for individuals within the company to engage in bribery of government officials?
• Third parties. What kind of agents and consultants are retained to assist in developing and doing business in countries, and do they interact with government officials? Are third parties (e.g., lawyers, customs brokers, and joint venture partners) used, and if so, how are they screened, approved, retained, paid, and monitored?