Categories
Innovation in Compliance

2023 Global Business Ethics Survey: Part 2 – Addressing Workplace Misconduct

The Global Business Ethics Survey (GBES) conducted by the Ethics & Compliance Initiative (ECI) provides valuable insights into workplace ethics and compliance from the perspective of employees. Tom Fox recently had the opportunity to visit with ECI CEO Pat Harned on the 2023 GBES. This survey has become a reliable benchmark for organizations to compare their workplace culture with third-party research, allowing them to identify areas for improvement and address potential risks.

Over the past 30 years of GBES research, ECI has identified and proven that certain “outcome” metrics are indicative of the well-being of workplaces from an ethics & compliance perspective. In this, the largest and latest update to the GBES body of research, employees in 42 countries around the world told us that there is reason for concern. In Part 2 of a five-part podcast,  we consider addressing workplace misconduct.

Pat’s views on workplace misconduct have been shaped by her belief in the importance of a strong relationship between employees and their supervisors, which she sees as crucial to encouraging reporting of misconduct and ensuring satisfaction with the outcome. She advocates for training managers to respond supportively to reports and emphasizes the need for organizations to educate employees on the importance of reporting misconduct internally rather than resorting to social media or external agencies. With her extensive research and expertise, Harned has made significant contributions to promoting ethical practices in the workplace. Join Tom Fox and Pat Harned as they delve deeper into this topic on the 2023 GBES podcast.

Key Highlights:

  • Increasing Rates of Workplace Misconduct and Managerial Response
  • Global Reporting Trends in Corrupt Countries
  • The Impact of Supportive Managers on Reporting

Join us in Part 3, where we consider some disturbing findings on retaliation.

Resources

ECI

2023 Global Business Ethics Survey

Blog Post on the 2023 GBES, Part 2

Categories
Blog

Albemarle FCPA Enforcement Action: Part 5 – Lessons Learned

Over the past several blog posts, I have been exploring the Albemarle FCPA enforcement action.  We have explored in some detail the DOJ Non-Prosecution Agreement (NPA) and the SEC Administrative Order(Order). In this final blog post on the series, I want to suss out some lessons for the compliance professional.

Consequence Management

When Kenneth Polite announced the Pilot Program in conjunction with the 2023 Evaluation of Corporate Compliance Programs (ECCP), the focus was largely on clawbacks. However, the relevant section in the ECCP was entitled “Consequence Management,” indicating a broader focus on both incentives to do business ethically and in compliance as well as disincentives. The ECCP asked a series of questions:

  • Has the company considered the impact of its financial rewards and other incentives on compliance?
  • Has the company evaluated whether commercial targets are achievable if the business operates in a compliant and ethical manner?
  • What role does the compliance function have in designing and awarding financial incentives at senior levels of the organization?
  • How does the company incentivize compliance and ethical behavior? What percentage of executive compensation is structured to encourage enduring ethical business objectives?
  • Are the terms of bonus and deferred compensation subject to cancellation or recoupment, to the extent available under applicable law, in the event that non-compliant or unethical behavior is exposed before or after the award was issued?
  • Does the company have a policy for recouping compensation that has been paid where there has been misconduct?
  • Have there been specific examples of actions taken (e.g., promotions or awards denied, compensation recouped, or deferred compensation canceled) as a result of compliance and ethics considerations?

The NPA noted that Albemarle engaged in holdbacks, as they did not pay bonuses to certain employees involved in the conduct or those who had oversight. The NPA stated, “The Company withheld bonuses totaling $763,453 during its internal investigation from employees who engaged in suspected wrongdoing.” The illegal conduct involved those who “(a) had supervisory authority over the employee(s) or business area engaged in the misconduct; and (b) knew of, or were willfully blind to, the misconduct.” The significance of this effort was vital as it qualified Albemarle for an additional fine reduction of a dollar-for-dollar credit of the amount of the withheld bonuses under the Criminal Division’s March 2023 Compensation Incentives and Clawbacks Pilot Program.

Indeed, Deputy Attorney General Lisa Monaco, in a recent speech, said, “The pilot program also rewards companies that claw back or withhold incentive compensation from executives responsible for misconduct – or attempt to do so in good faith. For every dollar that a company claws back or withholds from an employee who engaged in misconduct – or a supervisor that knew of or turned a blind eye to it – the Department will deduct a dollar from the otherwise applicable penalty that the resolving company would pay.”

She specifically cited the Albemarle FCPA resolution, where “the company received a clawback credit for withholding bonuses of employees who engaged in misconduct. Not only did Albemarle keep the bonuses that would have gone to wrongdoers, but the company also received an offset against its penalty for the same amount. That’s money saved for Albemarle and its shareholders – and a concrete demonstration of the value of clawback programs.”

 Remediation During Investigation

The NPA cited several remedial actions by the company that helped Albemarle obtain the superior result in terms of the discounted fine and penalty. These steps were taken during the pendency of the DOJ investigation so that when the parties were ready to resolve the matter, Albemarle had built out an effective compliance program and had tested it. The NPA provided that Albemarle:

  • Strengthening its anti-corruption compliance program by investing in compliance resources, expanding its compliance function with experienced and qualified personnel, and taking steps to embed compliance and ethical values at all levels of its business organization;
  • Transformed its business model and risk management process to reduce corruption risk in its operation and to embed compliance in the business, including implementing a go-to-market strategy that resulted in eliminating the use of sales agents throughout the Company, terminating hundreds of other third-party sales representatives, such as distributors and resellers, and shifting to a direct sales business model;
  • Provided extensive training to its sales team and restructured compensation and incentives so that compensation is no longer tied to sales amounts;
  • Used data analytics to monitor and measure the compliance program’s effectiveness and
  • We are engaged in continuous testing, monitoring, and improvement of all aspects of its compliance program, beginning almost immediately following the identification of misconduct.

Two of the factors are relatively new and certainly are noteworthy for the compliance professional. The first is the change in the company’s approach to sales and their sales teams. Obviously, it was corrupt third-party agents that brought the company to such FCPA grief. Many of the quotes in the NPA and Order make it clear that Albemarle executives had an aversion to paying bribes but had greater moral flexibility when a third-party agent was involved. This led to the company moving away from third-party agents to a direct sales force.

Moving to a direct sales force does have its risks, which must be managed, but those risks can certainly be managed with an appropriate risk management strategy, monitoring of the strategy, and improvement; those risks can be managed. Yet there is another reason, and more importantly, a significant business reason, to move towards a direct sales business model. Every time you have a third-party agent or anyone else between you and your customer, you risk losing that customer because your organization does not have a direct relationship with the customer. By having a direct sales business model, your organization will have a direct relationship with your customer and, therefor, the ability to develop it further.

The NPA also specifically called out the Company’s use of data analytics in two ways. The first was to monitor the Company’s compliance program, and the second was to measure the compliance program’s effectiveness. While this language follows a long line of DOJ pronouncements, starting with the 2020 Update to the Evaluation of Corporate Compliance Programs, about the corporate compliance functions’ access to all company data, this is the first time it has been called out in a settlement agreement in this manner. Moreover, although not specifically tied to the lack of a required corporate Monitor, it would appear that by using data analytics, Albemarle was able to satisfy the DOJ requirement for implementing controls and then effectively testing them throughout the pendency of the DOJ investigation.

Internal Controls Over Commission Increases

According to the SEC Order, the Company failed to devise and maintain a sufficient system of internal accounting controls with respect to commission rates and deviations from contracted rates. In other words, even though there were internal controls in place for the setting of third-party agents’ commissions, they could be overridden at will. The Order concluded by noting, “As a result, sales personnel were able to increase agents’ commission rates in multiple countries – including Vietnam, India, China, and UAE – despite certain Albemarle personnel having knowledge of red flags indicating the agents would use a portion of the commission to make bribe payments to obtain contracts, influence tender specifications, or obtain nonpublic information concerning competitors’ bids.”

Every compliance professional should review their company’s controls over agents’ commission rates to make sure the business unit personnel alone cannot raise commission rates. While business units can always make the business case, this enforcement action drives home the message that the compliance function is not ‘one and done’ when an agent is approved but must be monitored throughout the third-party relationship lifecycle. Any requested change to a commission rate must go through the same analysis and approval process as the original approval.

Timely Self-Disclosure

There was a significant discussion in the NPA around Albemarle’s voluntary self-disclosure to the DOJ. However, NPA noted that “the disclosure was not “reasonably prompt” as defined in the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy and the U.S. Sentencing Guidelines.” The NPA reported that Albemarle learned of allegations regarding possible misconduct in Vietnam approximately 16 months before disclosing it to the DOJ. Interestingly, the SEC Order only stated, “Albemarle made an initial self-disclosure to the Commission of potential FCPA violations in Vietnam following its completion of an internal investigation of such conduct and, at the same time, self-reported potential violations it was investigating in India, Indonesia, and China. Albemarle later self-disclosed to the Commission potential violations in other jurisdictions as part of an expanded internal investigation.”

This meant the self-disclosure “was not within a reasonably prompt time after becoming aware of the misconduct in Vietnam,” and it means that Albemarle did not meet the standard for voluntary self-disclosure under the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy. While the DOJ “gave significant weight” to the Company’s voluntary, even if untimely, disclosure of the misconduct, it is undoubtedly cautionary.

What the DOJ wants is self-disclosure as soon as possible. One only needs to recall the case of Cognizant Technologies, where the company received a complete Declination where there were allegations of C-Suite involvement in the bribery schemes. This Declination was provided in large part because the company made its self-disclosure only two weeks after the information filtered up to the Board of Directors. While Cognizant Technologies may be the gold standard, it shows that if a company timely self-discloses, it can be considered for a full Declination.

The Albemarle FCPA resolution documents are chocked full of solid information that every compliance professional can use in the future. They are well worth a deep dive—finally, a kudos to Albemarle for obtaining this superior result.

Categories
Data Driven Compliance

Data Driven Compliance: Sheetal Parikh on Banking Integration: Connecting Banks and Fintech Companies

Are you struggling to keep up with the ever-changing compliance programs in your business? Look no further than the award-winning Data Driven Compliance podcast hosted by Tom Fox. It features an in-depth conversation about the uses of data and data analytics in compliance programs. Data Driven Compliance is back with another exciting episode. The intersection of law, compliance, and data is becoming increasingly important in the world of cross-border transactions and mergers and acquisitions. Today, we look at the intersection of data analytics, banking, and compliance with Sheetal Parikh.

Sheetal Parikh is a seasoned attorney with over 18 years of experience in the financial services industry, currently serving as the Associate General Counsel and VP of Compliance at Treasury Prime. Drawing from her extensive background in securities and commodities litigation and regulatory work, Parikh advocates for a collaborative approach to integrating Fintech and banks, with a strong emphasis on compliance. She believes that Treasury Prime’s role is not to offload compliance functions but to provide banks and Fintech with a toolkit and set of tools, both through technology and expertise, to establish a compliance program that suits their specific risk profile and use case. Parikh also foresees a future where fintech companies offering banking products and services will face more direct oversight and regulation, as they are currently regulated indirectly through banks. Join Tom Fox and Sheetal Parikh on this episode of the Data Driven Compliance podcast to delve deeper into this topic.

Highlights Include:

  • Banking Integration and Compliance Solutions
  • Responsible Innovation in the Banking Industry
  •  Consequences of Regulatory Non-Compliance
  • Regulating Fintech Companies as Banks

 Resources:

Sheetal Parikh on LinkedIn

Treasury Prime

 Tom Fox 

Connect with me on the following sites:

Threads

Instagram

Facebook

YouTube

Twitter

Categories
Everything Compliance - Shout Outs and Rants

Everything Compliance: Episode 124 – Shout Outs and Rants, The Albemarle Edition

Welcome to the only roundtable podcast in compliance as we celebrate our second century of shows. In this episode, we have the quartet of Jonathan Armstrong, Matt Kelly, and Tom Fox, with guests Kristy Grant-Hart and Karen Moore joining us on this episode of our fan-fav Shout Outs and Rants section.

1. Matt Kelly rants about former House Speaker Kevin McCarthy and the GOP’s refusal to govern create chaos.

2. Karen Moore rants about lawyer hourly rates.

3. Tom Fox shouts out to the MLB playoffs and former Monster of the Midway Dick Butkus.

4. Jonathan Armstrong shouts out to Kortney Nordrum, who, on an SCCE panel, discussed a data breach and how it impacted her organization.

5. Kristy Grant-Hart shouts out to My Crazy Ex-Girlfriend.

The members of the Everything Compliance are:

•       Jay Rosen– Jay is Vice President of Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com

•       Karen Woody – One of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu

•       Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com

•       Jonathan Armstrong –is our UK colleague, who is an experienced data privacy/data protection lawyer with Cordery in London. Armstrong can be reached at jonathan.armstrong@corderycompliance.com

•       Jonathan Marks can be reached at jtmarks@gmail.com.

•       Special Guest Kristy Grant-Hart is the founder of Spark Consulting.

The host and producer, ranter (and sometimes panelist) of Everything Compliance is Tom Fox, the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the Compliance Podcast Network.

Categories
Daily Compliance News

Daily Compliance News: October 10, 2023 – The CEOs Misbehaving Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News. All from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Stories we are following in today’s edition:

  • Claudia Goldin won a Nobel in Economics. (WaPo)
  • Misbehaving CEOs hurt the entire company. (FT)
  • Will Elon Musk lose to the SEC this time? (Reuters)
  • The US is trying to crack down on sanctions evaders. (WSJ)
Categories
Principled Podcast

Season 10 Episode 5 – Approaching the “S” and “G” in Corporate ESG Strategy

What you’ll learn on this podcast episode

A lot of press coverage tends to conflate environmental, social, and governance initiatives exclusively with environmental stewardship and climate change. While the “E” of ESG is certainly important, organizations that overlook the “S” and “G” could open themselves up to other crises, such as human rights violations and data breaches. In this episode of LRN’s Principled Podcast, host Susan Divers discusses best practices for integrating governance and social impact considerations into ESG strategy with Sony Group’s Global Ethics & Compliance Strategy Leader, Kathleen Franklin.

Guest: Kathleen Franklin

Kathleen Franklin – Grayscale

Kathleen Franklin is the Global Ethics & Compliance Strategy Leader for the Sony Group Companies, where she is responsible for promoting a culture of ethics and devising enterprise-wide solutions for critical risk areas. She also acts as the chief compliance officer for Sony Corporation of America and its operating subsidiaries. Prior to joining Sony, Kathleen was a partner and co-chair of the Corporate Governance Group for Boies, Schiller and Flexner, LLP.

Kathleen is also a member of the board of directors of Bank OZK (NASDAQ:OZK) where she serves on the Risk Committee. Bank OZK is headquartered in Little Rock, Arkansas, conducts banking operations through 240 offices in Arkansas, Georgia, Florida, North Carolina, Texas, South Carolina, New York and California, and has approximately 27 billion in assets.

Kathleen graduated magna cum laude from Siena College, Loudonville, New York, where she received a Bachelor of Science degree in Business Administration. She graduated magna cum laude from Albany Law School of Union University and earned an LL.M in Taxation from New York University School of Law.

Host: Susan Divers

Headshot_Susan_Divers_S7E18_Principled_Podcast

Susan Divers is a senior advisor with LRN Corporation. In that capacity, Ms. Divers brings her 30+ years’ accomplishments and experience in the ethics and compliance area to LRN partners and colleagues. This expertise includes building state-of-the-art compliance programs infused with values, designing user-friendly means of engaging and informing employees, fostering an embedded culture of compliance and substantial subject matter expertise in anti-corruption, export controls, sanctions, and other key areas of compliance.

Prior to joining LRN, Mrs. Divers served as AECOM’s Assistant General for Global Ethics & Compliance and Chief Ethics & Compliance Officer. Under her leadership, AECOM’s ethics and compliance program garnered six external awards in recognition of its effectiveness and Mrs. Divers’ thought leadership in the ethics field. In 2011, Mrs. Divers received the AECOM CEO Award of Excellence, which recognized her work in advancing the company’s ethics and compliance program.

Mrs. Divers’ background includes more than thirty years’ experience practicing law in these areas. Before joining AECOM, she worked at SAIC and Lockheed Martin in the international compliance area. Prior to that, she was a partner with the DC office of Sonnenschein, Nath & Rosenthal. She also spent four years in London and is qualified as a Solicitor to the High Court of England and Wales, practicing in the international arena with the law firms of Theodore Goddard & Co. and Herbert Smith & Co. She also served as an attorney in the Office of the Legal Advisor at the Department of State and was a member of the U.S. delegation to the UN working on the first anti-corruption multilateral treaty initiative.

Mrs. Divers is a member of the DC Bar and a graduate of Trinity College, Washington D.C. and of the National Law Center of George Washington University. In 2011, 2012, 2013 and 2014 Ethisphere Magazine listed her as one the “Attorneys Who Matter” in the ethics & compliance area. She is a member of the Advisory Boards of the Rutgers University Center for Ethical Behavior and served as a member of the Board of Directors for the Institute for Practical Training from 2005-2008.

She resides in Northern Virginia and is a frequent speaker, writer and commentator on ethics and compliance topics. Mrs. Divers’ most recent publication is “Balancing Best Practices and Reality in Compliance,” published by Compliance Week in February 2015. In her spare time, she mentors veteran and university students and enjoys outdoor activities.

Categories
Blog

Global Business Ethics Survey: Part 2 – Addressing Workplace Misconduct

The Global Business Ethics Survey (GBES) conducted by the Ethics & Compliance Initiative (ECI) provides valuable insights into workplace ethics and compliance from the perspective of employees. I recently had the opportunity to visit with ECI CEO Pat Harned on the 2023 GBES. This survey has become a reliable benchmark for organizations to compare their workplace culture with third-party research, allowing them to identify areas for improvement and address potential risks. It is Part 2 of a five-part blog post series on the 2023 GBES. We look at Key Findings 2 and 3.

Key Finding: 2 – Workplace misconduct is at an all-time high.

Workplace misconduct is a prevalent issue that organizations worldwide must address. According to the 2023 GBES, a staggering 65% of employees have witnessed violations of company standards or the law within the past year. This alarming statistic highlights the urgent need for effective strategies to tackle workplace misconduct.

One crucial aspect of addressing workplace misconduct is the role of managers. Managers play a pivotal role in the reporting and resolution process, as their supportive response can greatly impact the success of resolving misconduct. Research has shown that employees are more likely to report misconduct if they have a good working relationship with their supervisor. Therefore, organizations must prioritize training managers to recognize and respond supportively to reports.

Creating a culture of trust and accountability is essential in addressing workplace misconduct. Trust is a fundamental element that permeates an organization, impacting employees’ willingness to report misconduct. When employees trust their managers and feel valued as individuals, they are more likely to come forward with reports. On the other hand, a lack of trust can lead to underreporting and perpetuation of misconduct.

Educating employees about the importance of reporting misconduct is crucial. Organizations need to provide clear channels for reporting and ensure employees know where to go when they witness wrongdoing. By messaging to employees that reporting to management is essential and productive, organizations can encourage employees to come forward and help solve problems internally. This approach is more effective than resorting to social media or external agencies, which may not contribute to long-term workplace improvement.

Key Finding: 3 – Globally, reporting of observed misconduct is at a record high.

The global landscape of misconduct reporting varies significantly. Countries like India, Egypt, Nigeria, Bolivia, and Kenya have high reporting rates, indicating a willingness among employees to report misconduct. However, high reporting rates can also lead to high retaliation rates, as observed in some of these countries. In contrast, countries like Chile, Canada, South Korea, Japan, and Hungary have lower reporting levels, possibly due to cultural factors and employees’ perceptions of authority.

To address workplace misconduct effectively, organizations must improve the reporting process, train managers to respond supportively, and foster a culture that values trust and accountability. It is crucial to strike a balance between encouraging reporting and ensuring the safety of employees who come forward. Organizations should also consider the impact of their decisions on public trust in business, as misconduct erodes organizational cultures and can damage reputations.

In conclusion, addressing workplace misconduct through reporting and managerial support is a complex task that requires careful consideration of various factors. Organizations must prioritize training managers, fostering trust, and educating employees about the importance of reporting. By creating a culture that values accountability and supports those who come forward, organizations can effectively address workplace misconduct and promote a healthier and more ethical work environment.

Join us in Part 3, where we consider the disturbing findings of retaliation.

For more information, check out the ECI podcast series with Pat Harned discussing the GBES here.

Categories
Riskology

Riskology by Infortal Episode 11: The New Normal – Geopolitical Risks Reshaping Global Business

In this inaugural episode of Riskology by Infortal, hosts Chris Mason, Candice Tal and Dr. Ian Oxnevad discuss their approach to the podcast, and share a glimpse into the diverse range of topics they will be delving into. Riskology blends business, geopolitics, and intelligence to demystify the 21st century economic world and explore how geopolitical risk directly impacts your bottom line. 

Infortal Worldwide is a global risk management and investigations firm that specializes in helping businesses navigate complex risk landscapes. The company’s focus extends to various areas, including economics, politics, and geopolitical risk. By delving into these interconnected realms, Infortal Worldwide aims to provide clients with comprehensive insights that empower them to make informed decisions, especially in critical areas such as mergers and acquisitions, private equity investments, and other strategic moves.

 

You’ll hear Candice, Chris and Ian discuss:

  • Infortal Worldwide is a global risk management and investigations firm with a strong 38-year track record. The firm operates in 160 countries around the world, serving a diverse range of industry sectors, with a primary focus on large companies, upper-middle-market entities, and large-cap corporations.
  • In addition to geopolitical risk, Infortal specializes in providing solutions to real-world problems faced by clients. Their expertise encompasses issues such as sanctions risk, potential violations of the Foreign Corrupt Practices Act (FCPA), identifying bad actors, and addressing reputational damage that can expose companies to significant risks.
  • Infortal helps companies mitigate global risk exposures, such as financial losses, reputational damage, and legal liability. They provide a comprehensive risk management solution with tools and services to identify, assess, and manage risks.
  • The risk environment encompasses micro risks at the individual and business level, as well as macro risks at the country and regional level. The focus is on understanding immediate risk exposure from individuals and businesses, up to broader country-level and regional risks.
  • Infortal recognized the significant challenges that companies face when engaging with international partners, suppliers, and stakeholders. The company aims to address the gap in discussions around geopolitical risk and provide education on the multifaceted challenges that businesses face today.
  • Larger companies often face challenges in disseminating key information about geopolitical risks effectively. Information tends to become siloed within risk teams, making it difficult for decision-makers to access and act upon relevant intelligence. To unlock the power of geopolitical risk analysis, it is necessary to break down information silos and ensure that critical insights reach key decision-makers.
  • Geopolitical risk analysis is more than just identifying potential problems and challenges. When information flows effectively within an organization, companies can use geopolitical risk analysis to uncover opportunities. This proactive approach allows organizations to strategically navigate the business landscape, positioning themselves advantageously against competitors in the event of unforeseen challenges.
  • The current geopolitical risk landscape indicates a change in the dynamics of globalization. While globalization is a real and ongoing phenomenon, the traditional framework and relationships that defined it in the past have been significantly disrupted. Key geopolitical players, such as Russia, China, India, and the European Union, are reshaping the global economic landscape, and this transformation presents both challenges and opportunities.
  • While globalization is currently facing challenges and uncertainties, it is also a critical juncture with many opportunities. Strategic countries such as India and Turkey, as well as those straddling various global dynamics, will play a pivotal role in shaping the future. The US, with its strong fundamentals and economic influence, remains a major player in determining the course of global developments.

 

KEY QUOTES

“The area that we specialize in, in addition to geopolitical risk, is finding solutions to real world problems that our clients face. And that could be anything from sanctions risk, to potential FCPA violations, to finding bad actors [and] con artists, to businesses that are operating with reputational damage and create exposures for the companies that they work with.” – Candice Tal 

 

“And that’s the issue or the challenge of key information getting siloed within organizations. … It’s sometimes hard for all of the right information to come from the risk teams and end up in the right circles within the organization so that the key decision makers can actually act on the information and the intelligence that’s there. In the case of geopolitical risk, what we’re finding is that information is not making its way to the right individuals within the organizations.” – Chris Mason

 

“If you look at the geopolitical risk landscape today, it can be really summed up as: globalization ain’t what it used to be. And what that really means is that if there’s geopolitical stability and stability within major countries, then the global economy is going to work very well. But because of a number of issues that have happened over the past few years, some of it relates to COVID, some of it relates to just the fact that it’s not a unipolar system anymore. But what that means is that this is not the Cold War, this is not the post Cold War era in which we had peace and prosperity and the spreading of liberal democracy. If you sum all that up, we’re actually going in reverse.” – Ian Oxnevad

 

Resources

Infortal Worldwide 

Candice Tal on LinkedIn | Twitter

Ian Oxnevad on LinkedIn

Chris Mason on LinkedIn

Categories
Corruption, Crime and Compliance

Catching Up with California and State Data Privacy Laws

California’s data privacy regulations, primarily embodied in the California Consumer Privacy Act (CCPA) and its extension through the California Privacy Rights Act (CPRA), constitute a pioneering and influential framework. These regulations, effective from 2018 and further strengthened in 2020, set a standard for data protection not only within the state but also across the national and global economy. In this episode of Corruption, Crime and Compliance, Michael Volkov explores the nuances of the CCPA and CPRA, and the evolving data privacy landscape.

You’ll hear Michael talk about:

  • The lack of a federal data privacy law in the United States has led to a complex patchwork of state laws. Businesses are faced with the challenge of navigating these varied regulations, which contributes to compliance complexities.
  • California, through the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), is a leader in data privacy regulation in the United States, with implications for both the national and global economy. The CPRA, enacted in 2020, establishes the California Privacy Protection Agency (CPPA) to enforce the law robustly.
  • The CPRA introduces critical changes, including: 
  • Protection of employee and business-to-business personal information, which is now subject to the same privacy protections as consumer personal information. 
  • Enhanced consumer rights, such as the right to access, delete, and correct their personal information, and the right to opt out of the sale of their personal information.
  • Companies are now obligated to implement reasonable security precautions and undergo annual cybersecurity audits and risk assessments.
  • In addition to California, other states such as Virginia, Colorado, Utah, Iowa, and Connecticut have also enacted data privacy laws that echo the GDPR. Businesses must stay up-to-date on evolving compliance requirements and adapt their systems accordingly.
  • Compliance issues comprise risk assessments, impact assessments, adherence to data breach requirements, and compliance with notification standards. Companies are developing systems based on the most stringent set of laws to guarantee compliance.

 

KEY QUOTES

“We have a patchwork of laws that apply in the United States. Unfortunately, we continue to suffer from the absence of a federal data privacy and breach notification law. Congress has tried for years to broker a deal here, but it has never been able to overcome strong lobbying forces. Whether it’s high tech trial lawyers, law enforcement, or other gadflies, the public continues to suffer.” – Michael Volkov

 

“Many commentators have suggested that California’s data privacy laws and regulations are starting to look closer and closer to the EU’s GDPR regime.” – Michael Volkov

 

“To me, we’re getting into a more strict regulation. We already have, under the California Consumer Privacy Act, a requirement to have on your website: an ‘opt out’ in terms of any information that you may provide to a website, that it can’t be used by the entity for sharing or selling or whatever consumer products purposes. So keep tabs on the California events.” – Michael Volkov

 

Resources

Michael Volkov on LinkedIn | Twitter

The Volkov Law Group

Categories
Blog

Albemarle FCPA Enforcement Action: Part 4 – Internal Control Failures

Albemarle Corporation (Albemarle) recently agreed to pay more than $218 million to resolve investigations by the U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) into violations of the Foreign Corrupt Practices Act (FCPA) stemming from Albemarle’s participation in corrupt schemes to pay bribes to government officials in multiple foreign countries. We have explored in some detail the DOJ Non-Prosecution Agreement (NPA). Today, I wanted to consider specifically some of the company’s failures, which were detailed in the SEC Administrative Order (Order).

Corporate Structure

At the time of the violations, Albemarle had three business units “corresponding to its primary product markets: catalysts (which contained the Refining Solutions business), lithium, and bromine. The Refining Solutions business developed and sold catalysts to oil refineries through sales offices and intermediaries around the world. The President of the Refining Solutions GBU reported directly to Albemarle’s Chief Executive Officer. Albemarle centrally coordinated its compliance, legal, finance, contracting, and internal audit functions.”

The Refining Solutions business was further broken down into four operating units. It included “Albemarle Catalysts Company B.V. in the Netherlands (“Albemarle Netherlands”); Albemarle Singapore Pte. Ltd in Singapore (“Albemarle Singapore”); Albemarle Chemicals (Shanghai) Co. Ltd. in China (“Albemarle China”); and Albemarle Middle East FZE in the UAE (“Albemarle Middle East”) (each, an “Albemarle Subsidiary,” and together, the “Albemarle Subsidiaries”). Albemarle also used sales agents to sell refinery catalysts in Vietnam, India, Indonesia, China, and the UAE.” A most exciting nugget detained in the Order revealed that “the sales agents in Indonesia and China were also retained as distributors.”

Finally, the Company “exercised control over the sales activities of the Albemarle Subsidiaries, which acted as agents for Albemarle when retaining agents to sell catalysts globally. Albemarle officers served on the Albemarle Subsidiaries’ boards of directors and held signatory authority over bank accounts at local branches of both U.S. and non-U.S. banks, used to pay sales intermediaries in the relevant countries. Albemarle sold refinery catalysts globally through agents and distributors approved by Albemarle sales, business, legal, compliance, and finance personnel and management.” 

Internal Audit-Reporting Deficiencies

In perhaps the most damning phase of the Order, the SEC detailed how the Company’s internal audit function had raised the issue of insufficient controls multiple times, stating “Despite the known risks posed by Albemarle’s reliance on third-party sales agents and distributors in the sale of catalyst products to state-owned and -controlled oil refineries, Albemarle failed for many years to institute sufficient compliance systems and devise and maintain a sufficient system of internal accounting controls concerning the retention, payment, and oversight of these intermediaries.”

These included a series of internal audit reports in 2013, 2015, and 2016, all of which identified multiple gaps in Albemarle’s internal accounting controls with respect to the Refining Solutions business’s use of intermediaries. These reports set out a series of internal control deficiencies and failures, including that sales agents and distributors were paid:

  1. With incomplete due diligence,
  2. With a lack of executed contracts,
  3. With contracts that lacked required anti-corruption provisions;
  4. At not simply higher than market rates but at rates higher than those provided for by contract.

All of this was done in contravention of Albemarle’s policies and procedures.

Internal Audit-Recommendations

Yet, the internal audit did more than report deficiencies; it also made recommendations. As far back as 2013, the internal audit team recommended that Albemarle establish a comprehensive program specifically to manage and monitor the entire life cycle for intermediaries. The Order noted that “While Albemarle hired compliance personnel, reduced the number of sales agents and distributors without contracts, and implemented software to assist in third-party onboarding and contracting,” it failed to devise and maintain a sufficient system of internal accounting controls with respect to commission rates and deviations from contracted rates. In other words, even though there were internal controls in place, apparently, they could be overridden at will.

The Order concluded by noting, “As a result, sales personnel were able to increase agents’ commission rates in multiple countries – including Vietnam, India, China, and UAE – despite certain Albemarle personnel having knowledge of red flags indicating the agents would use a portion of the commission to make bribe payments to obtain contracts, influence tender specifications, or obtain nonpublic information concerning competitors’ bids.”

Internal Control Failures

The Order detailed a series of internal control failures by the Company across multiple business units in several different countries. The entire story paints a picture of a company that certainly did not have a culture of doing business ethically and in compliance.

In Vietnam, the Company “Agent was hired in 2012 at a 4.25 percent commission rate that Albemarle’s sales representative viewed as high for the region, and Albemarle approved an increase to Vietnam Agent’s commission to 6.5 percent in 2015 despite emails reflecting a high probability additional funds would be used to bribe Vietnamese government officials.” The Order went on to note, “Albemarle’s system of internal accounting controls was insufficient to prevent or detect these improper payments, which Albemarle Singapore falsely recorded as legitimate commissions in books and records that were consolidated into Albemarle’s financial statements.”

In India, multiple red flags emerged during Albemarle’s due diligence process. The India Agent claimed that its board of directors included two former senior India State-Owned Customer officials and Albemarle already had a sales agent in India. An Albemarle Subsidiary regional director alerted an Albemarle sales executive who was employed directly by Albemarle and based in the United States, of his understanding, based on a July 2009 call with an India Agent, that the agent would make corrupt payments to keep Albemarle in the bidding process. Additionally, “Albemarle increased India Agent’s commission in 2010 (via a backdated agreement) and again in 2012. A July 2014 email from an Albemarle Europe sales executive to India Agent described the commissions as “extremely high” and “far from any possible realistic justification.” Finally, “The agreement called for payment of a three percent commission to India Agent, a rate three times higher than that paid to Albemarle’s existing agent for India.”

In Indonesia, the Agent requested a commission increase expressly to fund bribes to Indonesia State-Owned Customer officials. Moreover, “Although Albemarle sales personnel declined to increase the commission and reportedly told Indonesia Agent that Albemarle did not conduct business via bribery, they did not report concerns to their supervisors, Legal, or Compliance personnel or take any steps to terminate the agency relationship. Instead, Albemarle made contractual commission payments and certain extra-contractual expense reimbursements to Indonesia Agent throughout 2013 in connection with a contract Indonesia State-Owned Customer awarded to Albemarle in April 2013. A portion of these funds was used to pay bribes.  Albemarle’s system of internal accounting controls was insufficient to prevent or detect the improper payments made to and through Indonesia Agent, which Albemarle Singapore falsely recorded as legitimate commissions and business expenses in books and records that were consolidated into Albemarle’s financial statements.”

In China, although business unit employees knew of the proposed agent’s familial relationship with the relevant government official, they failed to report it internally. Then, the Company’s compliance department’s due diligence revealed that China Agent had no website and was authorized to do business only a few weeks before China Agent’s Principal first met with Albemarle personnel. Despite these red flags, Albemarle retained the China Agent. When an Albemarle business director questioned China Agent’s compensation as “high,” an Albemarle Netherlands business director replied that he anticipated large returns on the contract. In February 2014, Albemarle agreed to increase the China Agent’s commission if it obtained higher prices from the customer. In August 2016, Albemarle China further increased the commission rate.

Finally, in the UAE, the Company did not conduct due diligence on the agent until after the agent agreement had been executed. After this initial contract was executed, a second agent was also contracted for illicit purposes. The deal with the original Agent was amended in 2013 to increase its commission by one percent — the same amount the Agent agreed to pay to the second agent, “UAE Consultant.” The UAE Consultant provided no discernable services other than conveying confidential tender evaluations and competitors’ bids obtained from the refinery and the EPC firm. In addition to commissions that Albemarle paid to the agent, Albemarle paid the agent undefined “administrative charges” equal to ten percent of its invoices for customs clearance and other non-sales services.

The SEC Order lays out in greater detail how the Company’s internal controls were circumvented. It also detailed some of the specific language in emails, which cleared denoted coded language around the payment of bribes.

Join us tomorrow to review some of the key lessons learned.