Categories
FCPA Compliance Report

Oracle FCPA Enforcement Action

In this episode, I take on a solo pod to discuss and consider the Oracle FCPA enforcement action brought by the Securities and Exchange Commission.

Key areas we discuss on this podcast are:

  • Background facts.
  • Same facts in same country?
  • Failure of a paper program.
  • The need for data analytics.
  • Where is the DOJ?
  • What are the lesson learned going forward?

 Resources

For a White Paper on the Oracle FCPE enforcement action, email tfox@tfoxlaw.com

Categories
Daily Compliance News

October 10, 2022 the Data Privacy Edition

In today’s edition of Daily Compliance News:

  • Weinstein LA trial takes on new urgency. (NYT)
  • Twitter/Musk case study. (Reuters)
  • US tries to fulfill data privacy agreement with EU. (WSJ)
  • Met creates an anti-corruption unit. (BBC)
Categories
Blog

Fighting Transparency and Whistleblowers

We sadly had two more examples of how companies are fighting transparency and the light of day through actions taken against whistleblowers. With these two examples we see once again how businesses which say they have a speak up culture and an open-door policy in writing do not seem to follow these prescriptions in practice. One comes from the world of sports (NBA basketball) and the second involves Exxon Mobil Corporation (Exxon).

If you are any kind of pro basketball fan, you have heard about the ‘altercation’ between Golden State Warriors Draymond Green and Justin Poole. Following an initial report of an ‘altercation’ occurring during a practice this week, TMZ released a video of the incident. After some unknown verbal sparring, Poole pushes Green away from him. Green then winds up and coldcocks Poole, knocking him down. Green’s initial response was essentially, I am sorry you are sorry. After the video was released, Green fully apologized and announced he was taking some time off.

What was the Warriors response to all this? According to ESPN, the public airing of the video and ensuing transparency, “has impacted the way the team has been able to move forward from the altercation. “In 32 years, I’ve probably seen 20-plus fights. It should not make it out of our walls,” Kerr said. “When things are kept internally, it’s almost easy to handle,” he continued. “As soon as things are leaked, all hell breaks loose. That affects every single player, coach. … It’s like if you had a camera in your family and there was a family dispute. Would you really want to discuss it with the world? No.”” According to Fox Sports, “the Warriors are taking “every legal course of action” to discover how the video was released to the public.”

For those NBA fans who do not remember, Laker Kermit Washington severely injured Rocket Rudy in 1978 with a similar punch to the face. So, this is not a ‘boys will be boys’ or a hyper competitive player dancing on the edge issue, but a full personal safety at work issue. What do the Warriors want too about it? Apparently not much as Outkick.com wrote, “Warriors general manager Bob Myers discussed the situation on Thursday. He stated that Green’s punishment would be “dealt with internally,” with little expectation for the 10-year veteran to miss any games in the upcoming season as a result. “There’s nothing that warranted the situation yesterday. I want to make that clear. It’s also something we feel like won’t derail our season and that’s with Draymond a part of that,” Myers told reporters.”

In a case from the more traditional corporate world, involving Exxon. The Wall Street Journal (WSJ) reported, “The Labor Department said it found Exxon Mobil Corp. illegally fired two company scientists over suspicions they shared information with The Wall Street Journal about concerns the pair had earlier raised with the company. The department’s Occupational Safety and Health Administration on Friday said Exxon must reinstate the two employees and pay them more than $800,000 in back wages, interest and damages.” In other words, Exxon has been found to have fired two whistleblowers.

The WSJ further noted, “Citing current and former employees, the Journal reported in September 2020 that some staff assigned to the Permian, the most active U.S. oil field, thought Exxon had been overly optimistic about an earlier projection it could increase oil and gas production in the New Mexico and West Texas region to 1 million barrels of oil equivalent per day as early as 2024. The people told the Journal that Exxon had overestimated how quickly it could drill wells there, which they said led the company to overvalue the asset by billions of dollars. Exxon later fired two scientists. The Labor Department determined the firings were prompted by Exxon’s suspicions the pair had brought information to the Journal.”

“Exxon denied the allegations at the time and has repeatedly said it has met and exceeded its drilling targets.” The WSJ went on to note, “Exxon claimed it had fired one of the scientists for mishandling proprietary information and another for “a negative attitude,” job hunting and losing management’s confidence.” Exxon spokesman Casey Norton, as quoted in the WSJ, said, “The terminations in late 2020 were unrelated to the ill-founded concerns raised by the employees in 2019.” Exxon has said that it will appeal.

Interestingly, in 2021, the WSJ “reported the Securities and Exchange Commission launched an investigation following an employee’s whistleblower complaint alleging the company’s overvaluation of the Permian had misled investors. The agency earlier this year closed the investigation and said it would not recommend an enforcement action against Exxon.” Additionally, “A federal judge in Texas dismissed a lawsuit last week brought by Exxon shareholders alleging the company misled investors about the value of its Permian assets. The judge determined the plaintiffs had not shown enough evidence that Exxon executives deliberately defrauded investors. The judge said they can refile the complaint with additional evidence.”

It is not clear if there was new evidence brought forward in this OSHA case that was not available to the SEC or federal district court. Perhaps OSHA found Exxon’s version of events not plausible. Nevertheless, coupled with the Warriors response to the leaking of Green punching a teammate, it seems that corporate America will try to prevent transparency at all costs. Compliance professionals would do well to make sure their organizations not simply welcome whistleblowers but embrace them to prevent fraud, waste and abuse and illegal conduct from moving forward in their organization.

Categories
Sunday Book Review

October 9, 2022 the Dracula edition

In today’s edition of Sunday Book Review:

Dracula by Bram Stoker

Interview with the Vampire by Anne Rice

I am Legend by Richard Matheson

Fevre Dream by George R. R. Martin

Categories
Popcorn and Compliance

Leadership Lessons from Count Dracula

In this episode of Popcorn and Compliance, Tom Fox explores one movie each week from the classic Universal monster movies 1930s to mine it for leadership and compliance lessons this month. For this second entry in this short series, Tom and Richard Lummis join forces to explore the 1931 movie Dracula. Count Dracula is one of the four classic Universal Pictures movie monsters from the 1930s, including the Wolfman, the Mummy, and Frankenstein’s Monster. What sets him apart from these other three? In particular, what is the Dracula brand? Is it fanged teeth and a black cape? Is it the signature Bela Lugosi voice? Is it a bat? In this episode, Richard Lummis and I explore branding for business leaders and discuss the lessons a 21st-century business leader can learn from a 1930s movie character.

Categories
Daily Compliance News

October 8, 2022 the More On Cheating in Chess Edition

In today’s edition of Daily Compliance News:

    • Cohen says only corrupt would take up Trump’s case. (BusinessInsider)
    • Blackrock to take on TX anti-woke investment law. (Reuters)
    • US Grandmaster cheated over 100 times. (WSJ)
    • DOT lays the groundwork for Registry ownership. (WSJ)
Categories
Corruption, Crime and Compliance

Episode 249 – DOJ Issues New Corporate Enforcement Policy

The Biden Administration promised a new, aggressive approach to corporate crime. Well, the Justice Department just delivered a new, comprehensive policy that raises a number of issues, some of which are likely to be controversial. The new policy incorporates reforms announced last October that largely centered on prior corporate criminal and civil records, the appointment of independent compliance monitors, and expanding the review of responsible persons in an internal investigation. The Justice Department’s new Corporate Enforcement Policy (“CEP”), however, expands on earlier policy changes but includes some new and far-reaching reforms intended to increase individual accountability and promote corporate culture through financial incentives and deterrence policies. This last idea is a significant expansion of DOJ’s CEP and is sure to reverberate through the business and compliance community. Chief compliance officers face a new requirement for their companies — creating an effective system of carrots and sticks to punish misconduct and increase rewards for ethical behavior.DOJ’s new CEP also lays the groundwork for further consideration of corporate responsibility for preserving electronic messaging, ephemeral services, and other electronic data. DOJ’s discussion in this area reflects DOJ’s frustration with a corporate internal investigation that omits access to electronic data, especially in those situations where employees use personal devices for business-related communications. The revised CEP provides guidance to prosecutors and the business community to ensure individual and corporate accountability through the evaluation of various factors, including (1) Corporate History of Misconduct; (2) Self-Disclosure and Cooperation; (3) the Strength of a Company’s Compliance Program; (4) the Use and Monitoring of Corporate Monitors (including their selection and scope of a monitor’s work).

Categories
Blog

Oracle: FCPA Recidivist Part 4 – the Comeback and DOJ

After revisiting “Parking in India” from 2012, we return to explore more from the Foreign Corrupt Practices Act (FCPA) recidivist Oracle Corporation. We previously reviewed the bribery schemes in general and how they worked in practice. Given not simply the recidivist status but the nature and location of the bribery schemes, one might reasonably ask questions about the resolution. Quite simply, how did Oracle achieve the result they did?

The Comeback

Under the FCPA Corporate Enforcement Policy, as developed by the Department of Justice (DOJ), the requirements for leniency were (1) self-disclosure, (2) extensive cooperation during the investigation and (3) thorough remediation up to the conclusion of the matter. Under the recent Monaco Memo, this prong 3 was further explained as creating a compliance program to address the issues which led to the compliance program and then testing that program prior to the conclusion of the resolution. While the Securities and Exchange Commission (SEC) does not have a similar written Policy they have followed the DOJ’s lead on since the implementation of the FCPA Corporate Enforcement Policy in November 2017.

In the 2022 Order, it specified there was some type of self-disclosure. The Order stated, “the Commission [SEC] considered that Oracle self-reported certain unrelated conduct, remedial acts it undertook, and cooperation afforded the Commission Staff.” This is one of the most oblique references to self-disclosure seen in an FCPA enforcement action. It is not clear what the ‘unrelated conduct’ might have been nor how it related to the FCPA violations. Whatever this unrelated conduct was, it was self-disclosed to the SEC and apparently that self-disclosure was enough to satisfy the SEC that self-disclosure had occurred.

The next requirement is thorough cooperation with the SEC during the investigation. Here the Order stated, “Oracle’s cooperation included sharing facts developed in the course of its own internal investigations, voluntarily providing translations of key documents, and facilitating the staff’s requests to interview current and former employees of Oracle’s foreign subsidiaries.” Each one of these factors should be digested by every compliance officer to understand what the SEC thinks is important. It may be different from the DOJ, particularly after the Monaco Memo, but these actions are all clearly important to the SEC.

Finally, of course, is the remediation. Here the Order specified several actions in greater detail than in most Orders. The Order stated, “Oracle’s remediation includes:

  • terminating senior regional managers and other employees involved in the misconduct and separating from employees with supervisory responsibilities over the misconduct;
  • terminating distributors and resellers involved in the misconduct;
  • strengthening and expanding its global compliance, risk, and control functions, including the creation of over 15 new positions and teams at headquarters and globally;
  • improving aspects of its discount approval process and increasing transparency in the product discounting process through the implementation and expansion of transactional controls;
  • increasing oversight of, and controls on, the purchase requisition approval process;
  • limiting financial incentives and business courtesies available to third parties, particularly in public sector transactions;
  • improving its customer registration and payment checking processes and making other enhancements in connection with annual technology conferences;
  • enhancing its proactive audit functions;
  • introducing measures to improve the level of expertise and quality of its partner network and reducing substantially the number of partners within its network;
  • enhancing the procedures for engaging third parties, including the due diligence processes to which partners are subjected;
  • implementing a compliance data analytics program; and
  • enhancing training and communications provided to employees and third parties regarding anti-corruption, internal controls, and other compliance issues.”

 Resources

These changes appear to be extensive and potentially significant within the greater Oracle compliance program. There was increased resources made available to Oracle through an increase in head count (15 new positions), restructuring of compliance groups and creation of new compliance teams. Additionally, the implementation of a compliance data analytics program would also fall under additional resources. Finally, Oracle moved to more proactive auditing.

Discipline

There were terminations of Oracle employees including “senior regional managers and other employees involved in the misconduct” in addition to the termination of distributors and resellers involved in the misconduct. While not tied to a disciplinary role but clearly in the less is more approach Oracle substantially reduced the number of business partners within its network.

Training

Next was in the area of training. There was enhanced “training and communications provided to employees and third parties regarding anti-corruption, internal controls, and other compliance issues.” This would seem to indicate enhanced training for those remaining business partners.

Internal Controls

Finally, there was the area of internal controls enhancement. Here there were improvements in the following areas: (a) discounting by improving aspects of the Oracle discount approval process and increasing transparency in the product discounting process through the implementation and expansion of transactional controls; (b) procurement through the increased oversight of, and controls on, the purchase requisition approval process; (c) removal of perverse incentives by limiting financial motivations and business courtesies available to third parties; (d) basic GTE by improving its customer registration and payment checking processes and making other enhancements in connection with Oracle technology conferences.

DOJ

Obviously, recidivist behavior is one of the key areas the DOJ focused on in the Monaco Memo. It is one of the factors the DOJ assesses in any resolution of an enforcement action. The Monaco Memo does note that civil penalties over five years old will be given lesser weight so perhaps the 2012 SEC FCPA enforcement action involving Oracle’s conduct in India plays into the SEC analysis here. There is also the question of a monitor for a company with recidivist behavior which Oracle avoided in this SEC resolution. In the Monaco Memo, two of the areas of evaluation are:

  1. Whether, at the time of the resolution and after a thorough risk assessment, the corporation has implemented an effective compliance program and sufficient internal controls to detect and prevent similar misconduct in the future;
  2. Whether, at the time of the resolution, the corporation has adequately tested its compliance program and internal controls to demonstrate that they would likely detect and prevent similar misconduct in the future;

While the SEC Order lays out in detail the remediation, there is no information on any testing performed by Oracle on the new components of its compliance program or on its controls.

As yet there is no information on a DOJ resolution. Given the tenor of the most recent DOJ announcements including the Monaco Memo, and the subsequent speech by Principal Associate Deputy Attorney General Marshall Miller and speech by Assistant Attorney General Kenneth A. Polite, it appears that recidivism will be greatly frowned upon. Also, unclear would be whether the DOJ would require a monitor based upon the remediation made by Oracle as reported in the SEC Order. As noted, there is no indication of testing of the compliance program enhancements. All in all, lots of questions for the DOJ and we will have to wait for a DOJ resolution to see if we can begin to answer some of them.

Please join me tomorrow where I conclude this series by considering what does it all mean for the compliance professional.

Categories
From the Editor's Desk

September and October in Compliance Week

Welcome to From the Editor’s Desk, a podcast where co-hosts Tom Fox and Kyle Brasseur, EIC at Compliance Week, unpack some of the top stories which have appeared in Compliance Week over the past month, look at top compliance stories upcoming for the next month, talk some sports and generally try to solve the world’s problems.

In this month’s episode, we look back at top stories in CW from September around the FCPA enforcement actions involving GOL and Oracle, the Monaco Doctrine as reflected in the Monaco Memo, and the SEC spanking of banks for nearly $2MM over employees using messaging apps. We discussed the ESG virtual event and previewed the CW 2022 in Europe, which will be held in Scotland, and the virtual 3rd Party Risk conference, scheduled for December.

We conclude with a look at some of the top sports stories, including a look at the Tua Tagavoiloa and the NFL concussion protocols, and ask Kyle how he would have covered; the Boston Celtic’s imbroglio regarding its suspended head coach Ime Udoka and  Aaron Judge and his season for the ages.

Categories
Because That's What Heroes Do

WandaVision, Episode 9 – Series Finale

In this podcast series, two complete MCU fans, Tom Fox, founder of the Compliance Podcast Network, and Megan Dougherty, co-founder of One Stone Creative, indulge in a passion for all things in the Marvel Cinematic Universe. We previously reviewed all the movies, and now we have a series on WandaVision. If you want to indulge in your love for the MCU with two fans passionate about all things MCU, this is the podcast series for you. For this offering, we conclude with Episode 9 Series Finale.

Some of the highlights include:

Ø The story synopsis.

Ø What are the key plot points?

Ø What were some of our favorite cookies?

We hope you have enjoyed our exploration of WandaVision. After a break, Megan and Tom will be back with a look at the summer’s MCU cinema releases, Dr. Strange in the Multiverse of Madness and Thor: Love and Thunder.