Categories
The Compliance Life

Joya Willams-From Legal Secretary to Compliance

The Compliance Life details the journey to and in the role of a Chief Compliance Officer. How does one come to sit in the CCO chair? What are some of the skills a CCO needs to success navigate the compliance waters in any company? What are some of the top challenges CCOs have faced and how did they meet them? These questions and many others will be explored in this new podcast series. Over four episodes each month on The Compliance Life, I visit with one current or former CCO to explore their journey to the CCO chair. This month, I take things in a different direction as I host my first non-CCO compliance professional, Joya Williams and detail her journey in compliance. In Episode 1, we take a look at Joya’s career leading to compliance.

Joya started her work life as a legal secretary, working in the Houston legal community for many years. She moved into the corporate world, taking a corporate paralegal position inhouse with the Baker Hughes compliance function. At Baker Hughes, entered Center for Advanced Legal Studies paralegal program and attended classes at night to obtain her Associates Degree in Paralegal Studies.  Afterwards, she obtained her paralegal certification. She found her passion and it was compliance.

Resources
Joya William LinkedIn Profile

Categories
Everything Compliance - Shout Outs and Rants

Everything Compliance-Shout Outs and Rants from Episode 101


Welcome to the fan favorite Shout Outs and Rants. In this episode we have them from Episode 101.

1. Karen Woody shouts out the US National and state parks systems which provide much needed green spaces for Americans.

2. Matt Kelly has a dual shout out and rant. He shouts out to the Boston Celtics for having the greatest NBA Finals-Game 1 comeback to win the game. He rants about the DOJ failing to post the speech by AAG Kenneth Polite where he announced the new requirement for CCO certification.

3. Jonathan Marks also has a dual shout out and rant. He shouts out to the Philadelphia Phillies for firing manager Joe Girardi and rants about Glencore’s Press Release about their updated compliance which he rants “says nothing”.

4. Tom Fox reads out the names of the students and teachers who were killed in the recent massacre in Uvalde,  TX.

5. Jonathan Armstrong has two shout outs. First to the Queen’s Platinum Jubilee and Sir Andy Murray for speaking out against the murder of school children. Murray is a survivor of a similar event in Scotland.

Categories
Innovation in Compliance

Third-Party Risk Management Industry with Brad Hibbert


 
Brad Hibbert is the Chief Strategy Officer and Chief Operations Officer at Prevalent Inc., a company specializing in eliminating security and compliance exposures tied to third-party vendors and suppliers. Tom Fox welcomes Brad back to this week’s show to explore and discuss a study Prevalent recently released entitled, “The 2022 Third-Party Risk Management Industry Study”. 
 

 
Third-Party Risk Management Industry Survey 
Brad reveals that Prevalent Inc. has been working on the “Third-Party Risk Management Survey” for approximately three years. To gather data on the subject, they send the survey to thousands of professionals who are focused on third-party risk management, and who also have a background in security. When the results come in they are categorized, analyzed, and observed for any trends. Tom asks Brad what was the overall assessment of third-party risk management he determined from the survey. “I think third-party risk management is certainly getting more awareness within companies and within executive teams within companies,” Brad replied. He also noticed that both IT and non-IT risks are major concerns for the respondents. 
 
Key Observations About the State of Third-Party Management Risk Today
Tom asks Brad to further analyze and discuss the key findings of the survey. These are the key observations:

  • “Organizations are paying more attention to non-IT security risks but not enough.” Brad explains that programs involved in investigating IT threats are starting to acknowledge the non-IT threats as well. He says “It is no longer just about IT vendors, so organizations are trying to get a broader visibility across that broader supply chain of IT vendors and non-IT vendors, and they’re also trying to get a broader visibility of the types of risks that they’re looking at.” Brad sees this as a positive trend in the third-party risk management industry.
  • “Third-party risk management may (finally!) be getting more strategic.” Tom knows that IT professionals and compliance professionals understand the gravity of third-party risk but wonders if higher-level executives see it the same way – this is an issue to be dealt with strategically, he points out. Brad explains that 31% of respondents indicated that they were impacted by a third-party data breach. These incidents will cause entire organizations to raise awareness of third-party risk and take it seriously. He remarks, “People from security, people from procurement, people from contract, legal and compliance are trying to understand how they can get a holistic view of this concern around vendor risk to minimize it throughout that vendor life cycle.” 
  • “Manual methods for assessing third parties persist but dissatisfaction runs high.” Unfortunately, most companies are still solely fixated on their IT main vendors and security risks, and they believe that they can simply use manual methods like emails and spreadsheets. However, as your third-party risk management grows, you can no longer successfully use those methods as they “do not examine the risks and remediate those risks with the vendors efficiently.”
  • “Organizations are concerned with increasingly damaging third-party security incidents but are using disparate tools to detect, investigate and resolve exposures.” Brad says “High profile impactful data breaches are certainly raising awareness of the problem and it’s causing more organizations to monitor third parties for these types of data breaches.” However, the number of successful breaches over the pandemic suggests that organizations are not using established tools to fight the threats. 
  • “Organizations are waiting over two weeks for third-party incident resolution.” Brad explains that most companies do not have a third-party breach response process in case of an emergency, so it takes a while for companies to identify the issue and begin the process of mediating those risks.
  • “Third-party risk audits are getting more complex and time-consuming.” Brad states, “42% of respondents state that they are audited yearly for their third parties and when they are audited, respondents are indicating it takes between a week and one month to procure evidence to meet that regulatory audit.” From that data, it was determined that audits are costly and time-consuming because most companies are trying to run grandiose third-risk management programs on less adequate systems.
  • “Third-party risk management discipline falters as vendor relationships progress.” From the survey, it was determined that as vendor relationships progress, the power imbalance between vendor and organization switches, leaving all the organization’s data and information exposed to the vendor, increasing the chances of data breaches. 

 
Resources 
Brad Hibbert | LinkedIn | Twitter
Prevalent Inc. | Third-Party Risk Management Study
 

Categories
Daily Compliance News

June 7, 2022 the Taser on a Drone Edition


In today’s edition of Daily Compliance News:

  • Musk threatens to end Twitter deal. (WSJ)
  • Crypto insider charged with insider trading. (NYT)
  • Toshiba BOD conflicts breaks into the open. (Reuters)
  • Taser maker halts drone project as ethics panel members resign. (Reuters)
Categories
Blog

Glencore Resolution: Part V – Final Thoughts

In May, the Attorney General and a host of other Department of Justice (DOJ) officials announced the settlement of a massive Foreign Corrupt Practices Act (FCPA) and market manipulation case against Glencore plc (Glencore). Over this blog series, I have been reviewing the matter and mining it for lessons learned for the compliance community. Today, in this concluding Part V, I want to explore some open questions and provide some lessons learned.
Cooperation Pays
One thing made clear in the Information was that there was some serious misconduct going on here, for multiple years, in multiple countries with multiple schemes. Yet, as laid out in the Plea Agreement, Glencore received a reduction of 15% based upon the FCPA Corporate Enforcement Policy and a 2-point reduction in the overall penalty calculation under the US Sentencing Guidelines. Both of these discounts led to a not-insignificant reduction from the overall penalty assessed.
Glencore did not receive voluntary disclosure credit because it failed to self-disclose its legal violations to the DOJ. Although Glencore received partial cooperation credit, it did not receive full credit because it did not always “demonstrate a full commitment” to cooperation, was slow in providing documents and other evidence and was slow in its remediation. Additionally, it did not timely and appropriately remediate with respect to disciplining certain employees involved in the misconduct. Additionally, Glencore did not have adequate internal controls in place at the time the underlying incidents took place. Since that time, Glencore has taken remedial measures, certain of the compliance enhancements are new and have not been fully implemented or tested to demonstrate that they would prevent and detect similar misconduct in the future, mandating the imposition of an independent compliance monitor for a term of three years.
The key takeaway from the Glencore settlement is that as bad as a company’s conduct is, it can make a comeback and receive some credit under the FCPA Corporate Enforcement Policy. The discounted amount Glencore received drives that message home, but the settlement also specifies that if a company does not “demonstrate a full commitment” to cooperation it will not receive all possible cooperation credit. Additionally, although not specified in the Information or Plea Agreement, this lack of a full commitment may have also led to the robustness of the Monitor requirements which we will take up next.
Monitors
Glencore has been assigned two corporate monitors. One for its UK subsidiary where much of the conduct centered and a second for the corporate parent in Switzerland. Yet it is clear the DOJ does not fully trust Glencore yet. According to the Plea Agreement, Attachment D, “The Monitor’s primary responsibility is to assess and monitor the Company’s compliance with the terms of the agreement…to specifically address and reduce the risk of reoccurrence of the Company’s misconduct.” Additionally, the Monitor will evaluate “the effectiveness of internal accounting controls, record-keeping and financial reporting  policies and procedures” as they “relate to ongoing compliance with the FCPA and other applicable anti-corruption laws.” The Monitor will also assess the “Board of Directors’ and senior management’s commitment to and effective implementation of the corporate compliance program described in Attachment C.”
While the Monitor can rely on company reporting and “Company-specific expertise”; it is only required to do so when “the Monitor has confidence in the quality of those resources.” Clearly the DOJ is leaving room for the Monitor to bring in its own resources, at the company’s expense, if the Monitor feels less than sanguine about how the company is moving forward. If the company is not moving forward in the right direction of providing sufficient information to the Monitor, the Monitor can respond accordingly, and the company has agreed to this. The Monitor will be looking at various operational issues of how Glencore implements the requirements of the settlement. These include where and with whom the company does business, its business partners, from third parties to joint venture partners and everything between and beyond; focusing on the business rationale for any such relationships. The Monitor will review and assess the company’s ongoing interactions with government officials and those of state-owned enterprises.
We have not seen this level of detail or robustness in a Monitor’s Mandate in quite some time. The Glencore Monitorship draws directly back to the remarks of Deputy Attorney General (DAG) Lisa Monaco in her October 2021 speech announcing a reorientation in FCPA investigations and enforcement. The monitorship mandate in the Glencore settlement is a direct outcome from this refocus and signals the formal end of the Benczkowski Memo and its clear distaste for monitorships. They are back, in a very big way and are clearly here to stay, at least during the Biden Administration.
CCO Certification
Although it was only announced formally on May 17, 2022, at Compliance Week 2022; the new requirement for Certification is formally incorporated into the Glencore settlement and is found at Attachment H of the Plea Agreement. The Glencore Chief Compliance Officer (CCO) will have to certify “the Company has implemented an anti-corruption compliance program that meets the requirements set forth in Attachment C.” Moreover, the certification attests that the Glencore compliance program “is reasonably designed to detect and prevent violations of the FCPA and other anti-corruption laws.” This certification is also required of the Chief Executive Officer (CEO).
This means the CCO is certifying the entire compliance program meets the standards of not simply best practices but also all the enhanced requirements set out in Attachment C. Of course, if there are either recidivist FCPA violations by Glencore or additional illegal actions uncovered during the pendency of the monitorship, it could well impact the certification. Also if the CCO does so attest, what happens if there is recidivist conduct during the time covered by the certification but only later discovered, even much later; similar to the conduct reported in the Tenaris FCPA enforcement action? Will there be criminal liability to a long-gone (or even current) CCO? At this point, it is an open question, but it does raise the stakes significantly for any CCO who does sign such a certification.
Culture, Culture, Culture
Glencore clearly had a business strategy based upon corruption. The corruption strategy was approved by, and payment of bribes were authorized at the highest levels of the company. While many of those executives have left the company, there was clearly an entire culture at play here. The question is whether the company will be able to turn things around enough to satisfy a Monitor, the DOJ and, at the end of the day, the Court who will oversee all of this.
The company made a start by publicly publishing its first Ethics and Compliance Report, for which it certainly should be commended. There is no better disinfectant than the light of day and if Glencore is committed to publicly reporting on its compliance, program it speaks directly to the change in culture that it is trying to undergo. It will no doubt take much time, effort and money but if Glencore is serious as it stated that “a strong Ethics and Compliance Programme grounded in our Values is critical to ensuring we are a responsible and ethical company, and a trusted business partner. We want to be transparent about the challenges we face, how we learn from them and how we use them as an opportunity to improve and push ourselves to do better”; it can become a global leader in ethics and compliance.

Categories
All Things Investigations

All Things Investigations: Episode 5 – Sanctions and Controls with Tyler Grove


 
Welcome to the Hughes Hubbard Anti-Corruption and Internal Investigations Practice Group’s Podcast, All Things Investigations. In this podcast, host Tom Fox and members of the Hughes Hubbard Anti-Corruption & Internal Investigations Practice Group will highlight some of the key legal issues involved in white-collar and other investigations, both domestically and internationally. In this episode, I speak with Tyler Grove, counsel at Hughes Hubbard, about the Biden administration’s multilateral approach to sanctions.
 

 
Tyler Grove has worked at Hughes Hubbard for over 10 years, starting as a paralegal and then working his way up to a full-time associate before taking the position of counsel. Tyler’s specialties include sanctions and export controls in addition to anti-money laundering and foreign investment issues. His practice has three main areas: compliance counseling, enforcement and investigations, and corporate diligence and filings.
Key areas we discuss on this podcast are:

  • The differences between the Biden administration’s sanctions vs. those of the past.
  • The US has imposed a soft embargo on any items subject to its jurisdiction and classified on the commerce control list.
  • How soon we will be able to see the effectiveness of the Biden administration’s embargo.
  • We will likely see an expansion of the sanctions imposed for human rights.
  • It’s important that companies are aware of their suppliers, and how their products are being manufactured.
  • Anti-boycott issues in China.

Resources
Hughes Hubbard & Reed website 
Tyler Grove on LinkedIn
 

Categories
The ESG Report

Issues in Energy Supply Chain with Daniel Banes and Mark Henderson


 
In this very unique ESG Report, Tom Fox welcomes special guests, Daniel Banes and Mark Henderson. Daniel Banes is the President of Commercial Tech and Mark Henderson is the Director of Solution Design Lead at Exiger, a company dedicated to altering the playing field related to fraud and financial crime. In this powerful episode, they discuss the effects of ESG in the energy industry and the role of the supply chain in ESG.
 

 
The Evolution of ESG in the Energy Industry 
Tom asks how ESG regulatory risk management has evolved within the energy industry. Mark explains that historically consumers, governments, and companies focused on the environmental issues in ESG, but recent global trends and regulations brought social issues to the forefront. Mark says that the Supply Chain Due Diligence Act that would come into effect in Germany on January 1st, 2023 is an example of social issues taking the front seat globally. This act would “require companies to identify, assess, prevent and remedy human rights risks, and impacts across their supply chains”. If companies do not comply with these laws, they are at risk of being fined and possibly excluded from earning contracts in Germany’s public sector for up to three years.
 
Climate Risk Management versus the Energy Industry 
Recently the SEC proposed new rules about climate risk management disclosure and Tom asked Daniel how he thinks it would affect energy companies. Dan responds that it means that energy companies would now be held accountable; over the years most companies proposed that they would be carbon neutral by a certain date, and it never materialized. “Having this disclosure rule gives the public insight – across the board for all public companies – into those targets that companies are committing to climate-related risks,” Mark says. He adds that financial statements would be audited allowing for more accountability for these companies. 
 
Managing Scope Three
Tom asks Daniel how he believes energy companies would manage Scope Three and how they could be connected to the proposed SEC rules about accountability and transparency. Mark explains, “Scope Three [is] about having data to look into your supply chain and understand emissions that are within your supply chain and have those conversations with your suppliers.” Additionally, it allows a more wholesome relationship to flourish across your supply chains and for efficiencies to be detected before discussing environmental control and risk and emissions. 
 
Resources 
Daniel Banes | Exiger Profile  | LinkedIn 
Mark Henderson | Exiger Profile  | LinkedIn 
Exiger | Exiger’s Supply Chain Explorer 
 

Categories
FCPA Compliance Report

Scott Schneider on Your Code of Conduct

In this episode of the FCPA Compliance Report I visit with Scott Schneider, Head of Content Development at Traliant. Scott has been in the compliance space for over 15 years and is passionate about the building blocks of a best practices compliance program, including Codes of Conduct. This week we take a deep dive into the foundational backbone of every compliance program, the Code of Conduct.  Some of the highlights include:

·      Importance of  Code of Conduct training.

·      Types of Code training.

·      Why have a Code of Conduct?

·      How does a Code of Conduct help establish culture?

·      Key areas the Code should cover?

·      How should a company develop its Code of Conduct?

·      When should a Code be revisited or reassessed?

·      The roles of Codes of Conduct and training down the road into 2025 and beyond?

Resources

Scott Schneider on LinkedIn
Traliant website

Categories
Daily Compliance News

June 6, 2022 the D-Day Edition


In today’s edition of Daily Compliance News:

  • Bermuda doubles down as a crypto center. (WSJ)
  • Even more corrupt than Nixon. (WaPo)
  • NFTs-the wild west. (NYT)
  • Stellantis to plead guilty to emissions fraud. (NYT)
Categories
Sunday Book Review

June 5, 2022 the D-Day edition


In today’s edition of Sunday Book Review:

  • Overlord by Max Hastings
  • The Longest Day by Cornelius Ryan
  • Decision in Normandy by Carlos D’Este
  • Invasion 1944 by Hans Spiedel

 
Resources
WWII Reads-D-Day