Categories
Compliance Into the Weeds

More on DAG Monaco Speech-DPAs and NPAs

Compliance into the Weeds is the only weekly podcast which takes a deep dive into a compliance related topic, literally going into the weeds to more fully explore a subject. Today, Matt and Tom continue their look at the recent speech by DAG Lisa Monaco to the ABA White Collar Institute on some very significant change to white collar, including FCPA enforcement. Today we consider potential changes to DPAs and NPAs and other settlement mechanisms.

Some of the issues we consider are:
·      Are DPAs and NPAs simply the cost of doing business?
·      Is the Wells Fargo growth cap a valid model?
·      What about greater DOJ or Monitor oversight?
·      Longer terms for DPAs?
·      New enforcement tools coming?
·      New review of DPAs and NPAs.
Resources
Matt in Radical Compliance
So What Happens Next with DPAs
Tom in the FCPA Compliance and Ethics Blog
Monaco Speech – Individual Accountability
Monaco Speech – Monitors
Text of DAG Monaco Speech

Categories
Daily Compliance News

November 3, 2021 To Contract or Not Contract edition


In today’s edition of Daily Compliance News:

  • Hertz says it has a contract, Tesla says not.(WSJ)
  • Former heads of UFEA and FIFA charged with fraud in Switzerland. (FT)
  • DOJ sues to stop Random House deal. (NYT)
  • Apple employee files NLRB complaint. (Reuters)
Categories
Compliance Kitchen

Commerce Tightens Exports


Commerce tightens exports of items that can be used for surveillance of private citizens.  The Kitchen reviews the interim final rule – stop by for more.

Categories
The Compliance Life

Wendy Badger-The First to Graduate and Early Professional Career


The Compliance Life details the journey to and in the role of a Chief Compliance Officer. How does one come to sit in the CCO chair? What are some of the skills a CCO needs to success navigate the compliance waters in any company? What are some of the top challenges CCOs have faced and how did they meet them? These questions and many others will be explored in this new podcast series. Over four episodes each month on The Compliance Life, I visit with one current or former CCO to explore their journey to the CCO chair. This month, my guest is Wendy Badger, CCO at Tennant Company.
Wendy knew she wanted to be a lawyer long before she went to law school. She was the first person in her family to graduate from college and then obtain an advanced degree.   She talked about some of the challenges she faced and the support and mentorship she received. We then discussed her early legal career – immediate jump to compliance in the early 2000s through a very non-traditional path of joining an international trade association where she found passion for and niche in compliance.
Resources
Wendy Badger LinkedIn Profile

Categories
Innovation in Compliance

The Future of Zero Trust with Troy Fine


 
Troy Fine is Tom Fox’s guest on this week’s episode of the Innovation in Compliance Podcast. He is the Senior Manager of Cybersecurity Risk Management and Compliance at Drata. Troy joins Tom to talk about data security, data protection, and risk management.
 

 
Internal and External Auditing
Auditing is external and internal. External auditing entails third parties coming in to assess a company’s controls, security frameworks, and determining if they meet compliance requirements. Internal auditing involves people who work directly for the company they are assessing. They are a lot more involved with the business, and understand the requirements of the business better, so they take a more collaborative approach. Internal audit identifies the gaps within the organization, so the business can remedy them quickly, and so that the business can be prepared for an external audit. Troy points out that sometimes internal audit would assist external audit, with external audit relying on the testing that internal already performed. 
 
How Drata Scales Your Company
Integrity and trust are the core ethos of Drata. “We built this product so that our customers can prove to their customers that they could have trust in their data security,” Troy tells Tom. Currently, the company has over fifty integrations that they can pull data and test from, as well as many new frameworks. What this means is that as Drata’s customers get their own customers and more requests for compliance, Drata will be able to support them through additional controls. Customers and clients are able to create a more secure environment in their organizations and meet their compliance standards at the same time. Drata allows customers to manage their control environment via continuous monitoring. When an auditor comes in to assess, they can see the control operated over a long period of time.
 
Assessing Third-Party Risk
Within the Drata platform, there is a vendor management page where customers can start monitoring their vendors. Customers can rank them from low to medium to high risk. For medium- and high-risk vendors, customers can log and track how well those vendors are meeting security requirements. “Part of our control testing is to check if the customer is monitoring their vendors appropriately,” Troy remarks. “We want to make sure they’re also monitoring their vendors, so we provide them a template that allows them to make sure that we’re viewing the SOC 2 reports appropriately, and identifying any risk or end-user controls that they need to perform.”
 
Zero Trust
Tom asks Troy what companies need to be thinking about in terms of cybersecurity in the coming years. “A big area to focus on is going to be this idea of Zero Trust,” Troy says. A greater emphasis on verification, based on location, customer behavior, or just a change in general, is going to be seen in the not too distant future. “As the workforce becomes more remote, the idea that somebody behind the keyboard is not the same person that was in your office is becoming a bigger question,” he adds. Implementing Zero Trust frameworks is going to become more important.
 
Resources
Troy Fine | LinkedIn 
Drata
 

Categories
Daily Compliance News

November 2, 2021 the Character Matters edition


In today’s edition of Daily Compliance News:

  • Jes Staley resigns.(WSJ)
  • Goldman flags Archegos lawsuits. (Reuters)
  • First Consumer Product Safety criminal enforcement action. (WSJ)
  • SFO declines to prosecute individuals yet again. (Bloomberg)
Categories
Blog

Monaco Speech: Part 2 – Monitors

Deputy Attorney General (DAG) Lisa O. Monaco gave a Keynote Address at ABA’s 36th National Institute on White Collar Crime last week (Monaco Speech). Her remarks were noted by many commentators, including on Compliance Into the Weeds where Matt Kelly and myself took a deep dive into her speech in a rare emergency podcast. Her remarks reframed a discussion about this Department of Justice’s (DOJ) priorities on white collar criminal enforcement, including under the Foreign Corrupt Practices (FCPA). Her remarks should be studied by every compliance professional as they portend a very large change in the way the DOJ and potentially other agencies enforce the FCPA. This has significant implications for every Chief Compliance Officer (CCO), compliance professional and corporate compliance programs.
Today, I am going to take up the third change announced by Monaco, the use of corporate monitors. I asked Affiliated Monitors Inc., (AMI) founder Vin DiCianni for his thoughts around the remarks on monitors. He said, “For Affiliated Monitors this refreshed approach by DAG Monaco highlights the seriousness which businesses must place on the investment in their programs and in addressing what has for some been a negative experience with a monitor.  For those who might be the subject of a monitorship, DAG Monaco recognized that the negativity that has sometimes surrounded monitorships as being punitive, should be seen in a different light bringing value, pointing a way forward and as a solution which has had great success in resolving matters.”
In 2021, we have seen several enforcement actions which seemed quite well suited for monitors.Of course, the DOJ recently announced that some companies have been failing to live up to their settlement resolutions and have proposed the extension of current monitorships. Monaco echoed this sentiment stating, “Recently, two different multinational corporations separately announced that each had received a breach notification from the Justice Department.”
Monaco’s remarks may well have been tailored to these 2021 FCPA resolutions and companies in breach of their settlement obligations when she stated, “In recent years, some have suggested that monitors would be the exception and not the rule. To the extent that prior Justice Department guidance [Benczkowski Memorandum] suggested that monitorships are disfavored or are the exception, I am rescinding that guidance. Instead, I am making clear that the department is free to require the imposition of independent monitors whenever it is appropriate to do so in order to satisfy our prosecutors that a company is living up to its compliance and disclosure obligations under the DPA or NPA. Of course, the decision to use monitors must also include consideration of how the monitorship is administered and the standards by which monitors are expected to do their work. And the selection of monitors will continue to be accomplished in a fashion that eliminates even the perception of favoritism. The department will study how we select corporate monitors, including whether to standardize our selection process across the divisions and offices.”
Monaco went on to explain several reasons for need for the increased use of monitorships.  The first is in the area of recidivist offenders. However, this is beyond simply recidivist FCPA offenders and ties into another part of the Monaco speech. It deals with the DOJ taking into account the full panoply of corporate misconduct which might lead to tax investigations, import control enforcement actions or any anti-trust concerns to resolve any FCPA enforcement action. It all seems to me to be around the issue of trust. Monaco stated, “Stepping back, any resolution with a company involves a significant amount of trust on the part of the government. Trust that a corporation will commit itself to improvement, change its corporate culture, and self-police its activities. But where the basis for that trust is limited or called into question, we have other options. Independent monitors have long been a tool to encourage and verify compliance.” If the DOJ cannot trust you to follow the law in some areas, it may not trust you to fulfill your compliance obligations under a FCPA resolution.
Earlier in her speech Monaco talked at length on the importance of corporate culture. She noted, “But corporate culture matters. A corporate culture that fails to hold individuals accountable, or fails to invest in compliance — or worse, that thumbs its nose at compliance — leads to bad results. Let me also be clear: a company can fulfill its fiduciary duty to shareholders and maintain a commitment to compliance and lawfulness. In fact, companies serve their shareholders when they proactively put in place compliance functions and spend resources anticipating problems. They do so both by avoiding regulatory actions in the first place and receiving credit from the government. Conversely, we will ensure the absence of such programs inevitably proves a costly omission for companies who end up the focus of department investigations.”
When taken as a whole, Monaco’s speech says that once again, the DOJ wants companies to be good corporate citizens. Moreover, it all starts with culture and flows from there. If a company puts making a quarterly number above all else, that becomes the corporate culture and employees will do whatever is necessary to accomplish this goal. Conversely, if the values of the company are to do business ethically and in compliance, that will be taken into account. This ups the ante for corporations which find themselves in an FCPA investigation or enforcement action.
Join us tomorrow when we consider Monaco’s remarks on corporate culture.

Categories
Compliance Kitchen

Facebook DOL Settlement


Facebook settles with the DOJ and the DOL over discriminatory hiring practices toward US applicants. Tune in to hear more as the Kitchen reviews this update.

Categories
The ESG Report

From Compliance to ESG with Mike Munro


 
Mike Munro has worked with global companies such as Dell Chemical, Baker Hughes, and Transocean, for more than 30 years. His last position before founding Global Compliance Management and Response (GCMR) was as Chief Compliance Officer at Odebrecht Engineering and Construction in Brazil. He joins Tom Fox on this week’s episode of the ESG Report to discuss GCMR, as well as moving from compliance to ESG.
 

 
ESG Is More Than Anti-Corruption
Mike believes that compliance is about more than just anti-corruption issues. “It was clear that the elements and the focus of compliance programs and efforts are really applicable to a much broader area,” he tells Tom. After his work at Odebrecht ended, he decided to establish his own company to “bring what all of us have learned over the years regarding compliance programs and their value and the things that they’re focused on, and make sure that they can also bring value to other areas. And so that brought me into ESG because clearly, that is an area that does need a lot of help, a lot of work.”
 
From Compliance to ESG
Tom asks Mike, “What are some of the skills you see that a compliance professional has, which really lends itself to either leading or being a part of the leadership team for a corporate ESG effort?” Mike responds that one such skill is the ability to work cross-functionally. “A company really has to bring in many different stakeholders within the company, make sure that all those stakeholders understand what the issues are, understand what they need to do, understand their role in compliance. And that is exactly what is needed in ESG,” he tells listeners. ESG covers many dimensions and requires people across the company to work together, so the compliance officer – who already has expertise in leading cross-functional teams – is well suited to take the lead. He and Tom discuss how compliance and ESG overlap and that ESG will evolve in the same way the compliance function did. “All of those things that happened with compliance programs early on,” Mike remarks, “where you started with a very basic program, and then you moved to training and then you moved to tracking and then you moved to running investigations. Those similar things need to happen with ESG.”
 
The Culture of Safety
Many companies are already doing good things – particularly in safety and environmental compliance – but they don’t have a formalized ESG program, so they do not track or communicate what they’re doing, which means that they don’t get credit for their efforts. An ESG program  ‘allows for more of the positive story to be told,” Mike comments. Tom remarks on the culture of safety in energy companies. Everyone knows why the safety rules are important, and they follow them religiously. He and Mike agree that this is the same direction compliance and ESG need to take. 
 
GCMR and the Future of ESG
GCMR has brought together a global team of experts who can address ESG issues with the local context. “We are just absolutely focused on making sure when we provide services to a client that we are first and foremost, stressing that local issues have to be understood,” Mike points out. Tom asks whether Mike believes regulators or stakeholders will drive the evolution of ESG. It will be the financiers, Mike responds. He comments on the push in the EU for sustainability elements to have the same financial standards and the implications for companies’ financial reporting. 
 
ESG in Acquisitions
GCMR has compiled a simple list of key ESG items. This is how they help companies quickly assess potential acquisitions. “Part of the value of ESG reporting is being able to tell the whole story, but I truly believe that sometimes people make this more complicated than it has to be,” Mike comments.
 
Resources
Mike Munro on LinkedIn
Global Compliance Management and Response
 

Categories
FCPA Compliance Report

Matt Silverman – Trade Compliance, Part 2

In this Episode of the FCPA Compliance Report, I conclude a special two-part series with Matt Silverman on trade compliance. Matt leads the VIAVI Global Trade team and provides strategic guidance to management on international regulatory requirements – including customs, export controls, embargoes, sanctions and antiboycott laws – enabling compliant movement and market access for VIAVI’s products, software, technology and services. Highlights of this podcast include:

1.         What are the key components of a best practices trade compliance program?

2.         It seems to me that trade compliance is even more important coming out of Covid 19 and into our ‘new normal’.

3.         What would you tell a young compliance professional about focusing on trade compliance?

4.         Where do you see trade compliance down the road in 2025 and beyond?

5.         Where does trade compliance fit into ESG?

Resources

Matt Silverman on LinkedIn

Articles

Navigating the Line Between US Export Controls and Anti-Discrimination Laws,

Export Compliance Manager, Issue 12, April 2021

 Ensuring Export Compliance in Activity-Based Working Spaces, Home Offices,

International Trade Blog, March 3, 2021

Navigating Export Compliance, CEP Magazine, March 2021  

What HR Needs to Know About Export Compliance and Deemed Exports, International Trade Blog, January 11, 2021

Championing Your Compliance Program, CEP Magazine, November 2020