Huawei’s CFO admits to misleading a global financial institution. The Kitchen takes a closer look at a recently published DPO between the CFO and the DOJ.
Categories
Author: admin
*This episode originally aired on the Coffee and Regs podcast and is cross-posted here with permission.*
Greg Hotaling is a Regulatory Content Manager at Compliance Solutions Strategies (CSS), specializing in global regulatory matters relevant to the financial industry. Marye Cherry is the EU Regulatory Counsel and Head of ESG at CSS. She is an expert in transparency and regulatory reporting issues in the financial services industry, including ESG. In this episode of a special two-part series, Greg and Marye demystify the complicated world of ESG including the latest regulatory developments, the complexity of ESG data, and what ESG actually means for investment managers.
About ESG
ESG, green initiative, and sustainability are often used interchangeably; according to Marye, they all refer to the underlying principles of planet, people, and profit. She tells Greg that ESG is about “doing business in a way that exhibits concern for the long-term health of the planet and for the people who are impacted but still being able to do that profitably.” In the financial sector, ESG “refers to the integration of economic, social, and governance factors in the investment process.” It’s also called sustainable finance, Marye says.
What Investment Managers Should Know
In the past, ESG in the financial sector was mostly based on voluntary frameworks and standards, but in recent years, regulation has become the norm. “ESG will be most relevant in terms of the regulations that are coming or that already exist,” Marye advises investment managers. The EU is the most advanced region in this regard: they have already established several regulations including the Action Plan on Sustainable Finance, and several new regulations are upcoming. Regulation is where the action is in the ESG space, Marye points out.
Save the Date
Greg asks about important dates investment managers should keep in mind. The Sustainable Finance Disclosure Regulation (SFDR) is the upcoming regulation asset managers should focus on, Marye replies, and there are two dates to watch. The first date, March 10th 2021, was the initial implementation of SFDR. EU asset managers needed to classify their financial products under the articles of the SFDR and start to amend their documentation to disclose that classification. “The SFDR went into effect however, before the detailed technical standards were available to the market,” Marye says, and the pandemic further delayed the release of those standards. The standards as well as taxonomy linked disclosures will be released soon in the same document, so listeners should look out for that. The effective implementation date will be July 1, 2022.
Resources
Greg Hotaling on LinkedIn
Marye Cherry on LinkedIn | Twitter
Ed. Note-I was recently interviewed on Best Seller TV about my book, The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, Second Edition. This video of the interview appears with the permission of Best Seller TV.
On this episode of Best Seller T,V Tom Fox, author of The Compliance Handbook: A Guide to Operationalizing Your Compliance Program, Second Edition, addresses what best practices can be put in place for companies to run more efficiently and generate more profits. Fox, who began working in the compliance industry in 2007, was a lawyer by trade, but felt compelled to switch careers because he saw an opportunity to help make a difference and help corporations be more efficient. Fox says the United Nations estimates that $3 trillion are lost annually to corruption. He saw the opportunity to help corporations build first-class best practice compliance programs by complying with the law and run the business side a lot smoother.
Compliance is setting up systems, processes, and procedures that comply with a law and/or regulation. With laws constantly changing, Fox wrote the second edition of the book to instruct readers on the latest compliance laws that might affect them on a regular basis. Since his first edition in 2018, there has been a 40 percent change in laws, especially after the SEC and the Department of Justice made significant changes to the Foreign Corrupt Practices Act. The pandemic also helped exacerbate many more changes.
The book is for a wide variety of readers, starting with compliance professionals, laying out a blueprint on how to build world-class compliance programs or enhance currently existing programs. The book is also for c-suite and senior executives to help educate them on the benefits of compliance and how to stay out of trouble. The compliance industry has evolved significantly in the last decade or so. Fox adds that right now, the industry is more data-driven and, “When you have data, you can actually improve business efficiency.” He continues to say that the backbone of compliance is internal controls, which are financial controls, but are not often called that. If you look at them from a compliance perspective and tweak them enough to have both controls, you can make enough headroom in making a company run more efficiently, leading to greater profitability.
What specifically are internal controls in a compliance program? Internal controls are not only the foundation of a company but are also the foundation of any effective anti-corruption compliance program. The starting point is the FCPA itself, which states the following:
Section 13(b)(2)(B) of the Exchange Act (15 U.S.C. § 78m(b)(2)(B)), commonly called the “internal controls” provision, requires issuers to devise and maintain a system of internal accounting controls sufficient to provide reasonable assurances that—
(i) transactions are executed in accordance with management’s general or specific authorization;
(ii) transactions are recorded as necessary (I) to permit preparation of financial statements in conformity with generally accepted accounting principles or any other criteria applicable to such statements, and (II) to maintain accountability for assets;
(iii) access to assets is permitted only in accordance with management’s general or specific authorization; and
(iv) the recorded accountability for assets is compared with the existing assets at reasonable intervals and appropriate action is taken with respect to any
differences ….
The DOJ and SEC, in the FCPA Resource Guide, 2nd edition, stated:
Internal controls over financial reporting are the processes used by companies to provide reasonable assurances regarding the reliability of financial reporting and the preparation of financial statements. They include various components, such as: a control environment that covers the tone set by the organization regarding integrity and ethics; risk assessments; control activities that cover policies and procedures designed to ensure that management directives are carried out (e.g., approvals, authorizations, reconciliations, and segregation of duties); information and communication; and monitoring.
…the design of a company’s internal controls must take into account the operational realities and risks attendant to the company’s business, such as: the nature of its products or services; how the products or services get to market; the nature of its work force; the degree of regulation; the extent of its government interaction; and the degree to which it has operations in countries with a high risk of corruption.
Perhaps the best definition I have ever heard came from Jonathan Marks, Partner at Baker Tilly, who defined an internal control as
Internal controls expert Joe Howell, former Executive Vice President (EVP) at Workiva, Inc., has said that internal controls are systematic measures, such as reviews, checks and balances, methods and procedures, instituted by an organization that performs several different functions. These functions include allowing a company to conduct its business in an orderly and efficient manner; to safeguard its assets and resources, to detect and deter errors, fraud, and theft; to assist an organization ensuring the accuracy and completeness of its accounting data; to enable a business to produce reliable and timely financial and management information; and to help an entity to ensure there is adherence to its policies and plans by its employees, applicable third parties and others. Howell adds that internal controls are entity wide; that is, they are not just limited to the accountants and auditors. Howell also notes that for compliance purposes, controls are those measures specifically to provide reasonable assurance any assets or resources of a company cannot be used to pay a bribe. This definition includes diversion of company assets, such as by unauthorized sales discounts or receivables write-offs as well as the distribution of assets.
The COSO, in its 2013 publication entitled “Internal Controls – Integrated Framework”, defined internal controls as “a process, effected by an entity’s board of directors, management, and other personnel, designed to provide reasonable assurance regarding the achievement of objectives relating to operations, reporting, and compliance.” More specifically, internal controls are, according to COSO:
- Geared to the achievement of objectives in one or more categories – operations, reporting, and compliance
- A process consisting of ongoing tasks and activities – a means to an end, not an end in itself
- Effected by people – not merely about policy and procedure manuals, systems, and forms, but about people and the actions they take at every level of an organization to affect internal control
- Able to provide reasonable assurance – but not absolute assurance, to an entity’s senior management and board of directors
- Adaptable to the entity structure – flexible in application for the entire entity or for a particular subsidiary, division, operating unit, or business process
The Integrated Framework goes on to note, “This definition is intentionally broad. It captures important concepts that are fundamental to how organizations design, implement, and conduct internal control, providing a basis for application across organizations that operate in different entity structures, industries, and geographic regions.”
Why are internal controls important in your compliance program? Two FCPA enforcement actions demonstrate the reason. The first came in late 2013 when the DOJ obtained a criminal plea from Weatherford International. There were three areas where Weatherford failed to institute appropriate internal controls. First, around third parties and business transactions, limits of authority and documentation requirements. Second, on effectively evaluating business transactions, including acquisitions and JVs, for corruption risks and to investigate those risks when detected. Finally, in the area of gifts, travel and entertainment expenses, they were not adequately vetted to ensure that they were reasonable, bona fide, and properly documented.
The second case involved the SEC 2017 FCPA enforcement action with Halliburton. In this matter, Halliburton’s internal controls were circumvented and over-ridden which led to a FCPA violation without evidence of a bribe being paid. It was a civil FCPA enforcement action. It demonstrated that internal controls must be shown to be effect under the FCPA and without such a showing there can be a large financial penalty paid by a violator.
The whole concept of internal controls is that companies need to focus on where the risks are, whether they be compliance risks or other, and they need to allocate their limited resources to putting controls in place that address those risks, and in the compliance world, of course, your two big risks are the assets or resources of a company. Not just cash but inventory, fixed assets etc., being used to pay a bribe, and then the second big element would be diversion of company assets, such as unauthorized sales discounts or receivables and write offs, which are used to pay a bribe.
As an exercise, I suggest that you map your existing internal controls to the Ten Hallmarks of an Effective Compliance Program or some other well-known anti-corruption regime to see where control gaps may exist. This will help you to determine whether adequate compliance internal controls are present. From there you can move to see if they are working in practice or “functioning.” Internal controls will only become more important in FCPA enforcement. In this chapter, you will learn how to get ahead of the curve.
In today’s edition of Sunday Book Review:
- Letters from America by By J. Hector St. John de Crèvecoeur
- Roughing It by Mark Twain
- Old Glory by Jonathan Raban
- Confederates in the Attic by Tony Horwitz
- Travels with Charlie by John Steinbeck
How should you assess your internal controls regime for international operations? It is incumbent that you need to review as much information as you can to understand the financial and operational structure of an entity and how it is integrated with the corporate headquarters, or the U.S. business unit’s financial and operation structure, if the foreign operation is part of a U.S. business unit.
You could begin with the TI-CPI to garner a sense of the reputation of the country in which your business unit is located, as well as the CPI for all other countries in which the location either markets business or has current customers. Another area for inquiry or review is the scope of your foreign operations. This means you will need to consider your sales model, whether employee based or primarily using third party representatives. You will also need to consider if such third-party representatives are coming into a commercial relationship with your company through your supply chain.
Other areas of inquiry should include whether your company’s finance and accounting staff produce financial statements that are integrated into the parent’s financial statements; whether your international business locations utilize a local bank account for local sales receipts as well as funds transfers from the U.S. and whether the account has local check signers and whether dual signatures are required on the checks. You may also want to consider the extent to which disbursements are made in the local currency and, of course, is there a local petty cash fund.
As with many other areas around internal controls, it is important to consider the local DOA and whether it is consistent with your corporate DOA. Some of the considerations regarding the local DOA should extend to which corporate or U.S. business unit approvals are required for transactions initiated locally, such as: 1) approval of vendor invoices, 2) disbursements of funds, including wire transfers; 3) execution of facilities leases; 4) execution of contracts with agents; and 5) approval of pricing and credit terms to customers and distributors. You should also review whether the local DOA provides appropriate SODs at the local business unit level.
You should consider how sales of product are conducted. For example, is an inventory maintained at the local operation for shipment to customers; are products drop shipped from U.S. directly to the customers of the local operation or are they drop shipped to distributors for delivery to the ultimate customer?
Hopefully you are already doing the above, but you should review what is being done to determine if employees or local contractors who are local nationals have gone through your due diligence process so that they have been properly vetted to determine whether they are government officials in any capacity or are relatives of government officials. Along the lines of a more formal FCPA analysis you should review to see if there has been any investigation of alleged fraud, including FCPA violations, at the location and, if so, what were the results of the investigation? Around customers, you should review with whom each international location does business to determine the extent to which its current customers are local government entities as well as the extent to which the location is pursuing sales activities for other local government entities.
If there has not been a sufficient assessment of controls, the compliance professional must then decide how to best determine whether the local controls are sufficient to satisfy the requirement of the FCPA and accurately reflect all transactions and prevent concealment of improper transactions. Some of these considerations would be an inadequate SODs because the separation of responsibility for physical custody of an asset from the related record keeping is a critical control. In practice, this means that persons who can authorize purchase orders should not be capable of processing accounts payable transactions. Further, the employee who prepares the deposit should not post the receipts to the customer accounts.
You should look to see if there is inappropriate access to assets. If there are, internal controls should be created to provide safeguards for physical objects such as inventory and cash, restricted information, critical forms and update applications. This means that an employee who only needs to view computer information should be restricted to “read and file scan” access and should not be granted “write and create” access. Moreover, controls should prevent the unauthorized removal of resale inventory and movable fixed assets from the premises.
It is not necessary to prove a that a bribe has been paid to have an enforcement action against a company for violation of the internal controls provisions of the FCPA. That was the situation in the SEC 2018 FCPA enforcement action involving Kinross Gold Corporation. It was this lack of effective internal controls, not the payment of a bribe, which was the basis for the civil enforcement action. This means that you should look to make certain the situation is not one of form over substance, where controls can appear to be well designed but still lack substance, as is often the case with required approvals.
Such a situation could arise in several different scenarios. The first is where an account manager’s signature attests to the accuracy of the payroll voucher information, but if the account manager does not have assurance that the supporting time records are accurate, the approval process lacks substance. Other examples are where a supervisor who approves expense reports but routinely does not look at the supporting documentation; a country manager provides a true control as an approver; or where the country manager or the local finance manager has ability to conceal the true nature of transactions without detection by anyone else.
Another important area involves sales and compensation for a foreign business unit. On the sales side of the equation, you review the three-year historical sales for the location and the budgeted sales for the upcoming year. This can give insight into the relative pressure on employees to grow the business and, accordingly, the possibility of an employee seeing a bribe as a good way to grow the business. The inquiries can lead to questions about compensation such as: What is the sales incentive compensation plan for local sales personnel? For the country manager? Such an inquiry gives insight into the possibility of personal benefit which might result from someone paying a bribe to win a contract which results in a large sales incentive compensation to the employee.
These reviews, questions, inquiries and analyses are designed to locate the pressure points involved in any company’s sales processes. This is because pressure is a key element of occupational fraud and the risk of fraud, including corruption, increases as the pressure increases. Since corruption is viewed as a subset of fraud, it might be a good time to review the “fraud triangle,” which lays out breeding ground for fraud in the corruption context:
- Pressure which has financial implications, whether it be personal financial needs that are unmet or pressure to reach sales goals;
- Rationalization. A fraud perpetrator always rationalizes that he/she is not a criminal and when committing fraud for personal benefit, the perpetrator intends to repay the money; when committing fraud for company benefit, the perpetrator rationalizes that the company really wants to meet its goals and that the perpetrator’s actions are in furtherance of the company’s goals; and
- Opportunity. The perpetrator must be in a situation where the internal controls do not prevent the fraud and its necessary concealment
CONVERGE is in its 6th year of bringing together the world’s leading companies for 2 days of dynamic speakers, thought-provoking breakout sessions, and opportunities to connect with like-minded professionals. This year the conference has gone virtual. You will leave the conference with new resources and best practices allowing you to continue the hard work of driving ethics to the center of your business. In today’s episode I visit with Viktoria Reding, Compliance Manager at Wella. We visit about her presentation at Converge21 on Employee Awareness, Engagement, and Training.
For more information, go to Converge21.
In this episode, the Kitchen takes a look at how the Treasury Department facilitates humanitarian assistance in Afghanistan.