Tag: CCO

Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – The Witness Interview

What are the characteristics of a good interview in the context of an internal investigation? Is there one technique you can use which will provide you the results you want to achieve? How should you think through your questions and document review prior to the investigation? At this point in time, how do such issues play out in the time of Coronavirus?
There is no one right way to prepare for and conduct an interview. What is important is that you have a plan and execute on that plan. Begin by obtaining an understanding of what the various stakeholders want answers to. This could include the Board of Directors, C-Suite executives, the GC and legal department, the CCO and compliance function or up to government regulators such as the SEC or DOJ.

Three key takeaways:

  1. There is no one right way to prepare and do an interview.
  2. The interview should not be confrontational.
  3. The interview, like the entire investigation process, is a chess match.
Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – Investigative Challenges

What are some of the top challenges you may face during an investigation? Beyond the basics, a company must consider the intake process as a starting point, which Jonathan Marks noted is one of the biggest challenges. Rather surprisingly, he noted there are still companies without a hotline or anonymous reporting system, stating “We still see organizations whereby there is no formal ethics hotline except for the fact that they might send an email to some member of management or some member of the Board.”
Planning your investigation, having the right team members involved, and meeting the challenges which inevitably arise during an investigation can be difficult. However, beginning with the DOJ’s 2015 Yates Memo, the 2016 FCPA Pilot Program, and the 2017 and 2019 versions of Evaluation of Corporate Compliance Programs, together with the 2020 Update, 2023 ECCP, and FCPA Corporate Enforcement Policy, the pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now. Marks has laid out a concrete way for you to think through how to plan an investigation, staff it correctly, and meet the inevitable challenges.

Three key takeaways:

  1. The intake process may seem the most straightforward but many companies drop the ball at this initial step.
  2. You must never retaliate against employees who come forward in good faith.
  3. Always think several steps ahead.
Categories
31 Days to More Effective Compliance Programs

One Month to Better Reporting and Investigations – Preparing for the Investigation

Under Part 1, Section D. Confidential Reporting Structure and Investigation Process stated in part, Properly Scoped Investigation by Qualified Personnel –What steps does the company take to ensure investigations are independent, objective, appropriately conducted, and properly documented? How does the company determine who should conduct research, and who makes that determination? These questions were presaged by the DOJ’s 2015 Yates Memo and the 2016 FCPA Pilot Program. The pressure on every CCO and company to get an investigation done quickly, efficiently and, most importantly, right is even greater now.
Jonathan Marks began by cautioning that when considering any well-run internal investigation, a CCO must be cognizant of the strictures laid out in the Evaluation. It all begins with who in-house is looking at the complaint and does the CCO, compliance practitioner, or legal team have the skills and capabilities to handle the matter which has arisen. Obviously, if there are esoteric accounting issues or significant internal control workarounds and overrides, a CCO may not have the skills to really understand all the issues. Similarly, if the matter is a global FCPA or equivalent bribery and corruption matter, Marks related, these “come in different flavors, and because they come in different flavors you may not have the skills or capabilities to do an investigation that would take place in say Brazil or Russia or China or India.”

Three key takeaways:

  1. Always remember your ultimate audience may be the government.
  2. You must understand both the business environment and extended business enterprise.
  3. Communication and collaboration in any investigation are critical so you should begin early and continue to do so throughout the investigation.
Categories
31 Days to More Effective Compliance Programs

One Month to Better Reporting and Investigations – Triage of Internally Reported Allegations

One of the things that I learned from the television series M*A*S*H was the need for triage. In the hospital setting, triage is the process of determining the priority of patients’ treatments based on the severity of their condition. In the 2012 FCPA Guidance, there is a short but succinct statement, “once an allegation is made, companies should have in place an efficient, reliable, and properly funded process for investigating the allegation and documenting the company’s response, including any disciplinary or remediation measures taken.” This is considered in more expansive language in the 2020 Update to the Evaluation of Corporate Compliance Programs.  Under Part 1, Section D. Confidential Reporting Structure and Investigation Process, it stated in part, Properly Scoped Investigation by Qualified Personnel – How does the company determine which complaints or red flags merit further investigation?
Appropriate triage of allegations has several different impacts for any matter which comes to the attention of compliance. Obviously, it will help you to initially determine the seriousness of the matter. From there you can allocate an appropriate level of resources. It will also aid in your discussion with the DOJ if you must go that route. Finally, in the situation where facts come in, it provides the required documented evidence that a process was followed that you can show the government that a claim was properly scoped, as required under the Evaluation. But the key is to be prepared, not only in terms of having your investigation and notification protocols in place before an allegation comes in but also doing the proper triage so that you have an initial understanding of what you may be facing.

Three key takeaways:

  1. Compliance can learn from M*A*S*H about the need for triage.
  2. Initial triage allows you to separate the wheat of serious allegations from the chaff of more inconsequential allegations.
  3. A robust triage process allows for greater credibility with government regulators.
Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Reporting and Investigations – Answering DOJ Questions on Confidential Reporting

What are some best practices regarding an internal reporting system? The 2012 FCPA Guidance stated, “An effective compliance program should include a mechanism for an organization’s employees and others to report suspected or actual misconduct or violations of the company’s policies on a confidential basis and without fear of retaliation.”

This was expanded in the DOJ’s 2020 Guidance, in the section entitled “D. Confidential Reporting Structure and Investigation Process,” with the following language, “Another hallmark of a well-designed compliance program is the existence of an efficient and trusted mechanism by which employees can anonymously or confidentially report allegations of a breach of the company’s code of conduct, company policies, or suspected or actual misconduct. Prosecutors should assess whether the company’s complaint-handling process includes proactive measures to create a workplace atmosphere without fear of retaliation, appropriate processes for submitting complaints, and processes to protect whistleblowers.”

Three Key Takeaways:

  1. Internal reporting systems indicate a working, operationalized compliance program.
  2. There must be a solid communication line between the people doing the investigation and those leading the remediation.
  3. Your internal reporting mechanism must be trusted.
Categories
Data Driven Compliance

Data Driven Compliance: Christian Perez-Font on Law, Compliance & Data

Are you struggling to keep up with the ever-changing compliance programs in your business? Look no further than the award-winning Data Driven Compliance podcast, hosted by Tom Fox, which is a podcast featuring an in-depth conversation around the uses of data and data analytics in compliance programs. Data Driven Compliance is back with another exciting episode. The intersection of law, compliance, and data is becoming increasingly important in cross-border transactions, mergers, and acquisitions.

In this episode, Tom welcomes Christian Perez-Font for the first of two parts on using performance bonds and data analytics to guarantee these transactions and the legal requirements and nuances of different jurisdictions when conducting due diligence. They also discussed how technology changes how companies manage Latin American operations, how practitioners need to understand Excel spreadsheets, and how to share data to benchmark and extract the correct information. Christian’s background in engineering and economics has helped him incorporate data analytics, compliance, and law into a unique package. Tune in to Data Driven Compliance and stay ahead of the curve in the compliance world!

Key Highlights:

  • Law Compliance & Data
  • Data as Fuel
  • Data Analytics in M&A
  • Data Analytics in Compliance

Resources:

Christian Perez-Font on LinkedIn 

Thinkeen Legal

 Tom Fox 

Connect with me on the following sites:

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Compliance Man Chooses the Target

Compliance Man Takes a Eurotrip – Piotr Żyłka on Poland’s Compliance Revolution

Compliance Man is back for a new season! Get ready for a EuroTrip with Tom Fox and Tim Khasanov-Batirov on their hit podcast, Compliance Man! Join Tom Fox and co-host Timur Khasanov-Batirov on a Euro trip as they delve into the world of Poland’s Compliance Revolution with guest Piotr Żyłka.

The implementation of the Whistleblowing Directive and the Corporate Sustainability Due Diligence Directive into the Polish Legal System could be a major step forward in the fight against corruption. Tom Fox and Tim Khasinov-Batirov had a conversation with Piotr Żyłka, an author of the It’s All About Compliance blog, publisher, and compliance platform in Europe, to discuss the Polish compliance scene and the need for a Polish FCPA. Piotr discussed the banking law requirements, the DOJ guidelines, the New York City Bar Association paper, and the influence of foreign companies on compliance controls in Poland. He also highlighted the need for trainings, engagement of top management, and internal controls like KYC. Tom and Tim thanked Piotr for his time and knowledge and invited him to come back on the podcast to share his views.

Key Highlights

·      Internal Controls in Poland

·      Compliance in Poland

·      Sanctions Compliance

·      A Polish FCPA Needed?

 Resources

Piotr Żyłka on LinkedIn

It’s All About Compliance

Tim Khasanov-Batirov on LinkedIn

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Board – 20 Questions Directors Should Ask about the Board Compliance Committee

In an area of inquiry entitled Oversight, the 2023 ECCP asks three basic questions which we have explored throughout this chapter:

1. What compliance expertise has been available on the Board of Directors?

2. Have the Board of Directors held executive or private sessions with the compliance function?

3. What types of information has the Board of Directors examined in their exercise of oversight in the area in which the misconduct occurred?

To facilitate the answers to these questions, consider this list of 20 questions to reflect the oversight role of directors. These are questions the Board should ask of both senior management and the Board should ask itself. The questions are not intended to be an exact checklist, but rather a way to provide insight and stimulate discussion on the topic of compliance. The questions provide directors with a basis for critically assessing the answers they get and digging deeper as necessary. Although the questions apply to most medium to large organizations, the answers will vary according to the size, complexity and sophistication of each individual organization.

Part I: Understanding the Role and Value of the Compliance Committee

1. What are the Compliance Committee’s responsibilities and what value does it bring to the Board?

2. How can the Compliance Committee help the Board enhance its relationship with management?

3. What is the role of the Compliance Committee?

Part II: Building an Effective Compliance Committee

4. What skill sets does the Compliance Committee require?

5. Who should sit on the Compliance Committee?

6. Who should chair the Compliance Committee?

Part III: Directed to the Board

7. What is the Compliance Committee’s role in building an effective compliance program within the company? How can the Compliance Committee assess potential members and senior leaders of the company’s compliance program?

8. How long should directors serve on the Compliance Committee?

9. How can the Compliance Committee assist directors in retiring from the Board?

Part IV: Enhancing the Board’s Performance Effectiveness

10. How can the Compliance Committee assist in director development?

11. How can the Compliance Committee help the Board chair sharpen the Board’s overall performance focus?

12. What is the Compliance Committee’s role in Board evaluation and feedback?

13. What should the Compliance Committee do if a director is not performing or not interacting effectively with other directors?

14. Should the Compliance Committee have a role in chair succession?

15. How can the Compliance Committee help the Board keep its mandates, policies and practices up-to-date?

Part V: Merging Roles of the Compliance Committee

16. How can the Compliance Committee enhance the Board’s relationship with institutional shareholders and other stakeholders?

17. What is the Compliance Committee role in CCO succession?

18. How can the Compliance Committee foster great technical impact for compliance function?

19. What role can the Compliance Committee play in preparing for a crisis, such as the discovery of a sign of a significant compliance violation?

20. How can the Compliance Committee help the Board in deciding CCO pay, bonus and resources made available to the corporate compliance function?

 Three key takeaways:

1. The DOJ Evaluation requires active Board of Director engagement around compliance.

2. Board communication on compliance is a two-way street; both inbound and outbound.

3. Has the Board built an effective Compliance Committee for itself?

Categories
Compliance Into the Weeds

Compliance into the Weeds: What is Driving Compliance Engagement at the Board?

The award-winning, Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, going into the weeds to explore a subject more fully and looking for some hard-hitting insights on sanctions compliance. Look no further than Compliance into the Weeds!

In this episode, co-hosts Tom Fox and Matt Kelly dissect the Navex 2023 State of Risk and Compliance Report. Tom and Matt delve into Navex’s annual benchmarking report, which surveyed 1,300 compliance professionals. The report revealed that 53% of respondents described their compliance programs as mature. Matt and Tom question whether the board is driving the conversation or if compliance officers request updates due to potential liability. The report’s findings on cybersecurity and privacy concerns, survey results on where compliance should reside in a company, and the importance of having a mature anti-bribery anti-corruption compliance program are all discussed. Tune in to hear more about how compliance officers can address pressing concerns such as cybersecurity breaches and attacks.

Key Highlights:

  • Navex’s benchmark report on compliance programs
  • Board-Compliance Officer Relationship & Cybersecurity in Compliance
  • The necessity of Dedicated Compliance Committees
  • Survey Finds Diverse Views on Compliance Placement in Companies
  • The Importance of Anti-Bribery Compliance for Cybersecurity
  • Compliance Officer Reporting to CISO Dynamics

 Resources:

Matt 

LinkedIn

Blog Post in Radical Compliance

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

Tribute to Cormac McCarthy-Lessons for the Compliance Professional

Cormac McCarthy died last week. According to his New York Times (NYT) obituary, he was “the formidable and reclusive writer of Appalachia and the American Southwest, whose raggedly ornate early novels about misfits and grotesques gave way to the lush taciturnity of “All the Pretty Horses” and the apocalyptic minimalism of “The Road,” died on Tuesday at his home in Santa Fe, N.M. He was 89.” I came to McCarthy through his work All The Pretty Horses and it was one of the seminal books I have ever read. The only book I can compare it to is Now Let’s Us Praise Famous Men by James Agee and photographer Walker Evans. (Evan’s photos are as spectacular and as equally famous as Agee’s prose.) So today, as my tribute to McCarty, I wanted to take a deep dive into All The Pretty Horses and mine it for leadership lessons for the compliance professional. 

Story Synopsis

All the Pretty Horses was published in 1992. It’s the first book in McCarthy’s Border Trilogy. The story begins in 1949 and is centered around the life of John Grady Cole, a 16-year-old who grew up on his grandfather’s ranch in San Angelo, Texas. After his grandfather’s death, his mother decides to sell the ranch, leaving John Grady, a born and bred cowboy, deeply affected.

Instead of giving in to the changing times, John Grady and his best friend, Lacey Rawlins, decide to head south to Mexico, looking for work as ranch hands. On their way, they encounter a volatile and troubled teenager, Jimmy Blevins, who despite their reservations, joins them. In Mexico, they find work on a vast ranch owned by Don Héctor Rocha y Villareal. John Grady becomes an accomplished horse breaker and falls in love with Don Hector’s daughter, Alejandra, which is forbidden given their different social classes.

However, their peaceful existence is disrupted when Blevins’ past catches up with them. Blevins is accused of horse theft and murder, and John Grady and Rawlins are arrested as his accomplices. Blevins is executed without a trial, while John Grady and Rawlins spend time in a harsh Mexican prison. After enduring the brutal prison conditions, they are released due to the efforts of Alejandra’s great aunt. However, Alejandra, under pressure from her family, ends her relationship with John Grady, which leaves him heartbroken.

John Grady returns to Texas and finds that the world he once knew has changed irreversibly. The novel ends with him setting off into the sunset, uncertain about his future, but with an unbroken spirit and love for the cowboy way of life.

The novel is a coming-of-age story that explores themes of loss, love, and the tension between the old world and the new. McCarthy’s unique narrative style, characterized by minimal punctuation and lyrical prose, underscores the raw beauty and harsh realities of life in the American Southwest and northern Mexico.

Leadership Lessons

All the Pretty Horses presents leadership lessons for the compliance professional through its protagonist John Grady Cole and his experiences. Here are some key leadership lessons we can glean for the compliance professional include:

Decision-Making: John Grady often must make tough decisions, like when he decides to leave his hometown to find a life that suits him better. His choice to help Blevins, despite the risk, also shows a lot about his character. Compliance leadership lesson– compliance professionals must understand that leadership often involves making difficult decisions, with both immediate and long-term consequences.

Responsibility: John Grady takes responsibility for his actions and their consequences. He faces up to his punishments and doesn’t shy away from difficult tasks. Compliance leadership lesson-every compliance professional must accept responsibility for their decisions, good or bad.

Courage: Throughout his journey, John Grady consistently shows courage, whether it’s dealing with the harsh conditions in the Mexican prison or standing up for his values. Compliance leadership lesson– every compliance professional needs to have courage to face adversity, take risks, and stand up for what they believe in. Sometimes you must speak truth to power and be willing to accept the consequences.

Perseverance: John Grady’s determination to survive and maintain his dignity, even in the harshest circumstances, reflects a crucial quality of a leader. Compliance leadership lesson-every compliance professional needs to show determination and the ability to bounce back from setbacks.

Respect and Empathy: John Grady respects the individuals he interacts with, from his fellow cowboys to the horses he works with. Compliance leadership lesson-every compliance professional must respect your colleagues and demonstrate empathy for their challenges in doing business going forward, which are qualities that are critical for a leader to have when dealing with their team.

Integrity: John Grady has a strong sense of moral integrity, sticking to his principles even when faced with challenging situations. Compliance leadership lesson-every compliance professional must always demonstrate integrity in all aspects of your professional life. This is a key trait for leaders, who must maintain integrity and honesty.

Adaptability: Even though John Grady faces a world that is changing around him, he learns to adapt while staying true to his values. Compliance leadership lesson-every compliance professional must adapt to new risks your business meets; whether through new business initiatives or a global pandemic. In short, compliance leaders must demonstrate the ability to adapt to changing circumstances while maintaining core values is crucial.

Failure: Through his relationship with Alejandra, John Grady learns about love, loss, and sacrifice. These experiences, though painful, help him grow and mature as a leader. Compliance leadership lesson-every compliance professional will have failures. How you learn from them will be a key to your development. Compliance professionals need to understand that personal growth often comes through fighting through difficulty.

If you have never done so, I would urge you to read All The Pretty Horses and I hope you find it as moving as I did.