Categories
Innovation in Compliance

Creating a Safer Compliance Ecosystem with Eva Pittas


 
Eva Pittas is the co-founder and COO of Laika, a company that helps other companies manage compliance, obtain security certifications, and build trust with enterprise customers. Tom Fox welcomes her to this week’s show to talk about Laika and how it helps its clients.
 

 
The Birth of Laika
Eva began her professional life running IT risk and control for Citigroup and even worked there after the financial crisis of 2008. She was an integral part of the strong response to counteract the economic collapse. She joined the fintech industry in 2014, as she saw the growth happening in that space. She noticed that many companies “needed to get through with vendor procurement but they did not know what those processes would look like, what diligence would be, or what the security requirements were.” She started her consultancy boutique, BRCG, to provide answers to these questions. Working in the fintech space emphasized the importance of audits. Laika was born as a compliance solution for the rise of the cloud and to address the lack of expertise in information security and compliance guidance for companies. 
 
The Complete Compliance Solution 
Tom asks Eva about their typical clients and to describe the complete compliance solution. Eva says that most of their clientele are small to medium-sized innovative technology companies that are looking to introduce a holistic compliance program. She explains, “Compliance is not very straightforward….. it requires an interpretation of a standard, of a rule, of a regulation and how to apply that to your business.” Compliance programs have to evolve constantly to meet new compliance standards. Laika provides a customizable solution based on your compliance needs. 
 
What Makes Laika Special
Eva explains that what makes Laika stand out from other companies is that they have the expertise for all these recognized requirements. She states, “What Laika does is provide expert guidance and various subject matter experts that are a part of our solution that helps companies implement and maintain compliance.” Laika University facilitates this learning process.  
 
Women In Tech 
Eva emphasizes that women belong in the technology industry, no matter their background. “Technology is not in the future – it’s here,” she says. She encourages more women to enter the space, as you do not need a technological background to break into tech – several non-technical jobs are being created every day. 
 
Resources 
Eva Pittas | LinkedIn | Twitter   
Hey Laika  
 

Categories
Greetings and Felicitations

Ulysses at 100-Lessons for the 21st Century Compliance Professional

Matt Kelly once challenged me write a blog post for Bloomsday. Well aware of my great love for Joyce’s magnum opus, I accepted the challenge. This year is the 100th anniversary of the publication of the book. To celebrate this event, the author James Joyce and my passion for compliance, I have decided to do a 5-part podcast series on Ulysses. Over this podcast series, I will highlight some of the book and commentary and tie what Joyce, Dublin, Leopold Bloom and his wife Molly, together with his mentor Stephen Daedalus can teach the modern compliance professional. I hope you will join me in the short celebration and trip through Dublin 1904 for the 100th anniversary of Bloomsday. In Part 1, why does Joyce and Ulysses still matter.

Resources

The Teaching Compliance-James Joyce Ulysses, by James Heffernan

Categories
Innovation in Compliance

Compliance Insights from Traliant: Episode 1-John Arendes on Transforming Training from Boring to Brilliant

Welcome to a special five-part podcast series on the New Traliant, sponsored by Traliant. Over this series, we will discuss what is new at the company and key issues that Traliant is helping to lead and define the online training industry in going forward. Over this five part series I will visit with  John Arendes, Chief Executive Officer (CEO) at the company on what is new at Traliant. Some of the topics we consider are:

  • What’s new about Traliant?
  • Why is the New Traliant so significant now?
  • How hasTraliant built upon prior strengths to great truly superior online training?

Resources
Traliant Website
John Arendes on LinkedIn

Categories
Compliance Into the Weeds

Compliance Lessons from the Army

Compliance into the Weeds is the only weekly podcast which takes a deep dive into a compliance related topic, literally going into the weeds to more fully explore a subject. In this episode, we take a deep dive into the recently released GAO report on failures in the US Army SHARP program, largely around policies and procedures, with a dash of culture thrown in.  Highlights include:

·      Why has SHARP failed?

·      What is the role of policies and procedures in compliance? What about culture?

·      How can assess your own internal training and communications?

·      What are the 3 questions every compliance professional should ask?

·      What are the lessons for the civilian compliance world?

·      Where does the Army go from here?

Resources

Matt in Radical Compliance

Categories
The Compliance Life

Joya Willams-From Legal Secretary to Compliance

The Compliance Life details the journey to and in the role of a Chief Compliance Officer. How does one come to sit in the CCO chair? What are some of the skills a CCO needs to success navigate the compliance waters in any company? What are some of the top challenges CCOs have faced and how did they meet them? These questions and many others will be explored in this new podcast series. Over four episodes each month on The Compliance Life, I visit with one current or former CCO to explore their journey to the CCO chair. This month, I take things in a different direction as I host my first non-CCO compliance professional, Joya Williams and detail her journey in compliance. In Episode 1, we take a look at Joya’s career leading to compliance.

Joya started her work life as a legal secretary, working in the Houston legal community for many years. She moved into the corporate world, taking a corporate paralegal position inhouse with the Baker Hughes compliance function. At Baker Hughes, entered Center for Advanced Legal Studies paralegal program and attended classes at night to obtain her Associates Degree in Paralegal Studies.  Afterwards, she obtained her paralegal certification. She found her passion and it was compliance.

Resources
Joya William LinkedIn Profile

Categories
Blog

Glencore Resolution: Part V – Final Thoughts

In May, the Attorney General and a host of other Department of Justice (DOJ) officials announced the settlement of a massive Foreign Corrupt Practices Act (FCPA) and market manipulation case against Glencore plc (Glencore). Over this blog series, I have been reviewing the matter and mining it for lessons learned for the compliance community. Today, in this concluding Part V, I want to explore some open questions and provide some lessons learned.
Cooperation Pays
One thing made clear in the Information was that there was some serious misconduct going on here, for multiple years, in multiple countries with multiple schemes. Yet, as laid out in the Plea Agreement, Glencore received a reduction of 15% based upon the FCPA Corporate Enforcement Policy and a 2-point reduction in the overall penalty calculation under the US Sentencing Guidelines. Both of these discounts led to a not-insignificant reduction from the overall penalty assessed.
Glencore did not receive voluntary disclosure credit because it failed to self-disclose its legal violations to the DOJ. Although Glencore received partial cooperation credit, it did not receive full credit because it did not always “demonstrate a full commitment” to cooperation, was slow in providing documents and other evidence and was slow in its remediation. Additionally, it did not timely and appropriately remediate with respect to disciplining certain employees involved in the misconduct. Additionally, Glencore did not have adequate internal controls in place at the time the underlying incidents took place. Since that time, Glencore has taken remedial measures, certain of the compliance enhancements are new and have not been fully implemented or tested to demonstrate that they would prevent and detect similar misconduct in the future, mandating the imposition of an independent compliance monitor for a term of three years.
The key takeaway from the Glencore settlement is that as bad as a company’s conduct is, it can make a comeback and receive some credit under the FCPA Corporate Enforcement Policy. The discounted amount Glencore received drives that message home, but the settlement also specifies that if a company does not “demonstrate a full commitment” to cooperation it will not receive all possible cooperation credit. Additionally, although not specified in the Information or Plea Agreement, this lack of a full commitment may have also led to the robustness of the Monitor requirements which we will take up next.
Monitors
Glencore has been assigned two corporate monitors. One for its UK subsidiary where much of the conduct centered and a second for the corporate parent in Switzerland. Yet it is clear the DOJ does not fully trust Glencore yet. According to the Plea Agreement, Attachment D, “The Monitor’s primary responsibility is to assess and monitor the Company’s compliance with the terms of the agreement…to specifically address and reduce the risk of reoccurrence of the Company’s misconduct.” Additionally, the Monitor will evaluate “the effectiveness of internal accounting controls, record-keeping and financial reporting  policies and procedures” as they “relate to ongoing compliance with the FCPA and other applicable anti-corruption laws.” The Monitor will also assess the “Board of Directors’ and senior management’s commitment to and effective implementation of the corporate compliance program described in Attachment C.”
While the Monitor can rely on company reporting and “Company-specific expertise”; it is only required to do so when “the Monitor has confidence in the quality of those resources.” Clearly the DOJ is leaving room for the Monitor to bring in its own resources, at the company’s expense, if the Monitor feels less than sanguine about how the company is moving forward. If the company is not moving forward in the right direction of providing sufficient information to the Monitor, the Monitor can respond accordingly, and the company has agreed to this. The Monitor will be looking at various operational issues of how Glencore implements the requirements of the settlement. These include where and with whom the company does business, its business partners, from third parties to joint venture partners and everything between and beyond; focusing on the business rationale for any such relationships. The Monitor will review and assess the company’s ongoing interactions with government officials and those of state-owned enterprises.
We have not seen this level of detail or robustness in a Monitor’s Mandate in quite some time. The Glencore Monitorship draws directly back to the remarks of Deputy Attorney General (DAG) Lisa Monaco in her October 2021 speech announcing a reorientation in FCPA investigations and enforcement. The monitorship mandate in the Glencore settlement is a direct outcome from this refocus and signals the formal end of the Benczkowski Memo and its clear distaste for monitorships. They are back, in a very big way and are clearly here to stay, at least during the Biden Administration.
CCO Certification
Although it was only announced formally on May 17, 2022, at Compliance Week 2022; the new requirement for Certification is formally incorporated into the Glencore settlement and is found at Attachment H of the Plea Agreement. The Glencore Chief Compliance Officer (CCO) will have to certify “the Company has implemented an anti-corruption compliance program that meets the requirements set forth in Attachment C.” Moreover, the certification attests that the Glencore compliance program “is reasonably designed to detect and prevent violations of the FCPA and other anti-corruption laws.” This certification is also required of the Chief Executive Officer (CEO).
This means the CCO is certifying the entire compliance program meets the standards of not simply best practices but also all the enhanced requirements set out in Attachment C. Of course, if there are either recidivist FCPA violations by Glencore or additional illegal actions uncovered during the pendency of the monitorship, it could well impact the certification. Also if the CCO does so attest, what happens if there is recidivist conduct during the time covered by the certification but only later discovered, even much later; similar to the conduct reported in the Tenaris FCPA enforcement action? Will there be criminal liability to a long-gone (or even current) CCO? At this point, it is an open question, but it does raise the stakes significantly for any CCO who does sign such a certification.
Culture, Culture, Culture
Glencore clearly had a business strategy based upon corruption. The corruption strategy was approved by, and payment of bribes were authorized at the highest levels of the company. While many of those executives have left the company, there was clearly an entire culture at play here. The question is whether the company will be able to turn things around enough to satisfy a Monitor, the DOJ and, at the end of the day, the Court who will oversee all of this.
The company made a start by publicly publishing its first Ethics and Compliance Report, for which it certainly should be commended. There is no better disinfectant than the light of day and if Glencore is committed to publicly reporting on its compliance, program it speaks directly to the change in culture that it is trying to undergo. It will no doubt take much time, effort and money but if Glencore is serious as it stated that “a strong Ethics and Compliance Programme grounded in our Values is critical to ensuring we are a responsible and ethical company, and a trusted business partner. We want to be transparent about the challenges we face, how we learn from them and how we use them as an opportunity to improve and push ourselves to do better”; it can become a global leader in ethics and compliance.

Categories
Compliance Into the Weeds

Compliance Lessons from Uvalde

Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject. In perhaps our most somber podcast ever, Matt and Tom take a deep dive into some of the failures which led to the tragedy in Uvalde, TX, and lessons for the compliance professional. Highlights include:

  • Why have controls?
  • How can a control over-ride impact safety?
  • How can you prepare for emergencies?
  • Thought-out lines of communication were created before the emergency.
  • When leadership is tested.
  • What is the difference between ethical values and ethical priorities?

Resources

Matt in Radical Compliance

Categories
The ESG Compliance Podcast

The Role of Digital Solutions in ESG with Page Motes


Page Motes joins us today with her expertise in sales and compliance. She shares how tech giant Dell is working on ESG compliance, the transferable skills compliance professionals must have to advance, the significance of multi-disciplinary learning, and how customers can contribute to this by making a more significant social impact.
▶️ The Role of Digital Solutions in ESG with Page Motes:
Key points discussed in the episode:
(00:00:36) Page Motes lays out her professional background. She describes the fast-paced culture and vendors’ often-overlooked concerns in large companies. Since then, she has sworn to only be in a position to “use my talents to help advance goodness in the world.”
(00:11:13) Page Motes defines ESG in Dell as “all things environmental and then an aspect of the human rights piece.” She underlines the three most important skills for compliance professionals: knowing how to deal with ambiguity, being an ultimate connector, and exerting authority.
(00:14:37) Her message to compliance professionals hesitant to move into ESG: have the desire to learn different disciplines.
(00:17:30) Dell aims to deepen and broaden gathered data across its supply chain to disclose information based on government requirements properly. Some Scope Three categories remain difficult to report.
(00:19:49) ESG results brought Dell to create Eureka, a crowdsourcing tool for employees to share their ideas with higher-ups and have them kickstarted.
(00:23:58) The different corporate functions in Dell’s sustainability efforts.
(00:25:58) Page Motes predictions for Dell’s ESG endeavors – more customer involvement and collaboration.
—————————————————————————-
Do you have a podcast (or do you want to)? Join the only network dedicated to compliance, risk management, and business ethics, the Compliance Podcast Network. For more information, contact Tom Fox at tfox@tfoxlaw.com.

Categories
Corruption, Crime and Compliance

Episode 235 – Third-Party Risk Management


The global economy has suffered two significant shocks — first, the pandemic sent shockwaves through every organization, and second, the war in Ukraine. Both of these events exposed the importance of risk management, especially with regard to supply chain and distribution operations. Hence, the renewed focus on third-party risk management and the repetitive description of “holistic” third-party risk management. Reality forces change, and we are now experiencing significant adjustments to overall risk management procedures. At the top of every list has to be third-party risk management beyond legal and compliance risks — we have new disruptive risks that have to be identified, quantified, or ranked and then addressed.
Michael Volkov outlines the new reality and opportunities stemming from holistic third-party risk management in this episode.

Categories
Life with GDPR

André Paris on the Brazilian GDPR


Tom Fox returns for another episode of Life with GDPR. This week, Jonathan Armstrong is on assignment, so we are joined by our colleague André Paris, a Brazilian Privacy and Compliance Consultant, Professor, and Lawyer. Andre is the author of the book “Ethics and Transparency – A Path to Compliance.” He is a specialist in building a Corporate Culture based on Ethics, Transparency, and Respect, with experience in Corporate Risk Analysis and Management and Protecting Corporate Reputation and Crisis Management. He is also an enthusiast of building a more ethical and transparent business environment.
In this episode, we take up the Brazilian national GDPR-like data privacy law.  Some of the issues we consider include:
1.     What is Brazilian law?
2.     Who does it apply to?
3.     What does a compliance program look like?

 Resources

Check out Andre’s book, ETHICS & TRANSPARENCY: A Path To Compliance.

André Paris on LinkedIn