Categories
Compliance Into the Weeds

Compliance into the Weeds: Digital Transformation in Sports Betting: Preventing Fraudulent Activities

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject.

Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds!

In this episode, Tom and Matt take a deep dive into imbroglio involving Jontay Porter and gambling on NBA games.

The recent scandal involving the lifetime suspension of Jontay Porter from the NBA due to questionable prop bets, has sent shockwaves through the sports betting industry.

Tom views this incident as a stark warning for compliance professionals, underscoring the importance of data analytics in detecting anomalies and misconduct. He notes that thorough data analysis can expose even lesser-known players like Porter to inappropriate behavior while also commending the NBA’s swift and decisive action to preserve the integrity of the game.

Matt, a digital transformation advocate in sports betting, believes the scandal highlights the benefits of digital transformation in the industry. He stresses the crucial role of data analytics in identifying suspicious activity and potential misconduct, agreeing with the NBA’s decision to suspend Porter and protect the sport’s integrity.

Both Fox and Kelly’s perspectives are shaped by their backgrounds in compliance and digital transformation, respectively, emphasizing the profound impact of data analytics in these areas.

Key Highlights:

  • NBA Suspension: Data Analytics in Sports Betting
  • Sports Betting Fraud Prevention through Digital Transformation
  • Unveiling Unusual Patterns in Financial Transactions
  • Location-Based Anomalies in Investigative Analytics
  • Consequence Management

Resources:

Tom on the FCPA Compliance Report

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

AI-Driven Compliance Solutions: Balancing Automation and Human Judgment

In today’s rapidly evolving business landscape, compliance and risk management are critical components for the success and sustainability of any organization. With the increasing complexity of regulations and the growing need for transparency, companies are turning to innovative solutions to enhance their compliance programs and mitigate risks. The most revolutionary approach at this point in time is the use of data-driven tools powered by artificial intelligence (AI) and machine learning. The utilization of AI-driven tools has become increasingly crucial for compliance functions seeking to enhance decision-making processes, improve efficiency, and proactively address compliance risks. These tools, which leverage advanced analytics, machine learning, and automation, have the potential to revolutionize compliance practices and lead to more informed decisions at all levels.

Leveraging Data

Data has become a cornerstone in improving the effectiveness of compliance programs. By utilizing data analytics, companies can drive greater business efficiency, leading to a higher return on investment for their compliance initiatives. By leveraging AI-driven solutions, organizations can make fact-based decisions that focus on critical risk areas, enabling better risk assessment and reducing investigative costs.

The Department of Justice (DOJ) has made it clear that data analytics are part of a minimum set of best practices for compliance programs. This means the importance of user adoption is critical both in the effectiveness of AI-driven compliance solutions and in demonstrating your company’s commitment to compliance if the regulators come knocking. The truth is that no matter how sophisticated an AI-based tool may be if compliance professionals do not embrace and use it, its potential remains untapped. This underscores the need for a user-centric approach in developing and implementing AI and data-driven solutions for compliance and risk management.

The Role of Data

In the aftermath of global events such as the pandemic, geopolitical tensions, and regulatory changes, compliance has become more crucial than ever. Data-driven compliance solutions play a pivotal role in helping compliance functions navigate these challenges by providing valuable insights and supporting decision-making processes at all levels. By striking the right balance between automation and human judgment, AI-driven tools can effectively identify risks and enhance decision-making in risk management.

When implementing AI-driven compliance tools, every compliance professional should prioritize finding the right balance between automation and human judgment. While AI can analyze vast amounts of data and identify patterns and risks, human compliance expertise is essential in interpreting results and making informed decisions. Finding the right equilibrium between automation and human judgment is critical to ensuring the efficacy of AI-driven compliance solutions in risk management.

Enhancing Prevention

The use of AI and machine learning has revolutionized fraud prevention by enabling compliance professionals to interact more effectively and identify potential risks and high-risk transactions. While AI, coupled with machine learning, can analyze vast amounts of data and pinpoint areas of concern, human investigation and expertise remain essential in making informed decisions and determining the presence of fraud. By empowering compliance teams with AI-driven solutions, organizations can proactively mitigate risks, foster transparency, and build a strong anti-fraud culture.

AI-driven compliance tools offer various benefits, such as real-time risk notifications through alerts for a corporate compliance function and customized reports for senior managers. These tools enable organizations to take immediate action and remediate situations before they escalate into compliance violations. By leveraging AI and data-driven solutions, companies can enhance their decision-making processes, improve efficiency, and address compliance risks proactively.

Striking the Balance

While AI and data-driven solutions offer numerous benefits in compliance, risk management, and fraud prevention, it is essential to prioritize user adoption and consider the impact on the overall user experience. By incorporating a user-centric approach in the development and implementation of AI-driven tools, companies can ensure the effectiveness of their compliance and risk management initiatives.

However, relying solely on AI for fraud detection presents challenges. While AI and machine learning can enhance efficiency and identify potential risks, they are not foolproof. False positives can occur, necessitating human investigators to determine the validity of flagged transactions. Striking the right balance between AI and human expertise is crucial to ensuring accurate and effective fraud detection.

Embracing the Future of Compliance

As we look towards the future, the integration of AI and data-driven solutions will continue to play a pivotal role in transforming compliance. By leveraging advanced analytics, machine learning, and automation, organizations can enhance decision-making processes, improve efficiency, and proactively address compliance risks. With the right approach and a holistic perspective, AI-driven solutions can become a valuable asset in the pursuit of effective compliance and risk management strategies. However, it is crucial to maintain a balance between leveraging technology and harnessing human expertise to ensure the accuracy and effectiveness of these solutions.

The successful implementation of AI-driven compliance solutions requires a holistic approach that considers user adoption and the impact on employees, fosters a culture of transparency, and aligns with the organization’s risk management objectives. By prioritizing user adoption, balancing automation with human judgment, and considering the impact on the user experience, organizations can harness the transformative power of AI and data-driven solutions in compliance and risk management.

As organizations continue to navigate the complexities of compliance and risk management, AI-driven solutions offer a promising avenue for enhancing practices and making more informed decisions. By embracing these tools while recognizing the importance of human expertise, organizations can navigate the evolving landscape of compliance with greater efficiency and effectiveness.

Categories
Blog

The NBA, Data Driven Compliance and Jontay Porter

One of the best examples I have recently seen of the power of data-driven compliance is playing out in real-time in the NBA. It is the Jontay Porter betting scandal. This event drove home why transparency and robust data analytics can help identify illegal acts in real time, moving compliance from detective to proactive.

Background

The background to the story is both sad and tragic. As reported by ESPN, betting sites grew suspicious when a large amount of money was made on prop bets for Porter. The bets were: “In the game on Jan. 26 against the LA Clippers, there was increased betting interest on the under for Porter props, which for the night were set at around 5.5 points, 4.5 rebounds, and 1.5 assists. There was also an over/under for Porter’s made 3-pointers, which was 0.5.”

Additionally, “At least one other U.S. sportsbook detected unusual betting interest on the game’s Porter props. A sportsbook industry source told ESPN that multiple betting accounts attempted to bet large amounts, upward of $10,000 and $20,000, on Porter under in the January game against the Clippers. Betting limits on NBA player props vary by sportsbook and customer but are typically around $1,000 to $2,000.

The second part of the suspicious transaction was that in that game itself, “Porter played just four minutes before leaving the game because of what the Raptors said was an aggravation of an eye injury he had suffered four days earlier against the Memphis Grizzlies. Porter did not score against the Clippers but had three rebounds and one assist, and he did not attempt a 3, meaning the under-hit on all of the props.” According to the Draft Kings, the under on Porter’s 3-pointers was the biggest money winner for bettors of any NBA player props from games that evening.

A second set of anomalous information came in on March 20. In a game on that night, “Porter played just three minutes before exiting because of what the Raptors said was an illness and did not return. He did not score after attempting one shot and had two rebounds.

Sportsbooks had his over/under set at around 7.5 points and 5.5 rebounds. The next day, DraftKings Sportsbook reported in a media release that Porter’s prop bets were the No. 1 moneymaker from the night in the NBA.”

Anomalous Data

Another ESPN article reported that “the NBA’s investigation found that Porter revealed information about his health to a known sports bettor ahead of a March 20 game against the Sacramento Kings. According to the NBA, another bettor who was privy to the information placed a $80,000 same-game parlay bet featured under Porter’s statistics and would win $1.1 million. Porter played for three minutes before leaving the game with an illness. The bet, which was placed at DraftKings, was not paid.” This is in addition to multiple Sportsbooks that “reported a spike in betting interest on the under on several of Porter’s statistics ahead of a Jan. 26 game against the Los Angeles Clippers.”

Finally, and most damningly, Porter was also betting on NBA games. “The league investigation revealed Porter placed at least 13 bets on NBA games using an associate’s online betting account. According to the league, the bets ranged from $15 to $22,000, totaling $54,094. The NBA said the total payout from those bets was $76,059, with net winnings of $21,965. None of the bets involved any in which Porter played. Three bets were parlays, including one that included a bet on the Raptors to lose. All three bets lost, according to the NBA.”

 Lessons for Compliance

  1. Transparency

There are several key lessons for compliance in this sordid tale. The first is around transparency. It is not about the legalization of gambling; gambling on NBA games has always occurred. It is about the oversight that legalization has brought about. In other words, gambling has moved out of the shadows and into the light of day. There is increased regulatory oversight and reporting. The NBA itself noted that “it was alerted to the suspicious activity by licensed sportsbooks and an organization that monitors legal betting markets. Las Vegas firm U.S. Integrity, which works with sportsbooks, leagues, and state gaming regulators, monitored Porter’s abnormalities and said it is “proud to continue to support the NBA in initiatives relating to regulated sports betting.”

The legalization of gambling has increased the amount of money involved. However, having that much money means more oversight and better processes for determining anomalous patterns. Why? Because it is a business for these Sportsbooks and sites like Draft Kings. Not only is it a business, but its customers must have faith that the games are not crooked, which is exactly what the NBA demands.

  1. Data Analytics

The second, equally important lesson is about data analytics. Data analytics did not determine that Porter had illegally revealed information about his health. Data analytics determined an unusual pattern of betting on small bets on a minor player, all in a very big way. In other words, the data identified anomalies that could be further investigated. Every data analytics program should crunch massive GTE spending, marketing spending, charitable donations, third-party spending, and any other place funds could be generated to determine if a pot of money is needed to fund a bribe.

Moreover, once your data program is set up, you can monitor these areas in real-time. This will allow you to spot any unwarranted trends and patterns. Based on the investigation, you can suspend the activities. If further action is necessary, you can then take it. But it all begins with data analytics.

  1. Consequence Management

We now move to the tragic part of this story. As a direct consequence of his actions, Jontay Porter has been banned from playing in the NBA for life. For the compliance professional, the lesson is that the Department of Justice demands swift action, including termination and clawbacks for executives who are part of a bribery or corruption scheme.

Categories
Compliance Week Conference Podcast

Compliance Week 2024 Speaker Preview Podcast – Vince Walden on the Latest in DOJ Data Analytics Expectations

In this episode of the Compliance Week 2024 Speaker Preview Podcasts series, Vince Walden discusses his panel at Compliance Week 2024, “Aligning your Compliance Program to DOJ’s Data Analytics Expectations.” Some of the issues he will discuss in this podcast and his presentation are:

  • The latest words from the DOJ on data analytics
  • How will the DOJ use data analytics going forward?
  • Seeing old friends and learning about new best practices at Compliance Week 2024

I hope you can join me at Compliance Week 2024. This year’s event will be held April 2-4 at the Westin Washington, DC, Downtown. The line-up is first-rate, with some top ethics and compliance practitioners around.

Gain insights and make connections at the industry’s premier cross-industry national compliance event, offering knowledge-packed, accredited sessions and take-home advice from the most influential leaders in the compliance community. Back for its 19th year, join 500+ compliance, ethics, legal, and audit professionals who gather to benchmark best practices and gain the latest tactics and strategies to enhance their compliance programs. Compliance, ethics, legal, and audit professionals will gather safely face-to-face to benchmark best practices and gain the latest tactics and strategies to enhance their compliance programs, among many others, to:

  • Network with your peers, including C-suite executives, legal professionals, HR leaders, and ethics and compliance visionaries.
  • Hear from 80+ respected cross-industry practitioners, including CEOs, CCOs, regulators, federal officials, and practitioners, to help inform and shape the strategic direction of your enterprise risk management program.
  • Hear directly from panels on leadership, fraud detection, confronting regulatory change, abiding by cross-border rules and regulations, and the always-favorite fireside chats.
  • Bring actionable takeaways from various session types, including cyber, AI, Compliance, Board obligations, data-driven compliance, and many others, to your program for you to listen, learn, and share.
  • Compliance Week aims to arm you with information, strategy, and tactics to transform your organization and career by connecting ethics to business performance through process augmentation and data visualization.

I hope you can join me at the event. For information on the event, click here. As an extra benefit to listeners of this podcast, Compliance Week is offering a $200 discount on the registration price. Enter the discount code TFOX2024 for $200 off.

The Compliance Podcast Network produces the Compliance Week 2024 Preview Podcast series. Compliance Week sponsors this series.

Categories
Compliance Into the Weeds

Compliance into The Weeds: The ACFE 2024 Anti-Fraud Technology Benchmarking Report

The award-winning Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject. Looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode, Tom and Matt look at the recent ACFE publication of its 2024 Anti-Fraud Technology Benchmarking Report and what it means for compliance professionals.

The ACFE 2024 Antifraud Technology Benchmarking report unveils an intriguing shift towards the use of AI in antifraud analytics, with a significant 83% of respondents planning to adopt generative AI in the coming years. However, the report also highlights a gap in current practices, with only a quarter of organizations utilizing analytics for corruption and bribery detection. Tom views this report as a crucial tool for understanding the evolving landscape of fraud detection. He emphasizes the importance of staying ahead of technological advancements and the potential risks of not having sophisticated tools for managing fraud investigations.

Similarly, Matt underscores the report’s insights into the challenges faced by antifraud professionals. He stresses the importance of aligning analytical capabilities with manpower resources and the critical role of experienced professionals in managing complex issues like bribery and corruption. Both perspectives highlight the need for a strategic blend of technology and human expertise in the ever-evolving world of compliance and audit.

Key Highlights:

  • Generative AI Integration in Antifraud Analytics
  • Generative AI Impact on Fraud Examination Trends
  • AI’s Role in Fraud Detection and Compliance
  • Detecting Financial Fraud Through Advanced Analytics

Resources:

Matt on Radical Compliance

Tom 

Instagram

Facebook

YouTube

Twitter

Categories
Data Driven Compliance

Data Driven Risk Management and Fraud Prevention

Are you struggling to keep up with the ever-changing compliance programs in your business? Look no further than Tom Fox’s award-winning podcast, Data-Driven Compliance. This podcast features an in-depth conversation about the uses of data and data analytics in compliance programs. Data-Driven Compliance is back with another exciting episode. Today, I take a solo turn to explore how data-driven compliance has moved from cutting-edge compliance to part of a best practices compliance program to becoming table stakes to do business in a multi-national world.

AI and data-driven compliance solutions are revolutionizing risk management and fraud prevention practices, offering advanced analytics, machine learning, and automation to enhance decision-making processes, improve efficiency, and proactively address compliance risks. These tools are essential for companies to navigate the complex regulatory landscape. Understanding the transformative power of data-driven approaches in compliance and risk management is critical for every compliance professional. User adoption is critical, for even the most advanced technology will not be effective if not embraced and utilized by compliance professionals. There is also a need to balance automation and human judgment to ensure the effectiveness of these tools in risk management.

Key Highlights:

  • Data-Driven Compliance Tools for Risk Management
  • Optimizing Decision-Making with AI-Driven Compliance Tools
  • Transformative Data-Driven Fraud Detection and Prevention

Tom Fox

Connect with me on the following sites:

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

The SAP FCPA Enforcement Action-Part 5: Lessons Learned

We conclude our series on the initial Foreign Corrupt Practices Act (FCPA) enforcement action. It involved the German software giant SAP. While the conduct which led to the enforcement action occurred for a lengthy period of time and was literally worldwide in scope, the response by SAP is to be both noted and commended. The hard and impressive work that SAP did during the pendency of the investigation and enforcement action led to a very favorable result for the company in the reduced amount of its assessed fine and penalty as well as the fact that no monitor was mandated by the Department of Justice (DOJ) or Securities and Exchange Commission (SEC). Today, in our final post, we review key lessons learned from the SAP enforcement action.

Remediation

SAP did an excellent job in its remedial efforts. Whether SAP realized as a recidivist of the dire straits it was in after the publicity in South Africa around is corruption or some other reason, the company made major steps to create an effective, operationalized compliance program which met the requirement of the Hallmarks of an Effective Compliance Program as laid out in the 2020 FCPA Resource Guide, 2nd edition.

The remedial actions by SAP can be grouped as follows.

  1. Root Cause, Risk Assessment and Gap Analysis. Here the company conducted a root cause analysis of the underlying conduct then remediating those root causes, conducted a gap analysis of internal controls, remediating those found lacking; and then performed a comprehensive risk assessment focusing on high-risk areas and controls around payment processes, using the information obtained to enhance its compliance risk assessment process;
  2. Enhancement of Compliance. Here the company significantly increasing the budget, resources, and expertise devoted to compliance; restructuring its Offices of Ethics and Compliance to ensure adequate stature, independence, autonomy, and access to executive leadership; enhanced its code of conduct and policies and procedures regarding gifts, hospitality, and the use of third parties; enhanced its reporting, investigations and consequence management processes;
  3. Change in sales models. On the external sales side, SAP eliminated its third-party sales commission model globally, and prohibiting all sales commissions for public sector contracts in high-risk markets and enhanced compliance monitoring and audit programs, including the creation of a well-resourced team devoted to audits of third-party partners and suppliers. On the internal side, SAP adjusted internal compensation incentives to align with compliance objectives and reduce corruption risk;
  4. Data Analytics. Here SAP expanded its data analytics capabilities to cover over 150 countries, including all high-risk countries globally; and comprehensively used data analytics in its risk assessments.

Data Analytics

The references to data analytics and data driven compliance warrant additional consideration. SAP not only did incorporate data analytics into its third-party program but also expanded its data analytics capabilities to cover over 150 countries, including all high-risk countries globally. The SEC Order also noted that SAP had implemented data analytics to identify and review high- risk transactions and third-party controls. The SAP DPA follows the Albemarle FCPA settlement by noting that data analytics is now used by SAP to measure the compliance program’s effectiveness. This language follows a long line of DOJ pronouncements, starting with the 2020 Update to the Evaluation of Corporate Compliance Programs, about the corporate compliance functions access to all company data; this is the second time it has been called out in a FCPA settlement agreement in this manner. Additionally, it appears that by using data analytics, SAP was able to satisfy the DOJ requirement for implementing controls and then effectively testing them throughout the pendency of the DOJ investigation; thereby avoiding a monitor.

Holdbacks

Next was the holdback actions engaged in by SAP. The DPA noted, SAP withheld bonuses totaling $109,141 during the course of its internal investigation from employees who engaged in suspected wrongdoing in connection with the conduct under investigation, or who both (a) had supervisory authority over the employee(s) or business area engaged in the misconduct and (b) knew of, or were willfully blind to, the misconduct, and further engaged in substantial litigation to defend its withholding from those employees, which qualified SAP for an additional fine reduction in the amount of the withheld bonuses under the DOJ’s Compensation Incentives and Clawbacks Pilot Program.

Self-Disclosure

While this factor was not present in the SAP enforcement action, the message sent by the DOJ could not be clearer on not simply the expectation of the DOJ for self-disclosure but also the very clear and demonstrable benefits of self-disclosure. Under the Corporate Enforcement Policy, SAP’s failure to self-disclose cost it an opportunity of at least 50% and up to a 75% reduction off the low end of the U.S. Sentencing Guidelines fine range. Its actions as a criminal recidivist, resulted in it not receiving a reduction of at least 50% and up to 75% from the low end of the U.S.S.G. fine range but rather at 40% from above the low end. SAP’s failure to self-disclose cost it an estimated $20 million under the Sentencing Guidelines. It’s failure to self-disclose and recidivism cost it a potential $94.5 million in discounts under the Corporate Enforcement Policy. The DOJ’s message could not be any clearer.

Extensive Cooperation

There were also lessons to be garnered from SAP’s cooperation with the DOJ. While there was no mention of the super duper, extra-credit giving extensive remediation which Kenneth Polite discussed last year; when SAP began to cooperate, it moved to extensively cooperate. The DPA noted SAP “immediately beginning to cooperate after South African investigative reports made public allegations of the South Africa-related misconduct in 2017 and providing regular, prompt, and detailed updates to the Fraud Section and the Office regarding factual information obtained through its own internal investigation, which allowed the government to preserve and obtain evidence as part of its independent investigation…” Most interestingly, the DPA reported that SAP imaged “the phones of relevant custodians at the beginning of the Company’s internal investigation, thus preserving relevant and highly probative business communications sent on mobile messaging applications.” This is clear instruction around messaging apps in FCPA enforcement actions.

Resources

SEC Order

DOJ DPA

Categories
Everything Compliance

Everything Compliance – Episode 127, The Awesome Edition

Welcome to the only roundtable podcast in compliance as we celebrate our second century of shows. In this episode, we have the quartet of Jonathan Armstrong, Matt Kelly, and Jay Rosen, all hosted by Tom Fox, joining us on this episode to discuss some of the topics they are watching in 2024.

  1. Matt Kelly looks at the recently enacted Foreign Extortion Prevention Act (FEPA). He rants about the SEC getting hacked around the Bitcoin ETF announcement and reminds everyone to use two-factor authentication.
  2. Tom Fox shouts out to the University of Michigan for winning the College Football National Championship.
  1. Jonathan Armstrong looks at the intersection of AI and Operational Resilience and ties it to the need for greater Board skills in these areas. He shouts out to Jay Rosen, who is in transition and would be a great addition to any compliance product or service BD team.
  1. Jay Rosen opines on the DOJ’s Expectations for Data Driven Analytics in 2024. He shouts out to Robert Kraft and the New England Patriots for paying departing coach Bill Belichick his full 2024 salary.
  1. Jonathan Marks asks, What does it mean to be on a Board in 2024? He rants about the Philadelphia Eagles.

The members of the Everything Compliance are:

  • Jay Rosen – Jay is Vice President, Business Development, Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com
  • Karen Woody – One of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu
  • Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com
  • Jonathan Armstrong – is our UK colleague, who is an experienced data privacy/data protection lawyer with Cordery in London. Armstrong can be reached at armstrong@corderycompliance.com
  • Jonathan Marks can be reached at jtmarks@gmail.com.

The host, producer, ranter (and sometimes panelist) of Everything Compliance is Tom Fox, the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the Compliance Podcast Network.

For more information on Ethico and a free White Paper on top compliance issues in 2024, click here.

Categories
Blog

The SAP FCPA Enforcement Action-Part 3: The Comeback

This week we are taking a deep dive into the SAP Foreign Corrupt Practices Act (FCPA) enforcement action. In it, SAP agreed to pay the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) approximately $222 million in penalties and disgorgement. SAP also entered into a three-year Deferred Prosecution Agreement (DPA) with the DOJ. Given the multi-year (2014-2022) length of the various bribery and corruption schemes and worldwide geographic scope, the amounts paid in bribes and benefits garnered by SAP from their corruption; one might charitably wonder how SAP was able to reap such a positive outcome of only a fine and penalty totaling $222 million. We will explore that question today.

Extensive Cooperation

The starting point for this analysis is the DOJ DPA. The first key point to note is there was no self-disclosure by SAP. As the DPA noted, SAP only began to cooperate after investigative reports were made public in 2017 in South Africa about SAP’s bribery and corruption program. However from this point forward SAP moved to extensively cooperate. The DAP noted SAP “immediately beginning to cooperate after South African investigative reports made public allegations of the South Africa-related misconduct in 2017 and providing regular, prompt, and detailed updates to the Fraud Section and the Office regarding factual information obtained through its own internal investigation, which allowed the government to preserve and obtain evidence as part of its independent investigation…”

This cooperation included producing relevant documents and other information to the Fraud Section “from multiple foreign countries expeditiously, while navigating foreign data privacy and related laws;” SAP “voluntarily making Company officers and employees available for interviews;”  and took “significant affirmative steps to facilitate interviews while addressing witness security concerns”; interestingly SAP was required to resolve potential deconfliction issues between the its own internal investigation and the investigation being conducted by the DOJ. The company promptly collected, analyzed, and organized “voluminous information, including complex financial information.” It translated “voluminous foreign language documents to facilitate and expedite review by the Fraud Section and the Office.” Most interestingly, the DPA repored that SAP imaged “the phones of relevant custodians at the beginning of the Company’s internal investigation, thus preserving relevant and highly probative business communications sent on mobile messaging applications.”

The Remediation

The DPA reported extensive remediation by SAP as well and the information provided in the DPA is instructive for every compliance professional. The DPA noted that SAP engaged in the following remedial steps.

  1. Conducted a root cause analysis of the underlying conduct then remediating those root causes through enhancement of its compliance program;
  2. Conducted a gap analysis of internal controls, remediating those found lacking;
  3. Undertook a “comprehensive risk assessment focusing on high-risk areas and controls around payment processes and enhancing its regular compliance risk assessment process”;
  4. SAP documented its use of a “comprehensive operational and compliance data” into its risk assessments;
  5. SAP eliminating “its third-party sales commission model globally, and prohibiting all sales commissions for public sector contracts in high-risk markets”;
  6. “Significantly increasing the budget, resources, and expertise devoted to compliance;”
  7. Restructuring its Offices of Ethics and Compliance to ensure adequate stature, independence, autonomy, and access to executive leadership;
  8. Enhanced its code of conduct and policies and procedures regarding gifts, hospitality, and the use of third parties;
  9. Enhancing its reporting, investigations and consequence management processes;
  10. Adjusting compensation incentives to align with compliance objectives and reduce corruption risk;
  11. Enhanced and expanding compliance monitoring and audit programs, planning, and resources, including developing a well-resourced team devoted to audits of third-party partners and suppliers;
  12. Expanded its data analytics capabilities to cover over 150 countries, including all high-risk countries globally; and
  13. Disciplined “any and all” employees involved in the misconduct.

Obviously, SAP engaged in a wide range of remedial actions. It all started with a root cause analysis. Root Cause analysis was enshrined in the FCPA Resource Guide, 2nd edition as one of the Hallmarks of an Effective Compliance Program. It stated, “The truest measure of an effective compliance program is how it responds to misconduct. Accordingly, for a compliance program to be truly effective, it should have a well-functioning and appropriately funded mechanism for the timely and thorough investigations of any allegations or suspicions of misconduct by the company, its employees, or agents. An effective investigation’s structure will also have an established means of documenting the company’s response, including any disciplinary or remediation measures taken.”

In addition to having a mechanism for responding to the specific incident of misconduct, the company’s compliance program should also integrate lessons learned from any misconduct into the company’s policies, training, and controls on a go-forward basis. To do so, a company will need to analyze the root causes of the misconduct to timely and appropriately remediate those causes to prevent future compliance breaches. This SAP did during its remediation phase.

Equally of interest are the references to data analytics and data driven compliance. SAP not only did so around its third-party program but also expanded its data analytics capabilities to cover over 150 countries, including all high-risk countries globally. The SEC Order also noted that SAP had implemented data analytics to identify and review high- risk transactions and third-party controls. The SAP DPA follows the Albemarle FCPA settlement by noting that data analytics is now used by SAP to measure the compliance program’s effectiveness. This language follows a long line of DOJ pronouncements, starting with the 2020 Update to the Evaluation of Corporate Compliance Programs, about the corporate compliance functions access to all company data; this is the second time it has been called out in a settlement agreement in this manner. Additionally, it appears that by using data analytics, SAP was able to satisfy the DOJ requirement for implementing controls and then effectively testing them throughout the pendency of the DOJ investigation; thereby avoiding a monitor.

Next was the holdback/clawback actions engaged in by SAP. The DPA noted, SAP withheld bonuses totaling $109,141 during the course of its internal investigation from employees who engaged in suspected wrongdoing in connection with the conduct under investigation, or who both (a) had supervisory authority over the employee(s) or business area engaged in the misconduct and (b) knew of, or were willfully blind to, the misconduct, and further engaged in substantial litigation to defend its withholding from those employees, which qualified SAP for an additional fine reduction in the amount of the withheld bonuses under the DOJ’s Compensation Incentives and Clawbacks Pilot Program.

Finally, the DOJ related that SAP had enhanced and has committed to continuing to enhance its compliance program and internal controls, including ensuring that its compliance program satisfied the minimum elements set forth in Attachment C to DPA. Based upon all these factors, including SAP’s remediation and the state of its compliance program, and the Company’s agreement to report to the Fraud Section and the Office as set forth in Attachment D to this Agreement, the DOJ “determined that an independent compliance monitor was unnecessary.”

All-in-all a great result by and for SAP for which the company and its compliance team should take great credit in going forward.

Resources

SEC Order

DOJ DPA

Join us tomorrow where we consider fine and penalties.

Categories
Data Driven Compliance

Data Driven Compliance: The Journeys of Albemarle and ABB to Data – Driven Compliance

Are you struggling to keep up with the ever-changing compliance programs in your business? Look no further than the award-winning Data-Driven Compliance podcast, hosted by Tom Fox. This podcast features an in-depth conversation around the uses of data and data analytics in compliance programs. Data-Driven Compliance is back with another exciting episode. Today, I co-hosted with Vince Walden, CEO of KonaAI, to visit with our guests Andrew McBride, Chief Risk Officer at Albemarle, and Tapan Debnath, Head of Integrity, Regulatory Affairs, & Data Privacy—Process Automation at ABB, on their respective companies’ journeys to data-driven compliance.

We consider the importance of integrating due diligence systems with business conduct and anticipate 2024 to be a breakthrough year for data-driven compliance. McBride, recognized by the Department of Justice for his work in data-driven compliance, believes in the critical role of data in identifying and responding to risks, testing the effectiveness of compliance programs, and reporting to internal stakeholders. Debnath stressed the need for visibility and alignment with senior business stakeholders during investigations and the use of data analytics platforms to measure integrity and key performance indicators. Join Tom Fox, Vince Walden, Andrew McBride, and Tapan Debnath on this episode of the Data Driven Compliance podcast as they delve deeper into the challenges and importance of data-driven ethics and compliance programs.

Key Highlights:

  • Using data analytics to assess program effectiveness
  • Proactive risk management through continuous monitoring
  • Leveraging due diligence for proactive risk management
  • Data transparency and collaboration for compliance success
  • Transitioning from external dependencies to internal capabilities

Resources:

Vince Walden on LinkedIn

KonaAI

Tom Fox 

Connect with me on the following sites:

Instagram

Facebook

YouTube

Twitter

LinkedIn