Tag: DD

Categories
Blog

The Bre-X Mining Scandal: Part 5 – A Guide for the 2024 Compliance Professional (Part 1)

As we close out this series on the Bre-X mining scandal, the lessons from this notorious case continue to resonate, especially for today’s compliance professionals. The fraud that led to the downfall of Bre-X and the ensuing financial catastrophe for countless investors serves as a stark reminder of the pivotal role compliance plays in maintaining the integrity of any business. This two-part conclusion will explore the critical takeaways for compliance professionals in 2024. In Part 1, I focus on due diligence, transparency, corporate governance, conflict of interest, and regulatory compliance.

The Importance of Rigorous Due Diligence

If Bre-X taught us anything, it is the value of relentless due diligence. In today’s fast-paced business environment, where misinformation can spread like wildfire and trust is fragile, compliance professionals must maintain an unwavering commitment to fact-checking and independent verification.

Verification of Claims. Compliance officers are the gatekeepers of corporate integrity. The Bre-X scandal is a textbook case of what happens when claims are accepted at face value without proper scrutiny. In 2024, ensuring that all claims—whether they pertain to financial projections, resource estimates, or technological capabilities—are rigorously verified by qualified third parties is more crucial than ever. This due diligence must extend beyond simple paper trails; it requires thorough, boots-on-the-ground verification.

Third-Party Validation. One of the core failures in the Bre-X case was the reliance on internal data, which went unchecked. Today’s compliance landscape demands an external layer of assurance. Relying solely on the company’s self-reported information can be perilous. Independent third-party audits, validation, and assessments are no longer optional; they prevent corporate fraud. External experts often see red flags insiders miss due to oversight or willful blindness.

Transparency and Accurate Reporting

Transparency is the lifeblood of compliance, and the Bre-X scandal illustrates what happens when companies stray from this fundamental principle. The fine line between optimism and misleading information can be blurry, but compliance officers must ensure this line is never crossed.

Clear and Honest Disclosure. Today’s compliance professionals must act as the arbiter of clear and accurate corporate disclosure. More is needed to provide minimal information that technically complies with regulations; companies must fully disclose material facts related to their performance, risks, and operational realities. Bre-X misled investors with rosy projections based on fraudulent data. Modern compliance teams must guard against the temptation to oversell the company’s prospects or downplay significant risks.

Avoiding Misleading Information. The Bre-X debacle warns about the dangers of making exaggerated or false claims to investors and stakeholders. In 2024, compliance professionals must adopt a zero-tolerance stance toward misleading information. This requires close collaboration with all departments, ensuring financial reports, press releases, and investor communications are fact-checked, realistic, and grounded in verifiable data. The role of compliance in safeguarding against exaggeration or outright deception cannot be overstated.

Strengthening Corporate Governance

One of the critical failures in the Bre-X case was weak corporate governance. As companies grow in complexity, ensuring robust oversight from the boardroom down is essential.

Effective Oversight. Boards of directors must not only be present; they must be actively engaged in the business. The Bre-X scandal exposed how passive oversight can contribute to unchecked fraud. Compliance professionals should ensure that board members, especially independent ones, are empowered to ask tough questions and hold management accountable. In 2024, compliance officers should push for regular, thorough reviews of corporate governance practices, ensuring that the board remains active in safeguarding the company’s integrity.

Separation of Duties. Another key lesson from Bre-X is the need for a clear separation of duties. The concentration of power in a few individuals, especially in processes like reporting geological results, led to unchecked manipulation. Modern compliance frameworks must ensure no single person holds too much sway over critical processes. In areas such as financial reporting or resource assessments, compliance professionals must establish checks and balances that prevent conflicts of interest and reduce the risk of fraud.

Understanding and Mitigating Conflict of Interest

Bre-X was rife with conflicts of interest that, had they been addressed, might have mitigated the extent of the damage. In 2024, compliance professionals must be vigilant in identifying and managing potential conflicts at all levels of the organization.

Identifying Conflicts. Conflicts of interest can undermine the integrity of any organization through personal financial gain, favoritism, or unaddressed personal relationships. Compliance officers must develop robust mechanisms for identifying and addressing conflicts before they escalate. In the Bre-X case, certain individuals stood to personally gain from inflated stock prices directly conflicting with their fiduciary duties. Modern-day compliance professionals must establish clear conflict-of-interest policies and ensure these are consistently enforced.

Establishing Clear Policies. It is not enough to identify conflicts; companies must have clear policies and procedures to manage them. This includes mandatory disclosures, regular audits, and a strong ethical culture encouraging employees to report potential conflicts. Employees should be trained to recognize conflicts of interest and be empowered to raise concerns without fear of retaliation. The Bre-X scandal reminds us that an unaddressed conflict of interest can lead to catastrophic outcomes for all stakeholders.

Enhanced Focus on Regulatory Compliance

Finally, the Bre-X scandal illustrates the importance of adhering to industry standards and anticipating regulatory changes. In the wake of Bre-X, Canada introduced NI 43-101, a set of strict guidelines for reporting mineral resources. The lesson here is that compliance professionals must stay current with regulations and be proactive in their approach.

Adhering to Industry Standards. In 2024, industry standards are constantly evolving. Whether environmental regulations, data privacy laws, or sector-specific standards like NI 43-101, compliance professionals must ensure that their organizations are always fully compliant. This requires staying informed about changes in the regulatory landscape and ensuring that the company’s internal practices are aligned with the latest requirements.

Proactive Compliance. Compliance officers should take a proactive approach rather than waiting for regulations to change. This includes monitoring industry trends, participating in industry working groups, and maintaining open lines of communication with regulators. Proactive compliance can prevent costly legal battles and protect the company’s reputation.

The Bre-X mining scandal remains a cautionary tale for compliance professionals, and the lessons learned from this case are more relevant than ever in 2024. By emphasizing rigorous due diligence, transparency, corporate governance, conflict of interest management, and proactive regulatory compliance, compliance officers can help safeguard their organizations against fraud and mismanagement that led to Bre-X’s downfall.

In Part 2 of this series, we will conclude this blog post by diving deeper into the evolving role of technology and how it has transformed the compliance landscape, offering new tools and challenges for today’s compliance professionals. Join us tomorrow.

Categories
2 Gurus Talk Compliance

2 Gurus Talk Compliance – Episode 23 — The Sustainability Edition

What happens when two top compliance commentators get together? They talk about compliance, of course. Join Tom Fox and Kristy Grant-Hart in 2 Gurus Talk Compliance as they discuss the latest compliance issues in this week’s episode! In this episode, Tom and Kristy take on a wide variety of compliance related topics.

In the ever-evolving world of regulatory compliance and risk management, challenges are constant, and strategies must be dynamic. Tom highlights the focus on the Tesla Board, celebrates the OECD at 25, bemoans New Zealand’s drop in the TI-CPI, reviews the HP acquisition of Autonomy and looks at the differences in Binance and FTX enforcement.  Kristy highlights the slave labor allegations, EU sustainability law, the ease of whistleblower restrictions, the EU and AI, and checks in on Florida Woman. Join Tom Fox and Kristy Grant-Hart as they delve deeper into these issues in this episode of the 2 Gurus Talk Compliance podcast.

Topics Discussed:

1.     Chinese Slave Labor Allegations Hold Up VW’s Audi, Porsche, and Bentley Vehicles in U.S. Ports (MotorTrend)

2.     EU Corporate Sustainability Due Diligence Law Most Likely Dead, For Now (Forbes)

3.     US Supreme Court’s UBS case makes it easier for whistleblowers to win suits (Reuters)

4.     How EU AI Act May Accelerate Compliance Regime for U.S. Enterprises (WSJ)

5.     The Tesla Board Chair is under scrutiny for oversight of the company.  (NYT)

6.     A tale of 2 corps: Binance and FTX. (Reuters)

7.     OECD at 25.  (The Hill)

8.     No DD, no problem as HP seeks $4bn from Mike Lynch.  (Bloomberg)

9.     New Zealand drops to No. 3 on TI-CPI. (The Conversation)

10.  Woman swipes $1.5 million and splurges on flights, Carnival cruises, Florida cops say (Yahoo)

Resources 

Kristy Grant-Hart on LinkedIn

Spark Consulting

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
2 Gurus Talk Compliance

2 Gurus Talk Compliance – Episode 10 – Ethical Remote Workers Edition

What happens when two top compliance commentators get together? They talk compliance of course. Join Tom Fox and Kristy Grant-Hart in 2 Gurus Talk Compliance as they discuss the latest compliance issues in this week’s episode!

Tom and Kristy consider the possibility of an international anti-bribery court, challenges in enforcing judgments against countries without strong anti-corruption laws, and the United States’ unlikely participation. The European Commission issued an adequacy decision regarding data transfers between the US and EU, resolving a long-standing issue, but privacy advocate Max Schrems plans to challenge its validity. The importance of on-site due diligence, and the value of on-site audits and cybersecurity disclosure were also explored. The benefits of remote work, global anti-corruption efforts, AI safeguards, and the dangers of zero tolerance policies were covered as well. The conversation provided insights into various compliance-related topics.

Highlights Include

·      World ABC Court

·      No DOJ control on Cognizant investigation.

·      SEC adopts Cyber disclosure rules.

·      Fight against corruption in Ukraine.

·      Goldilocks Compliance.

·      Data Privacy Framework Program Launches New Website Enabling U.S. Companies to Participate in Cross-Border Data Transfers

·      Site Visits: Sometimes the Best Due Diligence is Done on Foot

·      New Data Reveals that Remote Workers are Likely More Ethical than their Office Counterparts.

·      White House Says Amazon, Google, Meta, Microsoft Agree to AI Safeguards

·      Man Steals Vehicle, Crashes it into Building during Search for WiFi Connection

 Resources 

  1. WSJ Risk and Compliance Journal
  2. FCPA Blog
  3. Radical Compliance
  4. Dept. Of Commerce Press Release
  5. WSJ
  6. Conflicts of Interest Blog
  7. GAB
  8. Fast Company
  9. Fox 35 Orlando

Connect with Kristy Grant-Hart on LinkedIn

Spark Consulting

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
FCPA Compliance Report

FCPA Compliance Report – Candice Tal on Due Diligence: Levels and Evaluation

Welcome to the award-winning FCPA Compliance Report, the longest running podcast in compliance. Join Tom Fox, the host of FCPA Compliance Report, as he speaks with Candice Tal, founder and CEO of Infortal. Get ready to boost your compliance program in this exciting episode of FCPA Compliance Report. In this episode, Tom and Candice discuss the three levels of due diligence typically used to investigate joint venture partners and senior executives and the significance of conducting thorough due diligence. Level one is for low-risk situations, level two is for moderate-risk situations, and level three is for high-risk situations that require deep dark web searches. The key takeaways are to never skimp out on basic due diligence and to consider level three due diligence for high-risk areas or key executives. Don’t miss out on this informative episode of FCPA Compliance Report hosted by Tom Fox and featuring Candice Tal!

 Key Highlights

·      Introduction of Candice Tal

·      What are the 3 levels of due diligence.

·      What is deep dive due diligence.

·      Finding reputational issues.

·      Evaluating due diligence.

Notable Quotes

“Due diligence typically is sorted out into 3 general levels or tiers.”

“If you’re not doing deep dive due diligence, you’re not finding reputational issues.”

“You just can’t find reputational issues on database searches.”

Resources

Candice Tal on LinkedIn

Infortal

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program for 3rd Parties – The How Question in Due Diligence

What is satisfactory due diligence under the FCPA? That question seems more important after the story on Unaoil S.A.M. and the subsequent release of the Panama and Paradise Papers. However, both events largely focused on the “who” part of due diligence and the need to know with whom you are doing business in the future. However, another important question that does not come up as often in due diligence is how?

How does a third party perform its services with or for your company? How can a third party help you make sales if it is on the sales side? If a third party comes through the supply chain, how do their products or services meet the needs of your company? Suppose the third party has a closer business relationship, such as a JV, teaming agreement, or similar arrangement. In that case, you may need a much deeper understanding of how this third party does business because the relationship may become so close you will be intertwined with the party. It may mean more than how their product works, but how does this third party conduct themselves and their business?

 Three key takeaways:

1. The how question can be as critical as the who question.

2. The more integrated a third party is into your operations, the more important this question becomes.

3. Incorporate a how-to question into your due diligence and ongoing monitoring and auditing after the contract is signed.

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program for 3rd Parties – Due Diligence

Most companies fully understand the need to comply with the requirements around third parties, as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up-and-running business. This means they may need to bring resources to bear while continuing to operate an ongoing business. This can be particularly true in performing due diligence on third parties. Many companies understand the need for a robust due diligence program to investigate third parties but have struggled with creating an inventory to define the basis of third-party risk and perform the requisite due diligence required.

It is stated in the 2023 ECCP that: “Risk-Based and Integrated Processes—How has the management of the company’s third-party process corresponded to the nature and level of the enterprise risk identified by the company? How has this process been integrated into the relevant procurement and vendor management processes?”

Getting your arms around due diligence can sometimes be bewildering for the compliance practitioner. The information you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “As part of risk-based due diligence, companies should understand the qualifications and associations of their third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.”

 Three key takeaways:

1. Risk rank your third parties and use this as a basis for adequate due diligence.

2. Any red flags which appear must be cleared, and there must be documented evidence of such clearance.

3. There must be documented evidence of a review of the due diligence.

Categories
2 Gurus Talk Compliance

2 Gurus Talk Compliance – Episode 3

What happens when two top compliance commentators get together? They talk compliance, of course. Join Kristy Grant-Hart and Tom Fox for their new podcast, 2 Gurus Talk Compliance! But it is not simply Kristy and Tom talking about compliance. In this podcast series, Kristy and Tom also review other top commentators in compliance. In this podcast, we discuss the recent jail time for a Wells Fargo executive, the UK government’s plan to enforcement of anti-corruption and AML violations, due diligence before acquiring a company, and the recent charges against the co-founder of FTX. They also touch on the shift towards valuing a healthier relationship with work and the potential of the Metaverse in the compliance industry. Tune in to hear Tom and Kristy break down the latest compliance news and provide valuable insight into the industry that will keep you ahead of the curve.

 Highlights Include

·      Corporate Ethics and Compliance

·      The Wells Fargo Scandal and Criminal Accountability

·      Uncertainty surrounding CCO certification

·      UK Government’s Fight Against Corporate Crimes

·      COVID and the Future of Work

·      The Importance of Due Diligence in Acquisitions

·      Move into the compliance profession

·      Indictment of Samuel Bankman Fried

 Notable Quotes

1.      “If you buy a company engaging in bribery corruption, you’re not responsible for that. But when you take title and ownership, they are not engaging in broader corruption. It is you are engaging in broader corruption.”

2.     “I just think that flat banning of CHAT GPD is taking away hugely useful business tools to the Italian business sector.”

3.     “It is incredibly rare for a bank officer to be held criminally accountable.

4.     I think we’ll start to see that now move from becoming an extraordinary practice to a best practice to a regular practice to table stakes.

Resources 

1.     Italy Bans ChatGPT

2.     Why have workers given up the office

3.     CCO certifications

4.     Getting your first job in compliance

5.     SBF and the FCPA

6.     Carrie Tolstedt pleads guilty

7.     UK to invest in economic crime enforcement

8.     What is happening to the Metaverse

9.     Flutter settles FCPA enforcement action

Connect with Kristy Grant-Hart on LinkedIn

Spark Consulting

Connect with Tom Fox on Linkedin

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program for Business Ventures-Why Business Ventures are Different than 3rd Parties

Business ventures, whether JVs, partnerships, franchises, team agreements, strategic alliances or one of the myriad types of business relationships a U.S. company can form outside the U.S., are different than the usual risk presented by third-parties under compliance requirements such as those mandated by the FCPA. The problems for companies is that they tend to treat business venture risk the same as third-party risk. They are different and must be managed differently.

The bottom line is that may compliance practitioners have not thought through the specific risks of business ventures such as JVs, franchises, strategic alliances, teaming partner or others as opposed to sales agents or representatives on the sales side of the business. I hope that this will help facilitate a discussion that maybe people will begin to think about more of the issues, more of the risk parameters and perhaps put a better risk management strategy in place.
Three key takeaways:

  1. Business ventures bring different FCPA risks from third-parties.
  2. JVs have both external compliance risks and corporate governance risks.
  3. Use your full compliance tool kit for business ventures in managing the FCPA risk for franchises.
Categories
Blog

Reprioritizing Your Third-Party Risk Management Program-Questionnaire and Due Diligence

Are you considering a third-party questionnaire for your organization? With so much debate around what should be asked, and how detailed you should be, it can be hard to know where to start. In this 5-part blog post series, sponsored by Diligent, I will consider the full range of third-party risk management. Today, we consider the third-party questionnaire and I am joined by Stephanie Font, the director of the Operations Optimization Group at Diligent as we discuss third party questionnaires and due diligence investigations.

With so much debate around what should be asked in your questionnaire and how detailed your questionnaire should be, it can be hard to know where to start. It is important that every compliance professional understand your risk profile to all crafting of the right due diligence process to ensure compliance. Here are the steps you need to follow to also get compliance and  risk.:

  1. Questionnaire: Gathering basic information about the third party and what regulations need to be complied with.
  2. Due Diligence Investigation: Investigating the third party based on their answers to the questionnaire and other risk factors.
  3. Documenting: Keeping records of the due diligence investigations to be used in the future.

Questionnaire: Gathering basic information about the third party and what regulations need to be complied with.

The first step to managing third parties is to create a questionnaire to gather basic information about the third party and what regulations need to be complied with. When creating the questionnaire, it is important to understand the organization’s risk model and what it is trying to achieve. The questionnaire should be tailored to the specific risk factors the organization is trying to address, as well as the regulations that need to be complied with. Questions should include items such as the size of the company, where they do business, and the type of relationship they have. Additionally, the questionnaire should ask questions that will alert to any potential risk factors, such as if they do business in a highly sanctioned country. Once the questionnaire is sent and responses are received, the answers can be used to inform the next step of the due diligence process. Your third-party risk management system should automate some of the process by flagging risk factors and indicating what level of investigation is needed. Lastly, it is important to document the process and create an audit trail that can be used for various reasons, such as compliance and internal review.

Due Diligence Investigation: Investigating the third party based on their answers to the questionnaire and other risk factors.

The second step of third-party due diligence is the due diligence investigation. This step involves investigating the third party based on their answers to the questionnaire and other risk factors. The best approach to this investigation is to first understand the company’s risk and what it is trying to accomplish. This allows the company to create a risk model and tailor the questionnaire to fit their needs. The questionnaire should include questions about the size of the company, where it does business, and other risk factors that may arise. After the questionnaire is complete, the next step is to assess the risk factors and determine the appropriate level of investigation needed. This could range from a baseline screening for sanctions list and other global databases to an enhanced due diligence investigation which involves boots on the ground to ask questions about the company’s reputation and verify a manufacturing site. Additionally, it is important to document the process to create an audit trail for internal stakeholders and regulators. This process should be tracked in a third-party risk management system to ensure everything is done correctly.

Documenting: Keeping records of the due diligence investigations to be used in the future.

Documenting is an important step in the due diligence process, as it helps to create an audit trail of the activities and decisions that were taken. When it comes to due diligence, it is important to keep records of all investigations that were conducted, as these records can be used in the future to defend any decisions that were taken. This allows for all the necessary information to be stored in a secure location and can even track any changes or updates to the investigations over time. Additionally, the system can be used to flag any potential risks that come up in the investigations, and it can also automate the process of deciding which type of investigation is necessary based on the risk model. Finally, it is important to keep all documents related to the due diligence process, such as the questionnaire, investigation reports, and any other relevant documents, to create an audit trail and ensure that all compliance regulations are met.

Third party due diligence is a crucial part of any compliance program. A thorough questionnaire and a detailed due diligence investigation can help organizations to mitigate risk and ensure compliance with applicable regulations. Additionally, it is important to document the process, as this creates an audit trail that can be used in the future. With the right tools and processes in place, organizations of any size can successfully manage third party risk and create a robust compliance program. With the right information and guidance, you too can create a successful third-party due diligence process for your organization.

For more information, on Diligent’s Third Party Risk Management solution, click here.

Listen to Stephanie Font on the podcast series here.

Categories
Blog

Levels of Due Diligence-Part 1

Due diligence will always be a basis of any best practices compliance program. Over the next couple of days, I will consider the levels of due diligence and detail how each category will help to inform your compliance program.

Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.

The 2020 Update to the Evaluation of Corporate Compliance Programs stated, “A well-designed compliance program should apply risk-based due diligence to its third-party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.”

The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.

A three-step approach was discussed in Opinion Release 10-02, in which the DOJ discussed the due diligence that the requesting entity performed:

First, it [the requestor] conducted an initial screening of six potential grant recipients by obtaining publicly available information and information from third-party sources … Second, the Eurasian Subsidiary undertook further due diligence on the remaining three potential grant recipients. This due diligence was designed to learn about each organization’s ownership, management structure and operations; it involved requesting and reviewing key operating and assessment documents for each organization, as well as conducting interviews with representatives of each MFI [microfinance institution] to ask questions about each organization’s relationships with the government and to elicit information about potential corruption risk. As a third round of due diligence, the Eurasian Subsidiary undertook targeted due diligence on the remaining potential grant recipient, the Local MFI. This diligence was designed to identify any ties to specific government officials, determine whether the organization had faced any criminal prosecutions or investigations, and assess the organization’s reputation for integrity.

This Opinion Release sets out a clear break which every compliance practitioner should use in considering an appropriate level of due diligence to engage with your third-party risk management process or when considering the level of due diligence required on a potential business venture partner. A very good description of the three levels of due diligence was presented by Candice Tal, Founder and CEO of Infortal Worldwide, in an article entitled, Deep Level Due Diligence: What You Need to Know.

Level I. First level due diligence typically consists of checking individual names and company names through several hundred Global Watch lists comprised of AML, anti-bribery, sanctions lists, coupled with other financial corruption and criminal databases. These global lists create a useful first-level screening tool to detect potential red flags for corrupt activities. It is also a very inexpensive first step in compliance from an investigative viewpoint. Tal believes that this basic Level I due diligence is extremely important for companies to complement their compliance policies and procedures; demonstrating a broad intent to actively comply with international regulatory requirements.

Level I should also consider beneficial ownership records where available, and company tax information to assess whether the third party is financially sound and in compliance with tax payments as required within its primary country of business, plus a check of perceived business risks in that country. Additionally, the third party’s website should also be reviewed; it is unusual for a company to not have a website and this can be a preliminary flag that there are issues. Tal recommends verifying that the company address also exists; a non-verifiable address should be considered a potential red flag which would indicate the need for a deeper level due diligence investigation.

Join us tomorrow as we explain Levels 2 & 3 of due diligence and conclude this blog post series.