Categories
Blog

AI in Compliance: Part 2, Leveraging AI for Third-Party Risk Management

We continue our week-long look at the use of AI in compliance. Today, we consider third parties. Third-party relationships remain one of the most significant areas of risk for corporate compliance programs. From supply chain partners to distributors and everything in between, third parties act as the face of your organization in many jurisdictions, making their actions, and any misconduct, your problem. To mitigate these risks, companies traditionally relied on periodic due diligence and reactive responses. But in today’s fast-moving and increasingly interconnected world, such approaches fall short.

This is where artificial intelligence (AI) can revolutionize third-party risk management. With AI tools, compliance teams can shift from static, checklist-driven processes to dynamic, continuous monitoring systems. In this post, we’ll explore how AI enhances third-party risk management by screening, monitoring, and evaluating third parties in real time and how it helps meet the DOJ’s 2024 Evaluation of Corporate Compliance Programs (2024 ECCP) expectations for robust, data-driven compliance practices.

The DOJ’s 2024 ECCP places a strong emphasis on using data analytics and continuous monitoring to strengthen compliance programs. These expectations are included with the requirements of a proactive risk management and data-driven compliance. AI allows compliance teams to manage a large volume of third-party relationships efficiently and effectively. To fully align with DOJ expectations, companies should document their use of AI tools, including how they support risk assessments and monitoring activities. Regular audits of AI systems can ensure they remain effective and compliant with legal standards.

AI: The Compliance Professional’s New Ally

The compliance risks tied to third parties are well-documented:  bribery and corruption, reputational damage, and legal and regulatory violations. AI excels at handling exactly the complexity of third-party management entails. It can process vast amounts of data from multiple sources, identify patterns, and provide actionable insights in real-time. Let’s break down how AI can be used at each stage of the third-party lifecycle.

  • Initial Screening.

Traditional screening processes rely on questionnaires and public database checks—important but limited in scope. AI-powered tools enhance this step in a variety of ways. By aggregating diverse data sources, AI systems can pull information from public records, news outlets, litigation databases, social media platforms, and proprietary sources. Through the use of natural language processing (NLP) algorithms, you can detect hidden risks through the analysis of news articles, blogs, or social media posts to uncover potential red flags, such as allegations of fraud, regulatory violations, or ethical misconduct. Finally, with scored risk profiles, AI models assess the likelihood of misconduct based on factors such as geographic risk, industry norms, and historical behavior. This risk scoring allows compliance teams to prioritize their efforts.

  • Onboarding Due Diligence

The onboarding phase is critical for setting the tone of the relationship and understanding the potential risks. AI can assist you in a variety of ways. With automated document review, AI tools can process contracts, certifications, and policies submitted by third parties, flagging inconsistencies or missing information. One area that continues to bedevil due diligence is the identification of Beneficial Ownership. By cross-referencing corporate records, AI can reveal ultimate beneficial owners, including individuals who might otherwise remain hidden. Machine learning (ML) models trained on historical compliance data can predict the likelihood of future misconduct, enabling proactive risk mitigation strategies through predictive insights. The bottom line is that by ensuring a thorough onboarding process, AI helps organizations comply with DOJ guidance, which emphasizes the importance of understanding third-party relationships.

  • Continuous Monitoring

A one-time due diligence exercise is no longer sufficient. The 2024 ECCP made clear the need for ongoing monitoring to ensure that third-party relationships remain compliant. AI facilitates this mandate by offering real-time alerts, where AI-driven systems can monitor news feeds, regulatory databases, and other sources 24/7, sending alerts when a third party is implicated in a legal issue, sanctions violation, or reputational scandal. One of the more challenging areas for compliance professionals has in around transaction monitoring. Here, AI can analyze financial transactions involving third parties, flagging anomalies that might indicate fraud or corruption. Finally, in the area of behavioral analytics, AI tools can track changes in a third party’s behavior, such as a sudden increase in high-risk transactions or shifts in geographic focus. These patterns often signal emerging risks. The bottom line is that with continuous monitoring, companies can address potential problems before they escalate into full-blown compliance failures.

  • Periodic Risk Re-Evaluation

AI ensures that risk assessments are dynamic, reflecting changes in the external environment and the third party’s circumstances. As far back as 2020, the DOJ told compliance professionals that risk assessments should be performed with your organization’s risk change, so a periodic risk re-evaluation directly aligns with the DOJ’s expectations. Key AI capabilities in this area include geopolitical risk analysis, using AI to evaluate the impact of geopolitical events, such as sanctions, trade disputes, or political instability, on third-party relationships. Your industry trends are something the DOJ has been talking about for at least 10 years, and AI systems can monitor regulatory developments and industry trends, helping organizations anticipate new compliance risks. Perhaps most excitedly are the customizable risk models you can create with AI. This would allow compliance teams to adjust risk assessment models based on evolving business needs, ensuring that evaluations remain relevant and actionable.

Overcoming Challenges in AI Implementation

While the benefits of AI are clear, implementing these tools effectively requires careful planning and preparation in several areas. First is your data quality. The old adage of GIGO (Garbage In, Garbage Out) has been replaced by BIBO (Best Input, Best Output). Here, AI is only as effective as the data it analyzes. Organizations must invest in robust data governance practices to ensure accuracy, completeness, and consistency.

Transparency is a key issue for compliance in using AI, and it was directly addressed in the 2024 ECCP. The black-box nature of AI decision-making can be a concern. Compliance teams should work with internal teams and vendors to ensure algorithms are interpretable and results are explainable. AI tools must integrate seamlessly with existing compliance systems to avoid creating silos or inefficiencies. While the US is far behind the rest of the world in data privacy laws, GDPR and others still apply to any internationally facing organization. This means companies must deploy AI responsibly, respecting privacy laws and ensuring that monitoring does not cross ethical boundaries.

The Future of Third-Party Compliance

AI is transforming third-party risk management from a reactive, one-size-fits-all process into a dynamic, data-driven discipline. By leveraging AI tools for screening, onboarding, monitoring, and reassessment, compliance professionals can manage third-party risks with unprecedented precision and agility. However, as with any powerful tool, AI must be used thoughtfully. By focusing on data quality, transparency, and ethical considerations, organizations can harness the full potential of AI while maintaining trust and accountability.  At the end of the day, a best practices compliance program is not simply about checking the box; rather, it is about creating a system that evolves with the risks it manages. AI is that system’s next evolution.

Categories
10 For 10

10 For 10: Top Compliance Stories For the Week Ending December 7, 2024

Welcome to 10 For 10, the podcast that brings you the week’s Top 10 compliance stories in one podcast each week. Tom Fox, the Voice of Compliance, brings you the compliance professional and the compliance stories you need to know to end your busy week. Sit back, and in 10 minutes, hear the stories every compliance professional should know from the prior week. Every Saturday, 10 For 10 highlights the most important news, insights, and analysis for the compliance professional, all curated by the Voice of Compliance, Tom Fox. Get your weekly filling of compliance stories with 10 for 10, a podcast produced by the Compliance Podcast Network.

  • McKinsey agrees to FCPA settlement for corruption in South Africa. (DOJ Press Release)
  • Judge rejects DOJ/Boeing settlement.  (WSJ)
  • Defense in Trafigura case can’t knock out star prosecution witness. (FT)
  • Was it corruption or a smart (or dumb) business deal? (TNR)
  • Tesla lost the case on the 2nd Musk pay package. (WSJ)
  • Was it fraud or worse? (NYT)
  • Paul Atkins was selected to head SEC. (FT)
  • Trump-appointed Texas judge enjoins CTA nationally. (Bloomberg)
  • OIG looks to hold nursing care execs responsible. (McKnight’s Long-Term Care News)
  • Buying/Selling homes and compliance.  (Mortgage News Daily)

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

You can check out the Daily Compliance News for four curated compliance and ethics-related stories each day here.

Check out the entire 3-book series, The Compliance Kids, on Amazon.com.

Connect with Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Daily Compliance News

Daily Compliance News: December 6, 2024 – The Boeing Settlement Bounced Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News—all from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, or general interest for the compliance professional.

  • He forgot what the Compliance Committee did. (FT)
  • Colombia’s Finance Minister was replaced. (Reuters)
  • McKinsey agrees to FCPA settlement for corruption in South Africa. (DOJ Press Release)
  • Judge rejects DOJ/Boeing settlement.  (WSJ)

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

Check out the entire 3-book series, The Compliance Kids, on Amazon.com.

Categories
FCPA Compliance Report

FCPA Compliance Report – Episode 737 – Navigating Compliance in a Trump Presidency: Insights and Concerns

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast in compliance. This edition delves into the implications of Donald Trump’s presidency for corporate compliance and ethics.

We share some initial thoughts from compliance officers and industry experts, exploring the widespread concern over Trump’s controversial character and potential impact on businesses’ ethical cultures. Key discussion points include the existential angst among compliance professionals, the future of FCPA enforcement, and the role of influential figures like Elon Musk in the Trump administration. The episode underscores the importance of maintaining robust compliance programs despite political uncertainties and the potential for increased regulatory challenges and internal corporate risks.

Highlights in this episode:

  • Compliance in the Trump Era
  • Existential Angst in Compliance
  • FCPA Enforcement Under Trump
  • Elon Musk’s Role in the Administration
  • The Future of Compliance and Governance
  • Conclusion: The Risks of Relaxed Controls

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

Check out the full 3-book series, The Compliance Kids, on Amazon.com.

For an audio/video version of the Compliance Kids book, Speaking Up is AWESOME, contact Tom Fox.

Categories
10 For 10

10 For 10: Top Compliance Stories For the Week Ending November 23, 2024

Welcome to 10 For 10, the podcast that brings you the week’s Top 10 compliance stories in one podcast each week. Tom Fox, the Voice of Compliance, brings you the compliance professional and the compliance stories you need to know to end your busy week. Sit back, and in 10 minutes, hear the stories every compliance professional should know from the prior week. Every Saturday, 10 For 10 highlights the most important news, insights, and analysis for the compliance professional, all curated by the Voice of Compliance, Tom Fox. Get your weekly filling of compliance stories with 10 for 10, a podcast produced by the Compliance Podcast Network.

  • Is bribery how business is done in India? (NYT)
  • Adami Group charged with fraud, FCPA violations. (NYT)
  • Trafigura heads to trial in Switzerland. (Bloomberg)
  • A layer of crypto corruption. (TheBulwark)
  • Firings as layoffs without benefits. (FT)
  • KPMG rehabbed in the UK.  (FT)
  • Founder of Crypto mixer sentenced to 3 years in prison. (WSJ)
  • Bill Hwang gets 18 years. (NYT)
  • Gary Wang receives no prison time. (NYT)
  • Jay Clayton was picked to head SDNY. (FT)

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

You can check out the Daily Compliance News for four curated compliance and ethics-related stories each day here.

Check out the full 3-book series, The Compliance Kids, on Amazon.com.

Connect with Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Compliance and AI

Compliance and AI: Demystifying AI Integration in Compliance: Insights from the DOJ

What is the role of Artificial Intelligence in compliance? What about Machine Learning? Are you using ChatGPT? These questions are but three of the many we will explore in this cutting-edge podcast series, Compliance and AI, hosted by Tom Fox, the award-winning Voice of Compliance. In this episode, Tom reflects on recent DOJ speeches on AI and the 2024 ECCP revisions concerning AI and compliance.

Tom discusses Deputy Assistant Attorney General Nicole Argentieri’s September speech and the 2024 Evaluation of Corporate Compliance Programs (ECCP). He also unpacks how compliance professionals are expected to manage AI-related risks rigorously. He offers actionable steps, such as conducting comprehensive risk assessments, implementing robust compliance controls, and ensuring ongoing monitoring and employee training. This episode is essential listening for compliance professionals aiming to stay ahead of AI-related challenges and align with the DOJ’s latest expectations.

Key highlights:

  • DOJ’s New Approach to AI in Compliance
  • Steps to Align Compliance Programs with DOJ Expectations
  • 2024 ECCP: Key Questions for Compliance Professionals
  • Proactive Strategies for Managing AI Risks

Resources:

For additional information check out the FCPA Compliance and Ethics Blog.

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Daily Compliance News

Daily Compliance News: November 22, 2024 – The All NYT Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance, brings you compliance-related stories to start your day. Sit back, enjoy a cup of morning coffee, and listen in to the Daily Compliance News—all from the Compliance Podcast Network. Each day, we consider four stories from the business world: compliance, ethics, risk management, leadership, or general interest for the compliance professional.

Today’s stories:

  • Matt Gaetz withdraws from AG nomination. (NYT)
  • Is bribery how business is done in India? (NYT)
  • Bill Hwang gets 18 years. (NYT)
  • Gary Wang receives no prison time. (NYT)

For more information on the Ethico Toolkit for Middle Managers, available at no charge, click here.

Check out the full 3-book series, The Compliance Kids on Amazon.com.

Categories
Daily Compliance News

Daily Compliance News: November 21, 2024-the Adani Group Edition

Welcome to the Daily Compliance News. Each day, Tom Fox, the Voice of Compliance brings to you compliance related stories to start your day. Sit back, enjoy a cup of morning coffee and listen in to the Daily Compliance News. All, from the Compliance Podcast Network. Each day we consider four stories from the business world, compliance, ethics, risk management, leadership or general interest for the compliance professional.

For the first time ever, the Daily Compliance News focuses on one story, the massive civil and criminal set of charges brought against the Adani Group and its founder Gautam Adani. Articles featured in this edition include, the NYT, FT and WSJ.

For more information on the Ethico Toolkit for Middle Managers, available at no charge by clicking here.

Check out the full 3-book series, The Compliance Kids on Amazon.com.

Categories
Compliance Into the Weeds

Compliance into the Weeds: DOJ Under Trump: FCPA Enforcement and Compliance

The award-winning, Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject more fully. Are you looking for some hard-hitting insights on compliance? Look no further than Compliance into the Weeds! In this episode of ‘Compliance into the Weeds,’ Tom Fox and Matt Kelly dive into the Trump Administration’s DOJ nominees, FCPA enforcement going forward, and what it may all mean for compliance professionals.

Tom and Matt explore the potential impacts of these nominations, notably the controversial choice of Matt Gaetz as Attorney General, and how they could shape the direction of anti-corruption enforcement and compliance practices. They also discuss the realistic aspects of other nominees, including Trump’s attorneys Todd Blanche and Emil Bove and former SEC Chairman Jay Clayton, who proposed to lead the Southern District of New York. The conversation touches on potential strategies for compliance officers, such as the increased significance of self-disclosure and the broader ramifications for corporate and foreign policy enforcement under a Trump administration.

Key highlights:

  • Trump’s DOJ Nominees: An Overview
  • Potential Changes in FCPA Enforcement
  • Self-Disclosure and Compliance
  • Implications for Compliance Officers

Resources:

Matt in Radical Compliance

Tom

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

Navigating the DOJ’s Complex Whistleblower Landscape: Key Insights for Compliance Professionals

The Department of Justice (DOJ) recently launched its Corporate Whistleblower Awards Pilot Program to tackle corporate misconduct under various laws. However, unlike the structured and familiar whistleblower frameworks of the SEC and CFTC, the DOJ’s approach has introduced a more fragmented system. Compliance professionals and company executives must prepare for the unique challenges and opportunities this evolving regulatory landscape presents. In a recent Law360 article, Navigating DOJ’s Patchwork Whistleblower Regime authors Patrick Campbell, Jonathan New, and Jimmy Nguyen explored these frameworks. Based on their article, I want to explore what compliance professionals need to know about the DOJ’s new whistleblower regime, the associated pilot programs, and practical steps to bolster your compliance program in light of this shift.

DOJ’s New Whistleblower Programs: A Patchwork Approach

Over the last year, the DOJ’s Criminal Division and several U.S. Attorney’s Offices have introduced several pilot programs, each designed to encourage individuals to report corporate misconduct in exchange for monetary rewards, Deferred Prosecution Agreements (DPAs) or Non-Prosecution Agreements (NPAs). These initiatives build on DOJ’s previous decade-long efforts to foster self-reporting and corporate accountability through clear compliance guidelines and structured voluntary disclosure policies. But this time, the DOJ has opted for a diverse, patchwork system of whistleblower programs instead of a unified framework.

The DOJ’s new whistleblower regime is primarily split into two types of programs:

  1. Monetary Awards Program. Launched on August 1, the Main Justice Pilot Program offers financial rewards for whistleblowers who come forward with information about specific types of corporate misconduct. The program focuses on financial crimes, foreign and domestic corruption, and healthcare fraud targeting private insurers.
  2. NPA Programs. Several U.S. Attorney’s Offices are more focused on granting leniency to whistleblowers who disclose information, even if they had a role in the misconduct. However, the specifics vary across different U.S. Attorney’s Offices, making it difficult for individuals and companies to anticipate how these programs will apply in practice.

Key Components of the DOJ’s Monetary Awards Program

The Pilot Program, which closely resembles the whistleblower programs of the SEC and CFTC, is designed to reward whistleblowers with up to 30% of forfeited proceeds for the first $100 million and 5% for amounts up to $500 million. To qualify, the information provided must:

  • This led to a successful enforcement action with over $1 million in net forfeiture proceeds.
  • Involve original information—meaning information independently obtained and not derived from public sources.
  • Be reported voluntarily and without a preexisting legal obligation to report.

To further incentivize individuals, the DOJ has clarified that any company retaliating against whistleblowers risks losing its cooperation credit and could face additional charges for obstruction of justice. Moreover, the DOJ amended its corporate enforcement policy, giving companies a 120-day window to self-report misconduct raised by an internal whistleblower before DOJ intervention.

U.S. Attorney’s Offices’ Programs: Encouraging Cooperation from Insiders

The U.S. Attorney’s Office’s whistleblower programs are aimed at insiders who may be involved in misconduct, providing them with an opportunity for leniency in exchange for cooperation. However, these programs vary significantly by jurisdiction. For instance, some offices exclude Foreign Corrupt Practices Act (FCPA) violations, while others include specific offenses relevant to their dockets, like intellectual property theft in Northern California and healthcare provider crimes in New Jersey.

This variation means that companies and whistleblowers need to understand the specific requirements of each U.S. attorney’s office program to maximize their eligibility and cooperation credit potential. While individuals can gain leniency for cooperating, the program’s qualifying factors—such as whether the whistleblower’s actions were voluntary and original—make it essential for companies to encourage internal reporting systems.

Implications of a Fragmented Whistleblower Framework

Unlike the SEC’s uniform and straightforward whistleblower program, the DOJ’s approach brings potential confusion. The variability across the DOJ and U.S. attorney’s offices creates a complex decision-making process for whistleblowers and their counsel, particularly when determining which office to approach and under which program. This lack of clarity may impact the quality and volume of tips the DOJ receives, as potential whistleblowers may hesitate due to perceived ambiguity in eligibility criteria, confidentiality protections, and financial award guarantees.

What This Means for Companies and Compliance Programs

While the DOJ’s whistleblower regime may seem daunting, it also significantly emphasizes voluntary disclosure and corporate accountability. Companies would be wise to address the DOJ’s renewed focus on whistleblowers proactively.

Here are several practical steps that compliance professionals should consider:

  1. Strengthen Internal Reporting Channels. Ensure that employees feel comfortable reporting potential misconduct internally without fear of retaliation. Employees should know they have a safe, reliable method for voicing concerns and that their reports will be taken seriously. Develop clear policies and protections for whistleblowers, as retaliation can cost a company valuable cooperation credit.
  2. Promptly Investigate Reports. DOJ’s policy now includes a 120-day grace period for self-reporting misconduct discovered through internal whistleblower channels. This means companies must prioritize timely investigations and decisions on whether to self-report to the DOJ, especially for conduct that could fall under the whistleblower programs’ target areas.
  3. Update Compliance Training Programs. Employees should be informed of their role in supporting the company’s compliance framework, particularly regarding ethical reporting. Conduct regular training on your whistleblower policies, emphasizing the importance of truthfulness, internal reporting channels, and the protections against retaliation. Training should be targeted, effective, and engaging.
  4. Incentivize Ethical Behavior. Compliance should be more than just an annual checkbox exercise. Companies must incentivize employees to uphold ethical standards by incorporating compliance criteria into performance reviews, compensation structures, and promotion decisions. This strongly conveys that ethical conduct is a priority and will be rewarded.
  5. Establish a Self-Disclosure Protocol. Given the DOJ’s new initiatives, companies need a clear process for evaluating whether and when to self-disclose misconduct to qualify for leniency. Ensure your compliance team is equipped to make quick assessments, especially for serious misconduct that may lead to forfeiture or prosecution.
  6. Align with DOJ Expectations on Compliance Programs. The DOJ’s 2024 Update to the Evaluation of Corporate Compliance Programs stressed the importance of having robust, responsive compliance structures that support a culture of ethical behavior. Companies should benchmark the number and nature of internal reports received, the speed of investigations, and corrective actions against publicly available data to assess their program’s effectiveness.

Looking Ahead: The DOJ’s Expanding Whistleblower Framework

The DOJ’s whistleblower regime is still evolving, with many current programs designated “pilots.” However, with U.S. attorney’s offices adopting new programs rapidly, we’ll likely see further developments, including more offices launching their versions of whistleblower awards and NPA initiatives. For companies, this means a sustained focus on compliance practices that support transparency, encourage reporting, and prioritize swift, decisive responses to misconduct.

Principal Deputy Assistant Attorney General Nicole Argentieri recently noted that the DOJ’s “tip line is open,” a clear message to compliance leaders that the agency is leveraging every available tool to uncover corporate misconduct. This heightened regulatory scrutiny means companies must ensure compliance programs meet DOJ standards and actively encourage a speak-up culture.

Final Thoughts: Navigating the New Whistleblower Regime

The DOJ’s fragmented whistleblower framework challenges companies, whistleblowers, and compliance teams. Nevertheless, these programs underscore the DOJ’s commitment to rooting out corporate misconduct through increased reliance on whistleblowers and internal disclosures. Compliance professionals play a critical role in this environment, as companies must have the right systems in place to respond promptly to reports of misconduct, protect whistleblowers, and, when necessary, self-report to the DOJ within the stipulated timeframe.

In this evolving regulatory landscape, companies must remain vigilant, ensuring that their compliance programs are robust, responsive, and capable of supporting a culture that values ethical conduct. By aligning internal practices with the DOJ’s expectations, companies can better navigate the complexities of the new whistleblower regime and position themselves for success in an increasingly scrutinized business environment.