Tag: Due Diligence

Categories
Blog

Lessons Learned from L’Affair Gruden

The fallout from the John Gruden imbroglio has widened and deepened. Many have asked why the NFL sat on the Gruden emails which were uncovered in the investigation of the toxic culture of the Washington football team, known to the NFL since the spring of this year, are only now coming into the public eye. Additionally, if the first email where Gruden disparaged the head of the NFL’s players union with a racial slur, which if it had not been brought to light by the Wall Street Journal (WSJ) on Sunday of this week, would it have been released by the NFL or Las Vegas Raiders at all? Finally, why did the NFL only send the first email to the Raiders when clearly there were many, many more that were unearthed. All good questions and they demonstrate several salient factors, not the least being as how the fallout from one event and investigation, can impact an entire industry. However, even without current answers to these and other questions there are several very important lessons for the compliance professional.
Don’t Put Stupid Stuff in Emails
Before we get to compliance, consider the most basic problem here. Not that Gruden is simply a racist, homophobe, sexist, misogynist and a person with little moral compass. We might have never known what was in his heart, if Gruden had not put those immoral values into emails over eight years. The reason he is now out of professional football, probably forever, is that he put his values into emails, in the crudest terms possible. Twenty years ago, I did corporate training on this very topic. That training is apparently still needed. Imagine how the civil litigation will look when all this gets to trial. All the plaintiff’s lawyer(s) will have to do is read the emails to demonstrate a wide variety of civil wrongs and regulatory breaches and the only question left will be damages.
Fallout from Unrelated Investigations
In the 21st century, nothing happens in a vacuum. The offending emails were uncovered in an unrelated investigation. These emails largely came from outside the entity being investigated (the Washington football team) and the investigative firm turned them over to the entity overseeing the investigation, here the NFL. As noted above, it is not clear what action the NFL might have taken against Gruden, his former employer ESPN or his current employer, the Las Vegas Raiders. Gruden’s resignation from the Raiders may well forestall an answer into those questions.
Now imagine the same scenario when the Securities and Exchange Commission (SEC) investigates Activism for its toxic work environment (or the Department of Justice (DOJ) for that matter) or when the SEC investigated Lordstown Motors for a variety of other fraud and accounting issues. What if a set of similar emails appeared, all coming from an outside 3rd party, such as Gruden’s did to the Washington football team President Bruce Allen? Would the company employing that same 3rd party receive an email from the SEC requesting all emails from the offending employee? Would the SEC want to look at all emails? How would your company respond? Is the EEOC going to get involved? Will they (or the SEC) be contacting ESPN, owned by the Walt Disney Company, a publicly traded organization about the culture at ESPN which allowed Gruden to send those emails. Are you ready to respond to them? 
What is Due Diligence?
No person wakes up in their mid-40s or 50s and thinks, today is the day I will start sending out racist, homophobic, sexist or misogynist emails and a throw away my moral compass. No one. They were like that long before they started doing so. Gruden had thought and felt those things long before he put them into print. Put another way, a leopard does not change it spots overnight. They were there for a long time.
As our colleague Candice Tal, founder of Infortal, continually reminds us, due diligence is not a one-time event nor a cursory google search. It is a sustained deep dive investigation. Gruden did not become a racist, homophobic, sexist and misogynist overnight. You can bet there are other pieces of evidence of his values and beliefs out there. The then Oakland Raiders signed Gruden to the richest professional football contract ever given to a coach, $100 million over 10 years. Yet they apparently did little to no background due diligence on him. Was there evidence of his racist, homophobic, sexist and misogynist views in the public record? Would it have mattered to the Raiders? Would the Raiders have hired him anyway? Perhaps so but at least they might have known about Gruden’s racist, homophobic, sexist and misogynist values and tried to manage that risk. Of course, they might have passed on hiring him altogether if they knew what the fallout could look like.
Culture, Culture and More Culture
What is the culture of your organization? Why did the NFL allow such a culture to flourish that would allow a Monday Night Football commentator on ESPN to hold the job and then become the highest paid professional coach? Is it because the Maga-hatter wearing NFL owners are all Trump supporters? What about the other employees who make up those organizations? Professional football players are 70% African American. What do Gruden’s remarks, the NFL’s non-response and the Raiders hiring communicate to them about how management thinks of them? Raider owner Mark Davis advised people to look to the NFL for answers.
Bill Rhoden, writing in The Undefeated, an ESPN publication, put it succinctly, “my concern is about the legion of enablers who supported Gruden all of these years. What about them? Who are they? The NFL has gotten rid of its Gruden problem. It has not gotten rid of Gruden-ism: regressive sensibilities that stand foursquare against diversity, inclusion and tolerance.” He went on to say, “The reality is that the NFL, for all of its attempts to move forward, has been revealed as a regressive organization populated by white men who hold views about race and power that are antithetical to progress and enlightenment. Trust me, Gruden is not the only person who holds these beliefs. He’s the only one stupid enough, or emboldened enough, to express them via email.”
In short, the NFL has a huge culture problem. But you cannot change unless you admit you have a problem. We have seen nothing from the NFL that indicates it believes the problem is beyond John Gruden.

Categories
Innovation in Compliance

Compliance, Diligence and M&A: Part 1-Core Investigative Diligence

Welcome to a special five-part podcast series sponsored by K2 Integrity. This month we consider the intersection of compliance, diligence and mergers & acquisitions (M&A). I am joined by Hannah Coleman, Managing Director in K2 Integrity’s Investigations and Risk Advisory practice. She specializes in fast-moving, complex, and specialized research assignments in a variety of areas including investigative due diligence, corporate contests, intellectual property investigations, media transparency assessments, and litigation support. Also joining this week’s series is Tom Pannell, Managing Director in K2 Integrity’s Investigations and Risk Advisory practice. With a focus on financial investigations, Tom leads multi-disciplinary teams working with corporate clients and their legal advisors responding to crisis events, including multi-jurisdictional white-collar crime, misconduct, financial statement fraud, anti-bribery and corruption incidents, and compliance risk advisory work. In this first episode, I visit with Hannah on issues relating to core due diligence issues.
Join us in our next episode where consider concerns in today’s deal making scene.
For more on K2 Integrity, check out their website, here.

Categories
31 Days to More Effective Compliance Programs

Day 18 | Levels of due diligence


Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward.
The 2020 Update stated, “A well-designed compliance program should apply risk-based due diligence to its third- party relationships. Although the need for, and degree of, appropriate due diligence may vary based on the size and nature of the company, transaction, and third party, prosecutors should assess the extent to which the company has an understanding of the qualifications and associations of third-party partners, including the agents, consultants, and distributors that are commonly used to conceal misconduct, such as the payment of bribes to foreign officials in international business transactions.”
The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.
There are many different approaches to the specifics of due diligence. By laying out some of the approaches, you can craft the relevant portions into your program. The Level I, II and III trichotomy appears to have the greatest favor and one that you should be able to implement in a straightforward manner. But the key is that you must assess your company’s risk and then manage that risk. If you need to perform additional due diligence to answer questions or clear red flags you should do so. And do not forget to “Document, Document, and Document” all your due diligence.
Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots on the ground investigation.
Categories
Daily Compliance News

August 25, 2020-the I Like to Watch edition


In today’s edition of Daily Compliance News:

  • Mandated Due Diligence for PEPs. (WSJ)
  • Reset the corruption clock in Illinois. (ChicagoTribune)
  • E-commerce bets paying off. (WSJ)
  • Jerry Falwell, Jr. resigns (or not). (WaPo)
Categories
31 Days to More Effective Compliance Programs

Due diligence


Most companies fully understand the need to comply with the requirements around third-parties as they represent the greatest risks for bribery and corruption. However, most companies are not created out of new cloth but are ongoing enterprises with a fully up and running business in place. This means they may need to bring resources to bear to do so while continuing operating an ongoing business. This can be particularly true in the area of performing due diligence on third-parties. Many companies understand the need for a robust due diligence program to investigate third-parties but have struggled with how to create an inventory to define the basis of third-party risk and, thereby, perform the requisite due diligence required.
Getting your arms around due diligence can sometimes seem bewildering for the compliance practitioner. The information that you gathered in Steps 1-Business Justification and 2-Questionnaire of the third-party management process should provide you with the initial information to consider the level of due diligence needed. This leads to Step 3 of the third-party management process: due diligence. The 2020 Resource Guide stated, “as part of risk-based due diligence, companies should understand the qualifications and associations of its third-party partners, including its business reputation, and relationship, if any, with foreign officials. The degree of scrutiny should increase as red flags surface.”
Three key takeaways:

  1. Risk rank your third-parties and use this as a basis to begin with an adequate level of due diligence.
  2. Any red flags which appear must be cleared and there must be documented evidence of such clearance.
  3. There must be documented evidence of review of the due diligence.
Categories
FCPA Compliance Report

From the Unthinkable to a Culture of Compliance- Glaucia Ferreira on Background Investigations


In this special podcast series, I visit with lawyers from Azevedo Sette in Sao Paulo. The lawyers and topics include: Isabel Franco on a CarWash changed a culture, Lucas Bianchinni on environmental regulation in Brazil, Glaucia Ferreira on the Clean Companies Act, Luiz Salles on recent Brazilian corruption enforcement actions and Ingrid Santos & Guiliana Boniha on the hottest topic in Brazil: Me Too and sexual/moral harassment. In today’s episode, I visit with Glaucia Ferreira on background investigations in Brazil.

  1. What are some of the challenges in performing background investigations in Brazil under the Clean Companies Act?
  2. Why are financial check and security investigation so critical in Brazil?
  3. What some of the challenges unique to performing background investigations in Brazil?
  4. Why is the human element so important in background investigations?
  5. Where can listeners go for more information?

This podcast is sponsored by the law firm of Azevdo Sette. To learn more about this firm, visit its website, for resources, expert guidance and support.

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program for 3rd Parties-Evaluation of Due Diligence With Candice Tal

An important part of the job duties of any compliance practitioner is clearing red flags which might appear for a proposed third-party relationship during the due diligence process. It is mandatory that not only must all red flags be cleared but there also be evidence of the decision-making process to show to a regulator if one comes knocking. Around third-parties, consider what risks you face in both your sales and supply chain. If there is a key player several tiers down the line who creates or builds a key component or delivers a critical service, you may want to put more management around that relationship from the compliance perspective.

For anything below a tier 2; you may be able to manage your risks through having your direct tier one counter-party take the lead in managing such compliance risks. But make sure that the expectation is communicated to your direct counter-party so that if the government comes knocking you can show that not only did you contractually obligate your direct counter-party to do so but that you provided them the tools and training to do so. Finally, you will need to be able to show that your direct counter-party did so.

Three key takeaways:

  1. There is no set formula for clearing of red flags or the evaluation of due diligence.
  2. Know when to say enough has been done.
  3. You must “Document, Document, and Document” your evaluation of any red flags.
Categories
31 Days to More Effective Compliance Programs

Innovation in Investigative Due Diligence


Candice Tal is the founder and Chief Executive Officer (CEO) of Infortal Worldwide, and one of the top experts around on due diligence. In an interview, I asked Tal about the use of AI in investigative due diligence and specifically how AI has led innovation in investigative due diligence. Tal believes that AI will be a “game changer” in compliance. Massive data sets require some type of AI to sort through and analyze the information. This is particularly important for internal controls and accounting books and records provisions to identify massive fraud. This is yet another area which is still developing. Tal stated, “I’ll frame that by saying at least in the next few years, there will still be a need for the traditional investigative approach that the boots on the ground, one where an investigator goes out and physically checks on facilities. Artificial intelligence is going to have limited ability to do that.” While drones may become part of an investigators tool kit, Tal believes that AI will be used “in a similar way to most data aggregators today. They find about 80% of the information. Yet there will always be the remaining 20% which they cannot find and you will need human intervention on the investigative side.”
Looking down the road to the veiled land of the future, Tal sees continued innovation facilitating investigative due diligence. While AI is more than simply on the horizon, she said it “is a tried and tested methodology that has existed for many years, in terms of how you look for and locate shell companies.” It is also true about finding information about people who are trying to deliberately hide information. The bottom line is some of these investigative techniques involve old-fashioned shoe leather or simply hard diligent investigative work and “that’s not new”. Yet AI and other technological tools can make investigations more efficient and more cost effective, while giving better results. At the end of the day, AI can be used to sharpen and hone the due diligence process.
Three key takeaways:

  1. AI can help change the face of due diligence.
  2. AI will facilitate data aggregation in due diligence investigations.
  3. Always remember the human element.
Categories
31 Days to More Effective Compliance Programs

Day 31 | Levels of due diligence


Due diligence is generally recognized in three levels: Level I, Level II and Level III. Each level is appropriate for a different level of corruption risk. The key is to develop a mechanism to determine the appropriate level of due diligence and then implement that going forward. The question becomes how you use the information you obtained in the business justification and the questionnaire to determine an appropriate level of due diligence for the next step in the five-step process of third-party management. A three-step approach of varying levels of due diligence is the appropriate analysis to take going forward.
A three-step approach was discussed in Opinion Release 10-02, in which the DOJ discussed the due diligence that the requesting entity performed. This Opinion Release sets out a clear break which every compliance practitioner should use in considering an appropriate level of due diligence to engage with your third-party risk management process or when considering the level of due diligence required on a potential business venture partner. A very good description of the three levels of due diligence was presented by Candice Tal, Founder and CEO of Infortal Worldwide, in an article entitled “Deep Level Due Diligence: What You Need to Know”
Three key takeaways:

  1. A Level I due diligence should only be used where there is a low risk of corruption.
  2. A Level II due diligence is sufficient in a high-risk jurisdiction if there are no red flags to be cleared.
  3. Level III due diligence is deep dive, boots on the ground investigation.

 

Categories
31 Days to More Effective Compliance Programs

Day 27 | Pre-acquisition due diligence in mergers and acquisitions


A company that does not perform adequate due diligence prior to a merger or acquisition may face both legal and business risks. Perhaps most commonly, inadequate due diligence can allow a course of bribery to continue – with all the attendant harms to a business’s profitability and reputation, as well as potential civil and criminal liability. While most compliance practitioners have been long aware of the requirement in the post-acquisition context, the 2012 FCPA Guidance focused many compliance practitioners of the need to engage in robust pre-acquisition due diligence.
This was expanded again in the 2017 Evaluation but the 2019 Guidance made even more clear the need for a robust compliance presence in the pre-acquisition phase. It stated, “A well-designed compliance program should include comprehensive due diligence of any acquisition targets.  Pre-M&A due diligence enables the acquiring company to evaluate more accurately each target’s value and negotiate for the costs of any corruption or misconduct to be borne by the target.  Flawed or incomplete due diligence can allow misconduct to continue at the target company, causing resulting harm to a business’s profitability and reputation and risking civil and criminal liability.
Three key takeaways:

  1. The results of your pre-acquisition due diligence will inform your post-acquisition integration and remediation going forward.
  2. Periodically review your M&A due diligence protocol.
  3. If red flags appear in pre-acquisition due diligence, they should be cleared.