Categories
Blog

Nicholas Latham on Implementing Frameworks for Effective Risk Management in Organizations

I recently had the opportunity to visit with folks from Diligent. We look down the road at key issues in 2024 in a podcast series sponsored by Diligent entitled Compliance Professionals Adapting to Change: Industries, Regulations, and Beyond. I could chat with Nicholas Latham, Renee Murphy, Jessica Czeczuga, Yee Chow, and Alexander Cotoia. Over this series, we discussed compliance communications in regulated industries, managing conflicts of interest at the Board level, the Board’s role in compliance training and communications, navigating the current ESG landscape, and professional growth and mentorship in compliance. In this first blog post, we discuss accounting and risk management frameworks.

One of the key topics discussed in the episode was the importance of risk assessment frameworks in identifying and mitigating organizational risks. Latham highlighted two widely used frameworks, the COSO Framework for Internal Controls and ISO 31,000, which both provide a comprehensive approach to risk management. These frameworks help organizations establish effective communication processes and gain a holistic view of risk across different departments.

The COSO Framework for Internal Controls focuses on enterprise risk management. It emphasizes the need to assess an organization’s control environment, determine risk appetite, and identify crucial risks for the business’s success. Information and communication processes, including training and monitoring activities, are built around these assessments to ensure effective risk management.

We next discussed the relevance of the “Single Pane of Glass” concept, often associated with the COSO Framework for Internal Controls. This concept provides a unified view of an organization’s operations and risk management, flattening hierarchical structures and promoting transparency. By implementing this approach, executives and leaders can comprehensively understand what is happening across the organization rather than just within individual departments.

We noted the challenges associated with compliance communication issues, particularly in e-communications. Latham emphasized the importance of setting the tone at the top, with executive leadership emphasizing the criticality of compliance and its impact on the organization and its customers. Training plays a crucial role in ensuring compliance, but Latham noted that the amount and frequency of training in today’s environment may not be sufficient. He stressed the need for organizations to step up their training efforts and be prepared for increasingly stringent regulatory scrutiny.

Monitoring e-communications poses a significant challenge due to the sheer volume of interactions. Latham suggested leveraging artificial intelligence (AI) to analyze a larger communications sample and identify potential risks. This approach could help organizations identify improper processes, training gaps, or script issues that may contribute to compliance breaches.

As a compliance professional, your understanding of risk assessment frameworks, such as the COSO Framework for Internal Controls and ISO 31,000, highlights the importance of comprehensive risk management practices. The “Single Pane of Glass” concept and the challenges associated with compliance communication issues provide valuable guidance for organizations navigating the complex risk and compliance landscape. As regulatory scrutiny continues to increase, compliance professional’s expertise will continue to serve as a valuable resource for organizations seeking to enhance their risk management practices and ensure compliance in an ever-evolving technological landscape.

Ready for Purpose-Driven Compliance? Diligent equips leaders with the tools to build, monitor, and maintain an open, transparent ethics and compliance culture. For more information and to book a demo, visit Diligent.com

Join us tomorrow when we consider conflicts of interest at the Board of Directors.

Categories
Everything Compliance

Everything Compliance – The Albemarle Edition

Welcome to the only roundtable podcast in compliance as we celebrate our second century of shows. In this episode, we have the quartet of Jay Rosen, Jonathan Armstrong, Matt Kelly, and special guests Karen Moore and Kristy Grant-Hart, with Tom Fox hosting. Our topic today (with the exception of Mr. Armstrong) is the recently announced Albemarle FCPA enforcement action with both the DOJ and SEC. We conclude with our always popular and fan-favor Shout Outs and Rants.

1. Matt Kelly provides an overview of the enforcement action. He rants about former House Speaker Kevin McCarthy and the GOP’s desire for chaos rather than governing.

2. Guest Karen Moore takes a deep dive into the SEC FCPA enforcement action involving Albemarle. She rants about lawyer fees over $2000+ per hour.

3. Tom Fox shouts out to the MLB playoffs and pays tribute to Dick Butkus.

4. Guest Kristy Grant-Hart takes a deep dive into the holdback provision noted in the DOJ enforcement action.

5. Jonathan Armstrong reviews CEOs misbehaving and the corporate response. He shouts out Kortney Nordrum for her presentation on what it is like to go through a data breach.

The members of the Everything Compliance are:

•       Jay Rosen– Jay is Vice President of Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com

•       Karen Woody – One of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu

•       Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com

•       Jonathan Armstrong –is our UK colleague, who is an experienced data privacy/data protection lawyer with Cordery in London. Armstrong can be reached at jonathan.armstrong@corderycompliance.com

•       Jonathan Marks can be reached at jtmarks@gmail.com.

•       Special Guest Kristy Grant-Hart is the founder of Spark Consulting.

•       Special Guest Karen Moore is an Adjunct Professor at Fordham University School of Law

The host and producer, ranter (and sometimes panelist) of Everything Compliance is Tom Fox, the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the Compliance Podcast Network.

Categories
Blog

Albemarle FCPA Enforcement Action: Part 5 – Lessons Learned

Over the past several blog posts, I have been exploring the Albemarle FCPA enforcement action.  We have explored in some detail the DOJ Non-Prosecution Agreement (NPA) and the SEC Administrative Order(Order). In this final blog post on the series, I want to suss out some lessons for the compliance professional.

Consequence Management

When Kenneth Polite announced the Pilot Program in conjunction with the 2023 Evaluation of Corporate Compliance Programs (ECCP), the focus was largely on clawbacks. However, the relevant section in the ECCP was entitled “Consequence Management,” indicating a broader focus on both incentives to do business ethically and in compliance as well as disincentives. The ECCP asked a series of questions:

  • Has the company considered the impact of its financial rewards and other incentives on compliance?
  • Has the company evaluated whether commercial targets are achievable if the business operates in a compliant and ethical manner?
  • What role does the compliance function have in designing and awarding financial incentives at senior levels of the organization?
  • How does the company incentivize compliance and ethical behavior? What percentage of executive compensation is structured to encourage enduring ethical business objectives?
  • Are the terms of bonus and deferred compensation subject to cancellation or recoupment, to the extent available under applicable law, in the event that non-compliant or unethical behavior is exposed before or after the award was issued?
  • Does the company have a policy for recouping compensation that has been paid where there has been misconduct?
  • Have there been specific examples of actions taken (e.g., promotions or awards denied, compensation recouped, or deferred compensation canceled) as a result of compliance and ethics considerations?

The NPA noted that Albemarle engaged in holdbacks, as they did not pay bonuses to certain employees involved in the conduct or those who had oversight. The NPA stated, “The Company withheld bonuses totaling $763,453 during its internal investigation from employees who engaged in suspected wrongdoing.” The illegal conduct involved those who “(a) had supervisory authority over the employee(s) or business area engaged in the misconduct; and (b) knew of, or were willfully blind to, the misconduct.” The significance of this effort was vital as it qualified Albemarle for an additional fine reduction of a dollar-for-dollar credit of the amount of the withheld bonuses under the Criminal Division’s March 2023 Compensation Incentives and Clawbacks Pilot Program.

Indeed, Deputy Attorney General Lisa Monaco, in a recent speech, said, “The pilot program also rewards companies that claw back or withhold incentive compensation from executives responsible for misconduct – or attempt to do so in good faith. For every dollar that a company claws back or withholds from an employee who engaged in misconduct – or a supervisor that knew of or turned a blind eye to it – the Department will deduct a dollar from the otherwise applicable penalty that the resolving company would pay.”

She specifically cited the Albemarle FCPA resolution, where “the company received a clawback credit for withholding bonuses of employees who engaged in misconduct. Not only did Albemarle keep the bonuses that would have gone to wrongdoers, but the company also received an offset against its penalty for the same amount. That’s money saved for Albemarle and its shareholders – and a concrete demonstration of the value of clawback programs.”

 Remediation During Investigation

The NPA cited several remedial actions by the company that helped Albemarle obtain the superior result in terms of the discounted fine and penalty. These steps were taken during the pendency of the DOJ investigation so that when the parties were ready to resolve the matter, Albemarle had built out an effective compliance program and had tested it. The NPA provided that Albemarle:

  • Strengthening its anti-corruption compliance program by investing in compliance resources, expanding its compliance function with experienced and qualified personnel, and taking steps to embed compliance and ethical values at all levels of its business organization;
  • Transformed its business model and risk management process to reduce corruption risk in its operation and to embed compliance in the business, including implementing a go-to-market strategy that resulted in eliminating the use of sales agents throughout the Company, terminating hundreds of other third-party sales representatives, such as distributors and resellers, and shifting to a direct sales business model;
  • Provided extensive training to its sales team and restructured compensation and incentives so that compensation is no longer tied to sales amounts;
  • Used data analytics to monitor and measure the compliance program’s effectiveness and
  • We are engaged in continuous testing, monitoring, and improvement of all aspects of its compliance program, beginning almost immediately following the identification of misconduct.

Two of the factors are relatively new and certainly are noteworthy for the compliance professional. The first is the change in the company’s approach to sales and their sales teams. Obviously, it was corrupt third-party agents that brought the company to such FCPA grief. Many of the quotes in the NPA and Order make it clear that Albemarle executives had an aversion to paying bribes but had greater moral flexibility when a third-party agent was involved. This led to the company moving away from third-party agents to a direct sales force.

Moving to a direct sales force does have its risks, which must be managed, but those risks can certainly be managed with an appropriate risk management strategy, monitoring of the strategy, and improvement; those risks can be managed. Yet there is another reason, and more importantly, a significant business reason, to move towards a direct sales business model. Every time you have a third-party agent or anyone else between you and your customer, you risk losing that customer because your organization does not have a direct relationship with the customer. By having a direct sales business model, your organization will have a direct relationship with your customer and, therefor, the ability to develop it further.

The NPA also specifically called out the Company’s use of data analytics in two ways. The first was to monitor the Company’s compliance program, and the second was to measure the compliance program’s effectiveness. While this language follows a long line of DOJ pronouncements, starting with the 2020 Update to the Evaluation of Corporate Compliance Programs, about the corporate compliance functions’ access to all company data, this is the first time it has been called out in a settlement agreement in this manner. Moreover, although not specifically tied to the lack of a required corporate Monitor, it would appear that by using data analytics, Albemarle was able to satisfy the DOJ requirement for implementing controls and then effectively testing them throughout the pendency of the DOJ investigation.

Internal Controls Over Commission Increases

According to the SEC Order, the Company failed to devise and maintain a sufficient system of internal accounting controls with respect to commission rates and deviations from contracted rates. In other words, even though there were internal controls in place for the setting of third-party agents’ commissions, they could be overridden at will. The Order concluded by noting, “As a result, sales personnel were able to increase agents’ commission rates in multiple countries – including Vietnam, India, China, and UAE – despite certain Albemarle personnel having knowledge of red flags indicating the agents would use a portion of the commission to make bribe payments to obtain contracts, influence tender specifications, or obtain nonpublic information concerning competitors’ bids.”

Every compliance professional should review their company’s controls over agents’ commission rates to make sure the business unit personnel alone cannot raise commission rates. While business units can always make the business case, this enforcement action drives home the message that the compliance function is not ‘one and done’ when an agent is approved but must be monitored throughout the third-party relationship lifecycle. Any requested change to a commission rate must go through the same analysis and approval process as the original approval.

Timely Self-Disclosure

There was a significant discussion in the NPA around Albemarle’s voluntary self-disclosure to the DOJ. However, NPA noted that “the disclosure was not “reasonably prompt” as defined in the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy and the U.S. Sentencing Guidelines.” The NPA reported that Albemarle learned of allegations regarding possible misconduct in Vietnam approximately 16 months before disclosing it to the DOJ. Interestingly, the SEC Order only stated, “Albemarle made an initial self-disclosure to the Commission of potential FCPA violations in Vietnam following its completion of an internal investigation of such conduct and, at the same time, self-reported potential violations it was investigating in India, Indonesia, and China. Albemarle later self-disclosed to the Commission potential violations in other jurisdictions as part of an expanded internal investigation.”

This meant the self-disclosure “was not within a reasonably prompt time after becoming aware of the misconduct in Vietnam,” and it means that Albemarle did not meet the standard for voluntary self-disclosure under the Criminal Division Corporate Enforcement and Voluntary Self-Disclosure Policy. While the DOJ “gave significant weight” to the Company’s voluntary, even if untimely, disclosure of the misconduct, it is undoubtedly cautionary.

What the DOJ wants is self-disclosure as soon as possible. One only needs to recall the case of Cognizant Technologies, where the company received a complete Declination where there were allegations of C-Suite involvement in the bribery schemes. This Declination was provided in large part because the company made its self-disclosure only two weeks after the information filtered up to the Board of Directors. While Cognizant Technologies may be the gold standard, it shows that if a company timely self-discloses, it can be considered for a full Declination.

The Albemarle FCPA resolution documents are chocked full of solid information that every compliance professional can use in the future. They are well worth a deep dive—finally, a kudos to Albemarle for obtaining this superior result.

Categories
Blog

Albemarle FCPA Enforcement Action: Part 4 – Internal Control Failures

Albemarle Corporation (Albemarle) recently agreed to pay more than $218 million to resolve investigations by the U.S. Department of Justice (DOJ) and the Securities and Exchange Commission (SEC) into violations of the Foreign Corrupt Practices Act (FCPA) stemming from Albemarle’s participation in corrupt schemes to pay bribes to government officials in multiple foreign countries. We have explored in some detail the DOJ Non-Prosecution Agreement (NPA). Today, I wanted to consider specifically some of the company’s failures, which were detailed in the SEC Administrative Order (Order).

Corporate Structure

At the time of the violations, Albemarle had three business units “corresponding to its primary product markets: catalysts (which contained the Refining Solutions business), lithium, and bromine. The Refining Solutions business developed and sold catalysts to oil refineries through sales offices and intermediaries around the world. The President of the Refining Solutions GBU reported directly to Albemarle’s Chief Executive Officer. Albemarle centrally coordinated its compliance, legal, finance, contracting, and internal audit functions.”

The Refining Solutions business was further broken down into four operating units. It included “Albemarle Catalysts Company B.V. in the Netherlands (“Albemarle Netherlands”); Albemarle Singapore Pte. Ltd in Singapore (“Albemarle Singapore”); Albemarle Chemicals (Shanghai) Co. Ltd. in China (“Albemarle China”); and Albemarle Middle East FZE in the UAE (“Albemarle Middle East”) (each, an “Albemarle Subsidiary,” and together, the “Albemarle Subsidiaries”). Albemarle also used sales agents to sell refinery catalysts in Vietnam, India, Indonesia, China, and the UAE.” A most exciting nugget detained in the Order revealed that “the sales agents in Indonesia and China were also retained as distributors.”

Finally, the Company “exercised control over the sales activities of the Albemarle Subsidiaries, which acted as agents for Albemarle when retaining agents to sell catalysts globally. Albemarle officers served on the Albemarle Subsidiaries’ boards of directors and held signatory authority over bank accounts at local branches of both U.S. and non-U.S. banks, used to pay sales intermediaries in the relevant countries. Albemarle sold refinery catalysts globally through agents and distributors approved by Albemarle sales, business, legal, compliance, and finance personnel and management.” 

Internal Audit-Reporting Deficiencies

In perhaps the most damning phase of the Order, the SEC detailed how the Company’s internal audit function had raised the issue of insufficient controls multiple times, stating “Despite the known risks posed by Albemarle’s reliance on third-party sales agents and distributors in the sale of catalyst products to state-owned and -controlled oil refineries, Albemarle failed for many years to institute sufficient compliance systems and devise and maintain a sufficient system of internal accounting controls concerning the retention, payment, and oversight of these intermediaries.”

These included a series of internal audit reports in 2013, 2015, and 2016, all of which identified multiple gaps in Albemarle’s internal accounting controls with respect to the Refining Solutions business’s use of intermediaries. These reports set out a series of internal control deficiencies and failures, including that sales agents and distributors were paid:

  1. With incomplete due diligence,
  2. With a lack of executed contracts,
  3. With contracts that lacked required anti-corruption provisions;
  4. At not simply higher than market rates but at rates higher than those provided for by contract.

All of this was done in contravention of Albemarle’s policies and procedures.

Internal Audit-Recommendations

Yet, the internal audit did more than report deficiencies; it also made recommendations. As far back as 2013, the internal audit team recommended that Albemarle establish a comprehensive program specifically to manage and monitor the entire life cycle for intermediaries. The Order noted that “While Albemarle hired compliance personnel, reduced the number of sales agents and distributors without contracts, and implemented software to assist in third-party onboarding and contracting,” it failed to devise and maintain a sufficient system of internal accounting controls with respect to commission rates and deviations from contracted rates. In other words, even though there were internal controls in place, apparently, they could be overridden at will.

The Order concluded by noting, “As a result, sales personnel were able to increase agents’ commission rates in multiple countries – including Vietnam, India, China, and UAE – despite certain Albemarle personnel having knowledge of red flags indicating the agents would use a portion of the commission to make bribe payments to obtain contracts, influence tender specifications, or obtain nonpublic information concerning competitors’ bids.”

Internal Control Failures

The Order detailed a series of internal control failures by the Company across multiple business units in several different countries. The entire story paints a picture of a company that certainly did not have a culture of doing business ethically and in compliance.

In Vietnam, the Company “Agent was hired in 2012 at a 4.25 percent commission rate that Albemarle’s sales representative viewed as high for the region, and Albemarle approved an increase to Vietnam Agent’s commission to 6.5 percent in 2015 despite emails reflecting a high probability additional funds would be used to bribe Vietnamese government officials.” The Order went on to note, “Albemarle’s system of internal accounting controls was insufficient to prevent or detect these improper payments, which Albemarle Singapore falsely recorded as legitimate commissions in books and records that were consolidated into Albemarle’s financial statements.”

In India, multiple red flags emerged during Albemarle’s due diligence process. The India Agent claimed that its board of directors included two former senior India State-Owned Customer officials and Albemarle already had a sales agent in India. An Albemarle Subsidiary regional director alerted an Albemarle sales executive who was employed directly by Albemarle and based in the United States, of his understanding, based on a July 2009 call with an India Agent, that the agent would make corrupt payments to keep Albemarle in the bidding process. Additionally, “Albemarle increased India Agent’s commission in 2010 (via a backdated agreement) and again in 2012. A July 2014 email from an Albemarle Europe sales executive to India Agent described the commissions as “extremely high” and “far from any possible realistic justification.” Finally, “The agreement called for payment of a three percent commission to India Agent, a rate three times higher than that paid to Albemarle’s existing agent for India.”

In Indonesia, the Agent requested a commission increase expressly to fund bribes to Indonesia State-Owned Customer officials. Moreover, “Although Albemarle sales personnel declined to increase the commission and reportedly told Indonesia Agent that Albemarle did not conduct business via bribery, they did not report concerns to their supervisors, Legal, or Compliance personnel or take any steps to terminate the agency relationship. Instead, Albemarle made contractual commission payments and certain extra-contractual expense reimbursements to Indonesia Agent throughout 2013 in connection with a contract Indonesia State-Owned Customer awarded to Albemarle in April 2013. A portion of these funds was used to pay bribes.  Albemarle’s system of internal accounting controls was insufficient to prevent or detect the improper payments made to and through Indonesia Agent, which Albemarle Singapore falsely recorded as legitimate commissions and business expenses in books and records that were consolidated into Albemarle’s financial statements.”

In China, although business unit employees knew of the proposed agent’s familial relationship with the relevant government official, they failed to report it internally. Then, the Company’s compliance department’s due diligence revealed that China Agent had no website and was authorized to do business only a few weeks before China Agent’s Principal first met with Albemarle personnel. Despite these red flags, Albemarle retained the China Agent. When an Albemarle business director questioned China Agent’s compensation as “high,” an Albemarle Netherlands business director replied that he anticipated large returns on the contract. In February 2014, Albemarle agreed to increase the China Agent’s commission if it obtained higher prices from the customer. In August 2016, Albemarle China further increased the commission rate.

Finally, in the UAE, the Company did not conduct due diligence on the agent until after the agent agreement had been executed. After this initial contract was executed, a second agent was also contracted for illicit purposes. The deal with the original Agent was amended in 2013 to increase its commission by one percent — the same amount the Agent agreed to pay to the second agent, “UAE Consultant.” The UAE Consultant provided no discernable services other than conveying confidential tender evaluations and competitors’ bids obtained from the refinery and the EPC firm. In addition to commissions that Albemarle paid to the agent, Albemarle paid the agent undefined “administrative charges” equal to ten percent of its invoices for customs clearance and other non-sales services.

The SEC Order lays out in greater detail how the Company’s internal controls were circumvented. It also detailed some of the specific language in emails, which cleared denoted coded language around the payment of bribes.

Join us tomorrow to review some of the key lessons learned.

Categories
Compliance Into the Weeds

Compliance into the Weeds: Messaging App Enforcement and Internal Controls

The award-winning, Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject more. Looking for some hard-hitting insights on sanctions compliance? Look no further than Compliance into the Weeds! In this episode, Tom and Matt consider the recent SEC and CFTC enforcement actions around messaging app non-compliance.

Join Tom and Matt as they take a deep dive into the enforcement actions and then consider how such claims would impact non-regulated industries. Regulated industries, particularly broker-dealer firms like Wells Fargo and Morgan Stanley, are facing enforcement actions and hefty fines for their employees’ use of messaging apps like WhatsApp and Snapchat that allow record preservation to be disabled. The involvement of senior managers in these misconducts has prompted the SEC to require an independent compliance consultant in settlements.

The conversation between Tom and Matt emphasizes the importance of messaging policies and procedures in regulated industries and the need for stricter compliance measures. They also discuss the complexities and potential consequences of record-keeping obligations and the regulatory concerns over the use of messaging apps. The conversation briefly touches on the future of AI chatbots in customer service, with differing perspectives on their ethical implications. Overall, the conversation highlights the significance of messaging policies, enforcement, and compliance in regulated industries.

Key Highlights

·      Enforcement Actions Against Regulated Industries

·      Enforcement actions and messaging policies

·      Record-keeping obligations for broker dealers and other industries

·      Regulatory concerns over the use of messaging apps

·      Internal Controls and non-regulated industries

 Resources

Matt 

LinkedIn

Blog Post in Radical Compliance

No Smoke and No Fire: The Rise of Internal Controls Absent Anti-Bribery Violations in FCPA Enforcement by Karen Woody in Cardoza Law Review

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Compliance Man Chooses the Target

Compliance Man Takes a Eurotrip – Piotr Żyłka on Poland’s Compliance Revolution

Compliance Man is back for a new season! Get ready for a EuroTrip with Tom Fox and Tim Khasanov-Batirov on their hit podcast, Compliance Man! Join Tom Fox and co-host Timur Khasanov-Batirov on a Euro trip as they delve into the world of Poland’s Compliance Revolution with guest Piotr Żyłka.

The implementation of the Whistleblowing Directive and the Corporate Sustainability Due Diligence Directive into the Polish Legal System could be a major step forward in the fight against corruption. Tom Fox and Tim Khasinov-Batirov had a conversation with Piotr Żyłka, an author of the It’s All About Compliance blog, publisher, and compliance platform in Europe, to discuss the Polish compliance scene and the need for a Polish FCPA. Piotr discussed the banking law requirements, the DOJ guidelines, the New York City Bar Association paper, and the influence of foreign companies on compliance controls in Poland. He also highlighted the need for trainings, engagement of top management, and internal controls like KYC. Tom and Tim thanked Piotr for his time and knowledge and invited him to come back on the podcast to share his views.

Key Highlights

·      Internal Controls in Poland

·      Compliance in Poland

·      Sanctions Compliance

·      A Polish FCPA Needed?

 Resources

Piotr Żyłka on LinkedIn

It’s All About Compliance

Tim Khasanov-Batirov on LinkedIn

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Compliance Man Chooses the Target

Compliance Man Takes a EuroTrip – Alex Movchan on Internal Controls in the EU

Compliance Man is back for a new season! Get ready for a EuroTrip with Tom Fox and Tim Khasanov-Batirov on their hit podcast, Compliance Man! Join Tom Fox and co-host Tim Khasanov-Batirov on a Euro trip as they delve into the world of internal controls in Europe, with special guest Alex Movchan, president of the Institute for Internal Controls in Central Europe and chief risk officer at a global medical device company. They discuss internal control strategies and best practices, including SOX and COSO frameworks, the importance of IT general controls, and adapting to changes in the market. The episode also explores the challenges of merging companies with different internal control frameworks, tailoring internal controls to specific country offices, and promoting compliance initiatives to top management.

Don’t miss out on this insightful conversation about compliance and risk management. Tune in to the “Compliance Man: Eurotrip-Internal Controls in Europe,” hosted by Tom Fox and Tim Khasanov-Batirov.

Key Highlights:

  • Internal Controls in Different Regions
  • Importance of Internal Controls in Emerging Markets
  • Compliance Frameworks in Europe
  • Updating Internal Control Frameworks in Response to ESG
  • Structuring Internal Controls for Decision-making Mechanisms
  • Importance of Compliance Officer and Internal Control Collaboration

Notable Quotes:

“Internal controls are the backbone of every compliance program; what we need is to have control over the situation, which means that you have to have internal controls in place.”

“When it comes to private owners and family-owned business, this is like a very different owner to owner.”

“We need to adapt faster as the internal controls professionals and as business managers, we need to update to the changes faster because the ones who update faster, the internal control frameworks, will be on the top of the markets.”

“Half of the companies just don’t know how to start.”

 Resources:

Alex Movchan on LinkedIn

Tim Khasanov-Batirov on LinkedIn

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Compliance Into the Weeds

Compliance into the Weeds: A Material Weaknesses Catastrophe

The award-winning, Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject. Looking for some hard-hitting insights on sanctions compliance? Look no further than Compliance into the Weeds!

In this episode, co-hosts Tom Fox and Matt Kelly dissect a disastrous 10k report filed by Ammo Incorporated, exposing the company’s shocking governance and compliance breakdown. The lack of personnel, internal control processes, and proper segregation of duties are just some of the material weaknesses that led to this corporate disaster. The hosts provide insightful lessons on what companies should avoid to maintain internal governance, share tips on approaching remediation, and emphasize the importance of self-awareness among senior management and the board. Tune in to hear how this niche investigative story was uncovered, and how Twitter played a crucial role in the investigation. Don’t miss Compliance into the Weeds – the podcast that will change the way you think about governance and compliance!

 Key Highlights 

·      Material weaknesses in internal governance practices

·      Material weaknesses in operations at Ammo

·      Challenges with Ammo Inc.’s strategic shift and internal controls

·      Remediating Company Failures: Story’s Disclosure

 Resources

Matt 

LinkedIn

Blog Post in Radical Compliance

Tom 

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
31 Days to More Effective Compliance Programs

One Month to a More Effective Compliance Program with Boards – The Board as an Internal Control

James Doty, former Commissioner of the Public Company Accounting Oversight Board (PCAOB) was once asked if the Board or its sub-committee which handles audits was a part of a company’s internal financial controls. He answered that yes, he believed that was one of the roles of an Audit Committee or full Board. I had never thought of the Board as an internal control but the more I thought about it, the more I realized it was an important insight for any Chief Compliance Officer or compliance practitioner as it also applies to compliance internal control.
In the FCPA Resource Guide, 2nd edition, in the Hallmarks of an Effective Compliance Program, there are two specific references to the obligations of a Board. The first is in Hallmark No. 1, which states, “Within a business organization, compliance begins with the board of directors and senior executives setting the proper tone for the rest of the company.” The second is found under Hallmark No. 3, entitled “Oversight, Autonomy and Resources”, where it discusses that the CCO should have “direct access to an organization’s governing authority, such as the board of directors and committees of the board of directors (e.g., the audit committee).” Further, under the US Sentencing Guidelines, the Board must exercise reasonable oversight of the effectiveness of a company’s compliance program. The Department of Justice’s (DOJ) Prosecution Standards posed the following queries: (1) Do the Directors exercise independent review of a company’s compliance program? and (2) Are Directors provided information sufficient to enable the exercise of independent judgment? Doty’s remarks drove home to me the absolute requirement for Board participation in any best practices or even effective anti-corruption compliance program.

A Board’s oversight is part of effective compliance controls, then the failure to do so may result in something far worse than bad governance. Such inattention could directly lead to a FCPA violation and could even form the basis of an independent SOX violation as to the Board.
Three Key Takeaways

  1. A Board must engage in active oversight.
  2. A Board should review the design of internal controls on a regular basis.
  3. Failure to do so could form the basis for an independent legal violation under SOX.
Categories
31 Days to More Effective Compliance Programs

One Month to More Effective Internal Controls – Culture as a Foundational Internal Control

To conclude this month’s series on Internal Controls, I am joined by Vin DiCianni, Founder and CEO of AMI. We discuss how corporate culture is a foundational internal control. It is a fascinating topic that is not discussed enough by compliance professionals.

3 Key Takeaways.

  1. It must start at the top.
  2. Hiring is critical to creating and sustaining an ethical culture.
  3. Creative internal controls around culture.