Categories
Blog

Oracle: FCPA Recidivist Part 5 – What Does It All Mean?

In this post, we conclude our exploration of the Foreign Corrupt Practices Act (FCPA) enforcement action involving the now recidivist Oracle Corporation. This enforcement action was concluded with the Securities and Exchange Commission (SEC) resulting in an Order. After having examined the background facts and bribery schemes in some details, we turn to what does it all mean for FCPA enforcement going forward and what lessons can the compliance profession draw from Oracle’s missteps.

Paper Programs Fail

One of the most prominent lessons to be garnered from this matter is that paper compliance programs Do Not Work. That may sound like perhaps the most basic truism in all of compliance but here we are in 2022, looking at a major multinational organization which had a ‘check-the-box’ compliance program around distributors and it eventually bit them in the backside.

After having its first FCPA enforcement action in 2012 involving distributors in India, where deep and unwarranted discounts were used to create a pot of slush funds to pay bribes, Oracle instituted a requirement for a ‘second set of eyes’ outside the business unit for unusual or excessive discounts. According to its policies regarding distributors, a valid and legitimate business reason was required to provide a discount to a distributor. Oracle used a three-tier system for approving discount requests above designated amounts, depending on the product. In the first level, Oracle at times allowed subsidiary employees to obtain approval from an approver in a subsidiary other than that of the employee seeking the discount. At the next level and for higher level of discounts, Oracle required the subsidiary employee to obtain approval from another geographic region and the final level (and for the highest discounts) was from someone at the Oracle corporate headquarters. So far so good.

The problem was there was no requirement for evidence of a business justification to support the requested discount. The Order noted, “Oracle reviewers could request documentary support, Oracle policy did not require documentary support for the requested discounts – even at the highest level.” A statement of why you need a discount without any supporting documents as evidence is simply that – a statement. In other words, there was no way for a higher-level approver to determine if such a request was valid or fraudulent. Ronald Reagan was on to a basic compliance concept when he intoned “Trust, but verify.” Those words still ring true as a basic requirement in any compliance program.

Data Analytics

The Oracle enforcement action emphasized why data analytics is mandatory for any current compliance program. In addition to creating slush funds through discounts to distributors, slush funds were created through fraudulent reimbursement requests for expenses associated with marketing Oracle’s products. If the request were under $5,000, business unit level supervisors at the subsidiaries could approve them without any corroborating documentation indicating that the marketing activity actually took place. In one example from the Order, it noted that an Oracle Turkey sales employees obtained such fraudulent reimbursements totaling approximately $115,200 in 2018 that were “ostensibly for marketing purposes and were individually under this $5,000 threshold.” There was apparently no one looking to see who and how often these reimbursement requests were made by any single employee or approved by any supervisor.

This is as basic a fraud scheme as one can imagine. Think of employee gift, travel and entertainment (GTE) reimbursement where anything over $100 must be preapproved. One BD type or one business unit routinely submits requests after purchases of $99.99 so no preapproval is required. The supervisor approves it, and it is automatically paid to the employee. One reimbursement at $99.99 may not raise a red flag but multiple requests should. The same concept holds true in this situation. However, no one at Oracle was looking at this bigger picture. This is where a data analytics program would pick up such anomalies and flag it for closer inspection and investigation. Oracle appears to have realized this through part of its remediation which included the implementation of a compliance data analytics program moving to proactive auditing.

Internal Control Upgrades

Putting in compliance enhancements to remediate your control failures is a key part to any FCPA enforcement resolution. In this area, there were improvements in the following capacities: (a) in distributor discounting by improving aspects of the Oracle discount approval process and increasing transparency in the product discounting process through the implementation and expansion of transactional controls; (b) in the Oracle procurement process through the increased oversight of, and controls on, the purchase requisition approval process; (c) by the removal of perverse incentives by limiting financial motivations and business courtesies available to third parties; (d) in basic gifts, travel and entertainment policies (GTE) by improving its customer registration and payment checking processes in connection with Oracle technology conferences.

Basic GTE

I cannot believe that in 2022 we are talking about companies that still do not have the most basic GTE policies in force. Since at least 2007, the Department of Justice (DOJ) made clear what was appropriate in business travel, business courtesies and business entertainment. Oracle’s 112 Project decidedly was not as it was designed to appear as a business trip to Oracle’s home office (then in California) related to Oracle’s bid on a project. However, the trip was designed to be a sham to hide boondoggle travel for four government officials. The alleged business meeting at the corporate headquarters lasted only 15 minutes and for the rest of the week, the Oracle BD folks entertained the government officials in Los Angeles and Napa Valley and then took them to a “theme park” in the greater Los Angeles area. Any travel involving government officials or any other covered persons under the FCPA should be submitted to and approved by your compliance function, including costs and the itinerary.

There was much to consider from the SEC enforcement action under the FCPA involving Oracle. We still have not heard from the DOJ. There may be more to come….

Categories
Everything Compliance - Shout Outs and Rants

Episode 105 – Shout Outs and Rants

Welcome to the only roundtable podcast in compliance as we celebrate our second century of shows. In 2021, Everything Compliance was honored by W3 as a top talk show in podcasting. In this episode, we have the quartet of Jonathan Marks, Tom Fox, Jonathan Armstrong, and Karen Woody.

1. Tom Fox shouts out to Aaron Judge, who has a year for the ages.

2. Karen Woody shouts out to the HBO film Elvis and the movie portrayal of Presley.

3. Jonathan Marks rants about compliance professionals and fraud examiners who have no idea what internal control is.

4. Jonathan Armstrong shouts out to King Charles III, who had a 70-year apprenticeship as the Heir Apparent to the British throne.  

The members of Everything Compliance are:

•       Jay Rosen– Jay is Vice President, Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com

•       Karen Woody – One of the top academic experts on the SEC. Woody can be reached at kwoody@wlu.edu

•       Matt Kelly – Founder and CEO of Radical Compliance. Kelly can be reached at mkelly@radicalcompliance.com

•       Jonathan Armstrong –our UK colleague is an experienced data privacy/protection lawyer with Cordery in London. Armstrong can be reached at jonathan.armstrong@corderycompliance.com

•       Jonathan Marks is Partner, Firm Practice Leader – Global Forensic, Compliance & Integrity Services at Baker Tilly. Marks can be reached at jonathan.marks@bakertilly.com

The host and producer, ranter (and sometime panelist) of Everything Compliance is Tom Fox, the Voice of Compliance. He can be reached at tfox@tfoxlaw.com. Everything Compliance is a part of the Compliance Podcast Network.

Categories
Compliance Into the Weeds

HanesBrands Cyber Security Breach Disclosure

Compliance into the Weeds is the only weekly podcast which takes a deep dive into a compliance related topic, literally going into the weeds to more fully explore a subject. In this episode, we explore the recent disclosure by HanesBrands of a cyber security breach which cost the company over $100MM in sales in Q2 2022.  Highlights include:

  • Why the public disclosure.
  • What might the SEC rules around disclosure be when adopted.
  • Why CISOs and IT (and a whole host of other corp functions) needs to talk to compliance.
  • What if this were a physical breach?
  • How and where to get started.

Resources

Matt in Radical Compliance

Categories
Compliance Into the Weeds

Internal Controls Lessons from Cyber Failures in Wisconsin

Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject. In this episode, we deep dive into recent failures detected in the state of Wisconsin regarding cyber security risks around election integrity. Highlights include:

  • The risks were uncovered.
  • What is a material risk?
  • Why Multi-Factor Authentication is important cyber security control.
  • What are the consequences of a single point of failure?
  • How and when should redefine a hazard?
  • What does CISA say about MFAs?

Resources

Matt in Radical Compliance

Categories
Compliance Into the Weeds

The Wild and Wacky World of Control Failures

Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to more fully explore a subject. In this episode, we dive deeply into the recent story of an in-house attorney who was disbarred for fraudulent activities in creating fraudulent claims and settlements.  Highlights include:

·      Background facts.

·      Conflicts of Interests.

·      What were the internal control failures?

·      Were they material?

·      Lessons for the compliance professional.

Resources

Matt in Radical Compliance

Categories
Innovation in Compliance

Contracts as a Third-Party Risk Management Tool with Brad Hibbert


 
Tom Fox welcomes Brad Hibbert on this episode of the Innovation in Compliance Podcast. Brad is the Chief Strategy Officer of Prevalent, Inc. He joins Tom to talk about how Prevalent helps companies manage third-party risk, the importance of risk management, and what the future for risk management in the compliance world may look like. 
 

 
Managing Third-Party Risk
Tom asks Brad to explain how Prevalent helps companies manage third-party risks. “We have a SaaS platform that helps organizations identify those risks, report against those risks, and then provide remediation capabilities to reduce those risks at every stage of the vendor lifecycle,” Brad tells Tom. Risk management is no longer about just doing reactive reporting on an annual basis. Risk has to be proactively monitored, identified, and reduced on a day-to-day basis, and especially when companies are having day-to-day conversations with their third parties during contract execution. Prevalent enables its risk management platform by having different team members interact with the third parties to collaborate and reduce the risks at every stage of the vendor life cycle. 
 
A Must Have
Third-party risk management is a must-have right now, and will continue to be in the future. “What organizations are realizing is they have to move beyond the compliance check box and actually reduce the risk associated with these third parties,” Brad remarks. Compliance is one of the drivers of this, but another main factor is the pandemic. COVID has changed the way companies and businesses operate, and has also exposed their weaknesses. With the shift to the hybrid work environment, and the increase of work from home, companies have had rapidly onboard third-party risks due to the use of online platforms. The risk of cyber-attacks and information being leaked is high, so being able to manage and protect companies from that is paramount. 
 
The Contract Essentials SaaS Solution
Tom asks Brad to explain the contract essentials SaaS solution. The SaaS solution allows the company to onboard or add existing contracts. Prevalent’s platform has very strong workflow and collaboration capabilities that focus on vendor risk, which is also good for profiling current contracts to see where the risk lies. Companies can use the SaaS solution to upload their contracts, or any related documentation surrounding it to a secured file, and it allows them to collaborate with third parties outside of the corporate network.
 
The Future of Third-Party Risk Management
Brad predicts a convergence of third-party risk management and the broader third party. “We’re going to continue to focus on building solutions that are easy to use that enable data sharing between the different groups that promote efficiency, collaboration, and then risk reduction,” he says. Organizations can no longer simply rely on assessments, instead must have continuous insights play major roles at all levels of the vendor life cycle. Monitoring the financial risk, the business risk, and the cyber risk proactively to create appropriate measures is something that will continue as well. 
 
Resources
Brad Hibbert | LinkedIn | Twitter
Prevalent, Inc.
 

Categories
Blog

Continuous Improvement of Internal Controls

Cristina Revelo is the Deputy Director, Corporate Monitoring at Affiliated Monitors, Inc (AMI). Her academic background is in Master of Science and Bachelor of Science in Accountancy from the University of Illinois. Her professional background is in forensic accounting and internal controls. I visited with her about internal controls in practice inside a corporation.
Revelo said that internal controls are essentially any process that someone has to execute in order for the company to meet their objectives, whatever those objectives might be. In a corporate compliance department, the process procedure protocols you have in place that someone has to execute, can be an internal control. It could be an individual who inputs data into a system, or it could be automated or an individual who has to physically do something in order for you to meet your goal within your overall process.
We moved to a couple of terms which often cause confusion around internal controls. The first is compensating controls and the second is control override. Revelo explained that a compensating control is “essentially an alternative control. You set in place a manual control versus an automated. If your control system breaks down, you are compensating for your control in a different way.” However, she emphasized the key is that you are still following your normal process of executing your controls.
Next was control override. A control override is an override of a compliance internal control, a negative from an accounting perspective or even violation of the Foreign Corrupt Practices Act (FCPA). She explained that a control override should be the exception and not the rule for any corporate compliance or finance function. There must be a business reason and it must be documented, Revelo stated, “We definitely don’t advertise having to override controls, but we understand that there are emergency instances where you need to override a control that should be properly documented.”
However, what happens when controls are continually overridden? Does that necessarily mean that companies are engaging in activities which violate the FCPA or some other law such as Sarbanes-Oxley (SOX). Revelo said she would start out with some basic questions such as “How often would something be manually approved? How often are controls skipped, what are the level of approvals that you have and what is your document? What are the reasons, and are you documenting how often a certain department is requiring those overrides?” While it could indicate a company lacks a culture of compliance or everything is an emergency, it might mean something else. It might mean that your internal controls need to be evaluated and then recalibrated. The Department of Justice (DOJ) calls this continuous monitoring leading to continuous improvement. Joe Oringel, co-founder of Visual Risk IQ, calls it continuous controls monitoring.
However, many compliance professionals, and particularly lawyers think once a control is in place, it’s set in stone, and it’s there forever. This derives from the unfortunate fact that once again many compliance professionals and most lawyers do not understand internal controls. Yet, internal controls, much like the rest of a compliance program can and should be continually monitored and continually improved based upon the information about such things as the number of overrides. Such a review can be evidence of a management problem or a culture of non-compliance at the organization. However, it could be that perhaps the controls need to be adjusted.
We then turned to how to assess and then update or enhance your internal controls. Companies should also think about updating and reviewing their controls at least annually. In this manner, they can identify any violations of their internal controls. It also allows a deep dive into any specific areas of control failures. Another approach would be more robust through greater monitoring of your controls, for example, you could review them quarterly to allow you to spot any trends that are moving in the wrong direction. You can even start out by having your compliance function perform a self-review of its controls and  test exemplar transactions. This is not a full-blown audit but simply desktop testing to make sure controls were properly followed. Once again simply because there is a control override or excessive use of a compensating control does not mean something is illegal. It may mean that the control is not working as it was designed.
Revelo said it could be an instance of “too short of an approval time period and they need a little bit longer because depending on their industry or how business works. This also helps to both  identify frustrations from employees where there is a control, but every time I need to execute, it is impossible for me to do, or it’s impossible for me to comply with it a hundred percent. These are the reasons.” These quarterly reviews can then be collated into an annual report for review and assessment and the report can form the basis of an annual report to the Compliance Committee of the Board of Directors or even the full Board.
The key is to have a process for monitoring the controls, taking input, literally from each line of defense. If a control is overridden too often, you need to change it. If a control is ineffective, you can use that information to craft a new internal control. Internal controls are not static, but dynamic and, with proper oversight, you can set up internal controls and literally improve them with appropriate documentation. (Hint” Document, Document, and Document)
Revelo emphasized it is not simply identifying the issues “because that actually might look worse if you identify a lot of issues, but do not fix them. You are better off by remediating everything you are identifying.” From there you can conduct a root cause in that analysis as to why there was failure in a control or violation of a compliance procedure. Revelo concluded, “you need to really do that in depth and then remediate it.”
Interestingly, Revelo noted that a Board of Directors has a significant role to play with internal controls. It is because all compliance literally starts with the very top of an organization and this is true when it comes to internal controls. She said, “probably the most important aspect of establishing a really great foundation for great execution of internal controls is with the Board. It all starts with the Board; with the way they advise the company with their priorities of the year and objectives for the year.” The importance of a corporate compliance program should be communicated throughout their organization and highlight the company’s commitment to compliance.
When I talk about internal controls to lawyers, I still see about half of them roll their eyes up inside their heads. However, that is a huge improvement from 10 years ago when all the lawyers had the same reaction. By using some of the strategies Revelo recommends for continuous monitoring and continuous improvement of internal controls, you have not only robust internal controls but more importantly effective internal controls.

Categories
This Week in FCPA

Episode 282 – The Naughty List Edition


With Jay on a holiday assignment, Tom is joined by Professor Karen Woody to look at some of the week’s top compliance and ethics stories this week in the Naughty List edition.
Stories

  1. JPMorgan tagged $200MM for failures in electronic record keeping. Tom in the FCPA Compliance and Ethics Blog. Matt Kelly in Radical Compliance. Tom and Matt in Compliance into the Weeds.  
  2. Nikola was fined $125MM for the former CEO’s imprudent tweets. Tom in the FCPA Compliance and Ethics Blog. Matt Kelly in Radical Compliance. Jaclyn Jaeger in Compliance Week(sub req’d).
  3. SOX 20 years later. Michael Peregrine looks back at the upcoming 20th anniversary of Sarbanes-Oxley in the Harvard Law School Forum on Corporate Governance
  4. France is updating its ABC regime. Frederick Davis in GAB.   
  5. Another Unaoil defendant appeals conviction based upon SFO misconduct. Dylan Tokar in WSJ Risk and Compliance Journal.
  6. What happened to FCPA Compliance in 2021? Dick Cassin explores in the FCPA Blog.  
  7. The story of internal controls and Netflix? Jonathan Marks in BakerTilly.  
  8. Vietnam imposes a 14-year sentence for wildlife trafficking. Jon Rusch in Dipping Through Geometries
  9. Lawyers and ESG. Lawrence Heim in PracticalESG
  10. Prioritizing your policy updates. David Banks in Risk and Compliance Matters.

Podcasts and Events

  1. Want some fun over the holidays? Join Tom and One Stone Creative co-founder Megan Dougherty to explore the full MCU. In Episode 1, Captain America. In Episode 2, Captain Marvel. Next week in Episode 3, Iron Man.  
  2. In December on The Compliance Life, I visited with Matt Silverman, Director of Trade Compliance at VIAVI. Matt is the first Trade Compliance Director I have hosted on TCL. In Part 1, Matt details his academic career and early professional life. In Part 2, Matt moves into trade compliance. In Part 3, Matt moves into the Director’s chair. 
  3. The Compliance Podcast Network welcomes Professor Karen Woody and her new podcast, Classroom Insider. In this unique pod, Karen interviews some of her students to tell them the history of insider trading. Check out Episode 1 on  Episode 2, the disclosure or abstain rule. In Episode 3 (premiering Dec. 31), they will take up narrowing the scope of the disclose or abstain rule. 
  4. The Shout Outs and Rants of Everything Compliance gets its own iTunes show. Everything Compliance has its first-year end review episode. 
  5. On Hidden Traffic, Gwen Hassan hosts Andrew Wallis, head of Unseen UK.

Tom Fox is the Voice of Compliance and can be reached at tfox@tfoxlaw.com. Karen Woody is a Professor of Law at Washington and Lee. She can be reached at kwoody@wlu.edu. 

Categories
Blog

On the Naughty List – Urban Meyer

We conclude our pre-Christmas Naughty List review and today we have one person who is on the Very Naughty List. That person is now former Jacksonville Jaguars head coach Urban Meyer. The missteps, inanity and downright irresponsible actions taken by Meyer during his abortive less than one season with the Jags is not only one for the annals in National Football League (NFL) history but provides multiple lessons learned for the compliance professional.
Meyer was a very successful college coach winning national titles at two schools, Florida and Ohio State. But he was clearly out of his depth in the NFL, which of course is professional football and not college football. But the red flags were all there for any who cared enough to look. Clearly, they were ignored by the Jags owner, now to his shame and humiliation. It began almost immediately after Meyer’s hiring when he tried to retain a strength and conditioning coach who had been fired at Iowa for allegations of racial abuse.
Michael DiRocco reported, “In February, Meyer hired former Iowa strength coach Chris Doyle, who was accused of making racist remarks and belittling and bullying players while with the Hawkeyes. Doyle resigned a day later after the Jaguars were criticized for the hire by the Fritz Pollard Alliance.” Before the resignation, Meyer had claimed he had done his due diligence on Doyle with Meyer adding, he “did not consider the implications of hiring him.” Later in the summer, the NFL “fined the Jaguars $200,000 and Meyer $100,000 for excessive contact during a June 1 organized team activity. The team also must forfeit two OTAs during the first week of the 2022 offseason, meaning they will have only eight.”
Please note the season had not even started yet.
The Jags got off to an ignominious start losing to the pathetic Houston Texas and began the season 0-4. It was at this point, missteps turned into inanity. After losing to the Cincinnati Bengals to reach 0-4, Meyer did not travel back to Jacksonville with the team but went to Columbus OH to unwind, relax with friends and to visit with his grandchildren. Almost immediately, “a video began circulating on social media on Oct. 1 that showed a woman who was not Meyer’s wife dancing close to his lap at his Columbus restaurant. Meyer apologized in positional group meetings early in the week, then at a news conference and again in a team meeting later in the week. Khan also issued a public rebuke.”
As the losing wore on, Meyer’s true personality came out. Andrew Gastelum, reported that in November Meyer “was involved in multiple disputes with players and coaches over the last two weeks, including a heated argument with receiver Marvin Jones and that Jones was reportedly so angry with Meyer’s criticism of Jaguars receivers that he left the team facility. According to Pelissero, staff convinced the receiver to return only for him to get into a heated argument with Meyer at practice.” Moreover, “Meyer reportedly challenged assistants to defend their résumés individually during a staff meeting where he told his coaching staff that he was a winner and that they were losers.” Of added significance to this reporting was, according to Tom Pelissero, that the sources for this story came from the NFL office, not simply Jag players. Predictably, in an incredibly inane move, as reported by Jordan Dajani, Meyer denied both events ever happened.
Yet even Meyer was capable of achieving another low, moving to complete irresponsibility.
Enraged and wrongfully believing that the source of this latest escapade came from inside the Jags, he announced anyone that blew the whistle on him would be unceremoniously shown the door, as in immediately. Then last week, Ryan Glasspiegel, reported that former Jags kicker Josh Lambo accused of Meyer of kicking him at practice in August. Lambo said, “It certainly wasn’t as hard as he could’ve done it, but it certainly wasn’t a love tap. “Truthfully, I’d register it as a five (out of 10). Which in the workplace, I don’t care if it’s football or not, the boss can’t strike an employee. And for a second, I couldn’t believe it actually happened. Pardon my vulgarity, I said, ‘Don’t you ever f–king kick me again!’ And his response was, ‘I’m the head ball coach, I’ll kick you whenever the f–k I want.’”
Unsurprisingly Meyer denied this also ever happened. Yet this is where complete irresponsibility turns to the surreal. While Meyer was denying the event ever took place, he had his lawyers threatening the reporter who broke the story. But here is the surrealness, as the lawyers did not dispute that Meyer kicked Lambo, only how hard. So, Meyer’s lawyers admit there was an assault, it just was not serious.
Finally, even the Jags owner had enough and when the assault allegations broke, he fired Meyer that night. The owner, Shad Khan claimed that he had intended to fire Meyer after the latest loss on Sunday, but it took him several days to get his ducks in a row. Of course, while the owner was doing so, Meyer was still coaching the Jags. Me thinks something is rotten with that story.
What are the lessons for the compliance professional in all of this?
Let’s start with due diligence. Meyer was penalized in Columbus for his less-than-ethical behavior around an assistant coach accused of assaulting his wife. He somehow managed to lose or deleted multiple text message on the topic. He was suspended for three games by Ohio State for his conduct. All of this was in the public record and there for all to see. Think executive due diligence is not important? Think again (and while you are thinking about it call Candace Tal.)
Internal Controls. Yes, there are internal controls in football. One such control deals with player safety based upon amount of physical contact which can occur during offseason training camp (OTA). Meyer and the Jags were fined for having players engage in contact drills. In typical Meyer fashion, he had the Jags deny the team had done anything wrong as it was the players who simply could not contain themselves.
Discipline. Pro football has a Neanderthal governance structure (with the noted exception of the Green Bay Packers, who exist in a parallel socialist world). There is no public company, no Board overseeing the company. There is an owner and every significant employee reports directly to the owner. Clearly the owner, who did not do due diligence on Meyer’s character, was not going to discipline him. Although he belatedly claimed he was going to do so after the most recent loss, that seems like “Monday Morning Quaterbacking” to me. Do you really think that if any other Jag employee engaged in any of this behavior they would not have been sacked? Discipline must be delivered uniformly and fairly. That is called Institutional Fairness and is the responsibility of the Chief Compliance Officer (CCO). It is also a requirement of a compliance program. As was noted in the original FCPA Resource Guide, compliance has to apply from the “Board room to the shop floor.” Even in the recent Securities and Exchange Commission (SEC) enforcement action involving JPMorgan, the SEC required “an evaluation of who violated policies and why, what penalties were imposed, and whether penalties were handed out consistently across business lines and seniority levels.”
Perhaps now you might understand why Urban Meyer is on the Very Naughty List. But you can use the lessons learned to help keep your organization off the Naughty List in 2022 and beyond.

Categories
Innovation in Compliance

Not Your Father’s Monitor-Part 3: Cristina Revelo on E&C Assessment and Internal Controls

In October, Deputy Attorney General (DAG) Lisa O. Monaco gave a Keynote Address at ABA’s 36th National Institute on White Collar Crime (Monaco Speech). Monaco’s remarks should be studied by every compliance professional as they portend a very large change in the way the DOJ will utilize monitors going forward.

Over this podcast series, sponsored by AMI we will consider why DAG Monaco’s remarks herald a new era for monitorships. We will consider Monaco’s remarks from a variety of perspectives. Bethany Hengsbach will consider this change in monitorships from the white-collar enforcement and defense perspective. Mikhail Reider Gordon will look at global aspects of the new DOJ monitor’s focus. Cristina Revelo will discuss how E&C assessments help drive More compliant companies. Jesse Caplan brings his views on the twin topics of antitrust and healthcare compliance. We will conclude our series with AMI founder Vin DiCianni who will look at where monitors monitorships are going in 2022 and beyond. In this Episode 3, Cristina Revelo brings her internal control expertise to analyze for E&C assessments, particularly with monitors and monitorships.

Highlights of this podcast include:

  1. Monitoring skills will be in demand as we see the rise of proactive monitorships / assessments
  2. Compliance and ethical culture are important considerations to review.
  3. E&C Assessments help companies get ahead of what is coming, mitigate risk, ensure compliance and address any gaps that might exist before a regulator comes knocking on their door.

Resources

Cristina Revelo

Affiliated Monitors Inc.