SEC Chair Clayton Talks Compliance Costs. Will the new administration gut SOX and Dodd-Frank compliance requirements?
Tag: SEC
Cease and Desist Order also covered former employee Jeannot Lorenz, and the SEC spelled out a bribery scheme facilitated by both a failure and override of company internal controls. The matter involved Halliburton’s work in Angola with the national oil company Sonangol, which had a local content requirement. The nefarious acts giving rise to the FCPA violation involved a third-party agent for Halliburton’s contracts with the state-owned enterprise. According to the SEC Press Release, this matter initially began in 2008 when officials at Sonangol, Angola’s state oil company, informed Halliburton management it had to partner with more local Angolan-owned businesses to satisfy local content regulations. The company was successful in meeting the requirement for the 2008 contracting period. However, when a new round of oil company projects came up for bid in 2009, Sonangol indicated, “Halliburton needed to partner with more local Angolan-owned businesses to satisfy content requirements.” Halliburton’s prior work on local content was deemed insufficient, and “Sonangol remained extremely dissatisfied” with the company’s efforts. Sonangol backed up this dissatisfaction with a potential threat to veto further work by Halliburton for Sonangol. Under this backdrop, the local business team moved forward with a lengthy effort to retain a local Angolan company (Angolan agent) owned by a former Halliburton employee who was a friend and neighbor of the Sonangol official who would ultimately approve the award of the business to Halliburton. In each of these attempts, the company bumped up against its internal controls around third parties, both on the sales side and through the supply chain. The first attempt to hire the Angolan agent was as a third-party sales agent, which under Halliburton parlance is called a “commercial agent.” In this initial attempt, internal control was held as the business folks abandoned their efforts to contract with the Angolan agent. The first attempt to hire the Angolan agent was rejected because the local Business Development (BD) team wanted to pay a percentage fee based, in part, upon work previously secured under the 2008 contract and not new work going forward. Additional fees would be paid on new business secured under the 2009 contract. This payment scheme for the Angolan agent was rejected as the company generally paid commercial agents for work they helped obtain and not work secured in the past. Further, the company was not seeking to increase its commercial agents during this time frame (Halliburton had entered into a Deferred Prosecution Agreement (DPA) for FCPA violations in December 2008 for the actions of its subsidiary KBR in Nigeria). Finally, “As outlined by Halliburton’s legal department, to retain the local Angolan company as a commercial agent, it would be required to undergo a lengthy due diligence and review process that included retaining outside U.S. legal counsel experienced in FCPA compliance to conduct interviews. Halliburton’s in-house counsel noted that “[t] he is undoubtedly a tortuous, painful administrative process, but given our company’s recent US Department of Justice/SEC settlement, the board of directors has mandated this high level of review.” In other words, the internal controls held and were not circumvented or overoverriddene Angolan agent was then moved from commercial agent status to supplier so the approval process would be easier. The proposed reason for this switch in designations was that the Angolan agent would provide “real estate maintenance, travel, and ground transportation services” to the company in Angola. However, the internal controls process around using a supplier also had rigor as they required a competitive bidding process which would take several months to complete. Over-riding this internal control, the local business team could contract with the Angolan agent for these services in September 2009 and increase the contract price without the Angolan agent going through the internal procurement controls. A second internal control overridden was the procurement requirement that the supplier procurement process begins with “an assessment of the critically or risk of a material or services”; not with a particular supplier and certainly not without “competitive bids or providing an adequate single source justification.” However, as the Order noted, the process was taken backward, with the Angolan agent selected and then “backed into a list of services it could provide.” Finally, a separate internal control required “contracts over $10,000 in countries with a high risk of corruption, such as Angola, to be reviewed and approved by a Tender Review Committee.” Inexplicably this internal control was also circumvented or overoverriddent. This arrangement was not deemed sufficient local content by Sonangol officials. After all of this and further negotiations, Halliburton entered into another agreement with the Angolan agent, where the company would lease commercial and residential real estate and then sublease the properties back to Halliburton at a substantial markup and also provide real estate transaction management consulting services (the “Real Estate” contract). This Real Estate contract also had to go through an internal control process. Initially, there were questions the company about the Real Estate contract as a single source for the procurement function, the upfront payment terms to the Angolan agent, the high costs, and the rationale for entering into subleases for properties that would cost less if leased directly from the landlord. Indeed, “One Finance & Accounting reviewer at headquarters noted that he could not think of any legitimate reason to pay the local Angolan company over $13 million under the Real Estate Transaction Management Agreement and that it would not have cost that much to run Halliburton’s entire real estate department in Angola.” Halliburton’s internal controls required that it had to be justified when the company used a single source. This justification would require a showing of preference for quality, technical, execution, or other reasons, none of which were demonstrated by the Angolan agent. Finally, if such a single source was used, the reasons had to be documented in Halliburton’s internal controls language “identified and justified.” The company documented none. Finally, as the internal controls were either circumvented or over-ridden, “As a consequence, internal audit was kept in the dark about the transactions, and its late 2010 yearly review did not examine them.” This was yet another internal control failure built on the previous failures noted above. So how many internal controls failures can you spot? Whatever the number, the lesson for the compliance practitioner is that you must do more than have internal controls. They must be followed and be effective. If you are doing business in high-risk regions, you have to test the controls and back up your testing by seeing if payments are being made in those regions. Perhaps the best concept would be Reaganian, trust but verify.
Three Key Takeaways
- Internal controls must be shown to be effective.
- Circumvention and management override of internal controls must be documented to pass muster.
- Internal controls must be tested, and that testing must be verified with an independent source of investigation.
Internal controls must be tested and verified to demonstrate effectiveness. For more information on improving your internal controls management process, visit this month’s sponsor Workiva at workiva.com.
Internal Controls – Integrated Framework, Illustrative Tools for Assessing Effectiveness of a System of Internal Controls” (herein ‘the Illustrative Guide’), COSO laid out its views on “how to assess the effectiveness of its internal controls.” It went on to note, “An effective system of internal controls provides reasonable assurance of achievement of the entity’s objectives, relating to operations, reporting, and compliance.” Moreover, two over-arching requirements can only be met through such a structured post. First, each of the five components is present and functioning. Second, are the five components “operating together in an integrated approach.” One of the most critical components of the COSO Framework is that it sets internal control standards against those you can audit to assess the strength of your compliance with internal control. As the COSO 2013 Framework is designed to apply to a wider variety of corporate entities, your audit should be designed to test your internal controls. If you have a multi-country or business unit organization, you must determine how your internal compliance controls are interrelated up and down the organization. The Illustrative Guide also realizes that smaller companies may have less formal structures in place throughout the organization. Your auditing can and should reflect this business reality. Finally, if your company relies heavily on technology for your compliance function, you can leverage that technology to “support the ongoing assessment and evaluation” program going forward. The Illustrative Guide suggests using a four-pronged approach in your assessment. (1) Make an overall assessment of your company’s system of internal controls. This should include an analysis of “whether each of the components and relevant principles is present and functioning and the components are operating together in an integrated manner.” (2). There should be a component evaluation. Here you need to evaluate any deficiencies you may have more deeply and whether there are any compensating internal controls. (3) Assess whether each principle is present and functioning. As the COSO 2013 Framework does not prescribe “specific controls that must be selected, developed and deployed,” your task here is to look at the main characteristics of each principle, as further defined in the points of focus, and then determine if a deficiency exists and it so what is the severity of the deficiency. (4) Finally, you should summarize all your internal control deficiencies in a log, so they are addressed on a structured basis. Another way to think through the approach could be to consider “the controls to effect the principle” and would allow internal control deficiencies to be “identified along with an initial severity determination.” A Component Evaluation would “roll up the results of the component’s principal evaluations” and would allow a re-evaluation of the severity of any deficiency in the context of compensating controls. Lastly, an overall Effectiveness Assessment would examine whether the controls were “operating together in an integrated manner by evaluating any internal control deficiencies aggregate to a major deficiency.” This process would then lend itself to an ongoing evaluation. If business models, laws, regulations, or other situations changed, you could assess if your internal controls were up to the new situations or needed adjustment. The Illustrative Guide spent a fair amount of time discussing deficiencies. Initially, it defined ‘internal control deficiency’ as a “shortcoming in a component or components and relevant principle(s) that reduces the likelihood of an entity achieving its objectives.” It defined‘ major deficiency’ as an “internal control deficiency or combination of deficiencies that severely reduces the likelihood that an entity can achieve its objectives.” A major deficiency is a significant issue because “When a major deficiency exists, the organization cannot conclude that it has met the requirements for an effective internal control system.” Moreover, unlike deficiencies, “a major deficiency in one component cannot be mitigated to an acceptable level by the presence and functioning of another component.” Under a compliance regime, you may be faced with known or relevant criteria to classify any deficiency. For example, if written policies do not have, at a minimum, the categories of policies laid out in the FCPA 2012 Guidance, which states “the nature and extent of transactions with foreign governments, including payments to foreign officials; use of third parties; gifts, travel, and entertainment expenses; charitable and political donations; and facilitating and expediting payments,” also formulated in the Illustrative Guide, such a finding would preclude management from “concluding that the entity has met the requirements for effective internal controls by the Framework.” However, what steps should you take if there are no objective criteria, as laid out in the FCPA 2012 Guidance, evaluate your company’s compliance with internal controls? The Illustrative Guide says that a business’ senior management, with appropriate board oversight, “may establish objective criteria for evaluating internal control deficiencies and for how deficiencies should be reported to those responsible for achieving those objectives.” Together with appropriate auditing boundaries set by either established law, regulation, or standard, or through management exercising its judgment, you can then make a full determination of “whether each of the components and relevant principles is present and functioning and components are operating together, and ultimately in concluding on the effectiveness of the entity’s system of internal control.” The Illustrative Guide has a useful set of templates that can serve as the basis for your reporting results. They are specifically designed to “support an assessment of the effectiveness of a system of internal control and help document such an assessment.” The Document, Document, and Document feature are critical in any best practices anti-corruption or anti-bribery compliance program, whether based upon the FCPA, UK Bribery Act, or some other regulation. With the Illustrative Guide, COSO has given the compliance practitioner a handy road map to begin an analysis of your company’s internal compliance controls. When the SEC comes knocking, they will look for this type of evidence to evaluate if your company has met its obligations under the FCPA’s internal controls provisions. First are some general definitions that you need to consider in your evaluation. An internal compliance control must be both present and functioning. A control is present if the “components and relevant principles exist in the design and implementation of the system of [compliance] internal control to achieve the specified objective.” An internal compliance control functions if the “components and relevant principles continue to exist in the conduct of the system of [compliance] internal controls to achieve specified objectives.”
Three Key Takeaways:
- An effective internal controls system provides reasonable assurance of the entity’s objectives relating to operations, reporting, and compliance.
- There are two over-arching requirements for effective internal controls. First, each of the five components is present and functional. Second are the five components operating together in an integrated approach.
- You can use the Tem Hallmarks of an Effective Compliance Program for an anti-corruption compliance program as your guide to testing against.
For more information on improving your internal controls management process, visit this month’s sponsor Workiva at workiva.com. The COSO model can be used to structure your assessment of internal controls.
Show Notes for Everything Compliance-Episode 14
Topics from Matt:
- Trump Administration & FCPA enforcement— we have two declinations now; maybe a compare-and-contrast and speculation on what a tough Trump Admin enforcement WOULD look like;
- EU’s GDPR— Do EU regulators know what they want to do with the enforcement of this law; if they follow the lead of the anti-competition people whacking Google, it could be a big deal;
- Hui Chen’s departure from the Justice Department, both her public rebuke of Trump and the substance of how she believes her guidance has been misinterpreted; and
- Ethical leadership and the lack thereof; the menace of abusing perks and privilege, connecting my posts about Uber’s leaders and Chris Christie vacationing on a closed beach.
Topics from Jay:
- How do the Campaign Finance Laws mirror/or differ from the FCPA?
- Will the Russian Collusion Investigation reveal the ultimate FCPA violation?
- Regarding Walter Shaub’s departure from the Office of Governmental Ethics (OGE), does it matter? What is OGE supposed to do, and why did it work for the past 40+ years but fall on deaf ears with the Trump administration?
- Dovetailing with Matt’s question about a slow H1 for FCPA enforcement and in light of the just-released Gibson Dunn FCPA Mid-Year Report, does the current climate (and lack of vigorous enforcement) provide a perfect storm for companies to look the other way if they fall off the E&C wagon, or do we think that companies are still being vigilant despite a perception of decreased enforcement?
Rants follow this week’s episode. What do the two declinations in 2017 mean? The Everything Compliance panel of experts weighs in.
Kokesh v. SEC, the US Supreme Court held the profit disgorgements operate as a penalty under the Securities and Exchange Act of 1934, as amended. As such “any claim for disgorgement in an SEC enforcement action must be commenced within five years of the date the claim accrued.” The position of the Securities and Exchange Commission (SEC) at the Supreme Court and in all other matters involving this issue was that profit disgorgement were not punitive, hence not a penalty but rather remedial in nature so the SEC could clawback all monies generated as a result of the illegal action. The decision, authored by Justice Sotomayor, was a 9-0 opinion which in the rarified world of Supreme Court decisions is about as clear a message as one can get. The Court first determined that profit disgorgement met the definition of a “penalty” under two basis, “First, whether a sanction represents a penalty turns in part on “whether the wrong sought to be redressed is a wrong to the public, or a wrong to the individual.” Second, a pecuniary sanction operates as a penalty if it is sought “for the purpose of punishment, and to deter others from offending in like manner” rather than to compensate victims.” [citations omitted] Thus, if a statute provided a compensatory remedy for a private wrong, it should not be characterized as penalty. For additional thoughts from Marc, see his piece on the FCPA Blog. For additional thoughts from myself, see my piece on the FCPA Compliance and Ethics Blog. [tweet_box design=”default” url=”http://wp.me/p6DnMo-3kd” float=”none”]The Kokesh decision has significant implications for FCPA enforcement going forward.[/tweet_box]]]>
This episode is dedicated to the chaotic (at best) first 100 days of the Trump administration related to compliance.
- Jonathan Armstrong leads a discussion of the Trump administration’s devolution of Privacy Shield, GDPR, and what they mean for American companies doing business in the UK and EU. He discusses the key differences in the DOJ’s Evaluation of Corporate Compliance Programs in an FCPA analysis and under the Bribery Act, differences in the EU approach to conflict minerals, and under the Trump Administration, and concludes by giving us his thoughts on what Brexit means for compliance.
For the Cordery Compliance client alerts, see the following:
EU conflicts minerals compliance legislation
DOJ Evaluation of Corporate Compliance: how does it compare to UK Bribery Act 2010?
BREXIT Glossary
- Jay Rosen considers what companies the intersection of business and politics under the Trump administration, the business response he has observed to Trump administrations steps and miss-steps, the comments made by DOJ representatives at Q1 conferences, and the vibe of compliance conference attendees.
For Jay’s posts, see,
Still in the Enforcement Business and Evaluation of Corporate Compliance Programs
“It Was the Best of Times, It was the Worst of Times,” or “Ignorance is Strength”
Matt Kelly opens with a discussion of regulatory enforcement under the Trump administration, how the ‘Trump Effect’ is negatively impacting corporations, and industry responses to deregulation issues and lays down some markers around compliance issues under the new administration.
For Matt Kelly’s posts, see:
Compliance in the Trump Era: More Markers Placed
Trump Administration Whacks Telco Firm for $892 Million
Drone Industry Pan Trump’s Regulatory
Trump Risk Disclosures Start Rolling In
First SEC Whistleblower Award of the Trump Era
Sessions Dodges, Weaves, Promises on FCPA
- Mike Volkov rounds out the discussion with a review of where the DOJ is currently under AG Sessions, remarks by DOJ officials on FCPA enforcement, the future of the Pilot Program, and DOJ Compliance Counsel Hui Chen.
For Mike Volkov’s posts, see the following:
Yates, AG Sessions and Individual Criminal Prosecutions
New E-Book — Moving the Goalposts: The Justice Department Redefines Effective Compliance
FCPA Remediation Focus on Supervisory Personnel
FPCA Pilot Program Motors On
For Tom Fox’s posts on the Trump administration’s first 100 days, see the following:
The Trump Administration-Kaos is Bad for Business
The Trump Administration-Failures in Leadership and Management
The Trump Administration-Preparing for a Catastrophe
The Trump Administration-the Business Response
DOJ Enforcement of the FCPA and the International Fight against Corruption in the Trump Administration
The members of the Everything Compliance panel include:
- Jay Rosen– Jay is Vice President, Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com
- Mike Volkov – One of the top FCPA commentators and practitioners around and the Chief Executive Officer of The Volkov Law Group, LLC. Volkov can be reached at mvolkov@volkovlawgroup.com.
- Matt Kelly – Founder and CEO of Radical Compliance, is the former Editor of Compliance Week. Kelly can be reached at mkelly@radicalcompliance.com
- Jonathan Armstrong – Rounding out the panel is our UK colleague, who is an experienced lawyer with Cordery in London. Armstrong can be reached at armstrong@corderycompliance.com
[tweet_box design=”default” url=”http://wp.me/p6DnMo-3eF” float=”none”]What has the Trump effect meant for FCPA? The experts weigh in.[/tweet_box]]]>
- Jonathan Armstrong discusses the Trump administration’s devolution of Privacy Shield, GDPR, and what they mean for American companies doing business in the UK and EU. He discusses the key differences in the DOJ’s Evaluation of Corporate Compliance Programs in an FCPA analysis, under the Bribery Act, in the EU approach to conflict minerals, and under the Trump Administration. He concludes by giving us his thoughts on what Brexit means for compliance.
For the Cordery Compliance client, alerts see the following: EU conflicts minerals compliance legislation DOJ Evaluation of Corporate Compliance: how does it compare to UK Bribery Act 2010? BREXIT Glossary
- Jay Rosen considers what companies the intersection of business and politics under the Trump administration, the business response he has observed to Trump administrations steps and miss-steps, the comments made by DOJ representatives at Q1 conferences, and the vibe of compliance conference attendees.
For Jay’s posts, see, Still, in the Enforcement Business and Evaluation of Corporate Compliance Programs “It Was the Best of Times, It was the Worst of Times,” or “Ignorance is Strength” Matt Kelly opens with a discussion of regulatory enforcement; under the Trump administration, how the ‘Trump Effect’ is negatively impacting corporations, industry responses to deregulation issues and lays down some markers around compliance issues under the new administration. For Matt Kelly’s posts, see Compliance in the Trump Era: More Markers Placed Trump Administration Whacks Telco Firm for $892 Million Drone Industry Pan Trump’s Regulatory Trump Risk Disclosures Start Rolling In First SEC Whistleblower Award of Trump Era Sessions Dodges, Weaves, Promises on FCPA.
- Mike Volkov rounds out the discussion with a review of where the DOJ is currently under AG Sessions, remarks by DOJ officials on FCPA enforcement, the future of the Pilot Program, and DOJ Compliance Counsel Hui Chen.
For Mike Volkov’s posts, see the following: Yates, AG Sessions and Individual Criminal Prosecutions New E-Book — Moving the Goalposts: The Justice Department Redefines Effective Compliance FCPA Remediation Focus on Supervisory Personnel FPCA Pilot Program Motors On For Tom Fox’s posts on the Trump administration’s first 100 days see the following: The Trump Administration-Kaos is Bad for Business The Trump Administration-Failures in Leadership and Management The Trump Administration-Preparing for a Catastrophe The Trump Administration-the Business Response DOJ Enforcement of the FCPA and the International Fight against Corruption in the Trump Administration The members of the Everything Compliance panel include:
- Jay Rosen– Jay is Vice President, Business Development Corporate Monitoring at Affiliated Monitors. Rosen can be reached at JRosen@affiliatedmonitors.com.
- Mike Volkov – One of the top FCPA commentators and practitioners and the Chief Executive Officer of The Volkov Law Group, LLC. Volkov can be reached at mvolkov@volkovlawgroup.com.
- Matt Kelly – Founder and CEO of Radical Compliance, is the former Editor of Compliance Week. Kelly can be reached at mkelly@radicalcompliance.com.
- Jonathan Armstrong – Rounding out the panel is our UK colleague, an experienced lawyer with Cordery in London. Armstrong can be reached at armstrong@corderycompliance.com.
Jay Rosen new contact information:
Jay Rosen, CCEP
Vice President, Business Development
Monitoring Specialist
Affiliated Monitors, Inc.
Mobile (310) 729-6746
Toll Free (866)-201-0903
JRosen@affiliatedmonitors.com
[tweet_box design=”default” url=”http://wp.me/p6DnMo-3aD” float=”none”]How can the use of data help to operationalize your compliance program?[/tweet_box]]]>
For the Cordery Compliance client alert on Privacy Shield, see here
- Jay Rosen considers what companies the intersection of business and politics under the Trump administration, the Tech sector response to the Muslim refugee ban and the more general business response to the first few weeks of the Trump administation.
For Jay’s post see, Where Do Politics End and Ethics & Compliance Begin?
- Matt Kelly opens with a discussion of the management process practices of the Trump administration in issuing Executive Orders and lays down some markers around compliance and regulatory issues under the new administration.
For Matt Kelly’s posts see the following:
Compliance in the Trump Era: More Markers Placed
Five Questions for SEC Nominee Jay Clayton
Yes Government Ethics is Happening
Dodd-Frank Reform Starts Coming into View
For Tom Fox’s posts on these topics see the following:
The Trump Administration-Kaos is Bad for Business
The Trump Administration-Part II, Failures in Leadership and Management
The Trump Administration-Part III-Preparing for a Catastrophe
The Trump Administration-Part IV-the Business Response
The members of the Everything Compliance panel include:
- Jay Rosen (Mr. Translations) – Jay is Vice President of Legal & Corporate Language Solutions at United Language Group. Rosen can be reached at rosen@ulgroup.com.
- Mike Volkov – One of the top FCPA commentators and practitioners around and is the Chief Executive Officer (CEO) and owner of The Volkov Law Group, LLC. Volkov can be reached at mvolkov@volkovlawgroup.com.
- Matt Kelly – Founder and CEO of Radical Compliance, is the former Editor of the noted Compliance Week Kelly can be reached at mkelly@radicalcompliance.com
- Jonathan Armstrong – Rounding out is our UK colleague, who is an experienced lawyer with Cordery in London. Armstrong can be reached at armstrong@corderycompliance.com
[tweet_box design=”default” url=”http://wp.me/p6DnMo-336″ float=”none”]What compliance and business lessons arise from the first 3 weeks of the Trump administration?[/tweet_box]]]>
Categories
This Week in FCPA-Episode 35
th edition:
- Hernandez and Beech FCPA guilty pleas. Hernandez Criminal Information, Beech Criminal Information.
- VW guilty plea in emissions-testing scandal. Link to article in New York Times.
- VW executive Oliver Schmidt arrested in US. See article on FCPA Compliance and Ethics Blog.
- Zimmer Bio-Met in follow-up FCPA enforcement action. See article on FCPA Blog.
- Mondelez FCPA enforcement action. See SEC Cease and Desist Order and article on FCPA Compliance and Ethics Blog.
- Supreme Court to take up 5 year statute of limitations for profit disgorgement under Securities Act, which applies to FCPA enforcement actions brought by SEC. Article in Law360.
- NFL Playoff update on Patriots, Cowboys and Texans.
[tweet_box design=”default” url=”http://wp.me/p6DnMo-2XB” float=”none”]What were the FCPA matters, issues and lessons from the week ending January 13, 2017? Check out This Week in FCPA.[/tweet_box]]]>
