Tag: US Sentencing Guidelines

Categories
Blog

Ted Lasso Week: Part 2 – Rebecca Welton: Misuse of Authority, Conflicts of Interest, and the Path to Accountability

Season 4 of Ted Lasso is out. Matt Kelly reposted a blog he wrote during the original run of the series, and he and I did a deeper dive into the show and its popularity for compliance professionals in an episode of Compliance into the Weeds. I decided to take a deep dive into five characters from the show and use them to explore compliance topics. Over five blog posts, I will consider Manager Ted Lasso, Assistant Manager Nate Shelley, player and later coach Roy Kent, and social media influencer Keeley Jones. Today in Part 2, we consider compliance lessons through the character of team owner Rebecca Welton.

In Part 1, we considered how Ted Lasso built psychological safety and an ethical culture while sometimes allowing empathy to outrun accountability. Rebecca Welton presents the problem from the other side of the executive table. She begins as the source of AFC Richmond’s misconduct, then becomes the leader best positioned to acknowledge it.

Rebecca’s story is not simply a redemption arc. It is a governance case study about what happens when personal objectives capture corporate authority. It also shows why confession, forgiveness, and improved behavior are necessary but insufficient elements of an effective remediation program. The compliance lesson is direct: power creates risk when no independent mechanism can question the person exercising it.

When the Owner Becomes the Risk

In “Pilot” (Season 1, Episode 1), Rebecca hires Ted, an American football coach with no soccer experience, to manage a Premier League club. Her stated rationale is irrelevant because her actual purpose is to destroy the institution Rupert Mannion loves. She uses Richmond’s people, reputation, competitive position, and financial value to pursue a private grievance.

That is a classic conflict between personal interest and organizational duty. Rebecca is not accepting an envelope of cash or steering a contract to a relative. Her conflict is more fundamental: she has converted corporate decision-making into an instrument of revenge. The COSO Internal Control Framework begins with the control environment, including integrity, ethical values, oversight, authority, and accountability. At Richmond, the control environment fails at the top. The owner sets an improper objective, possesses the authority to execute it, and faces no visible independent challenge.

Compliance officers should take note. Conflicts of interest do not end with disclosure forms. They arise whenever personal relationships, status, resentment, financial incentives, or outside interests can distort business judgment. The greater the executive’s authority, the stronger the required safeguards.

Concentrated Authority Silences Challenge

Rebecca’s plan requires assistance. Higgins facilitates her agenda even though he recognizes the harm. In “Make Rebecca Great Again” (Season 1, Episode 7), Rebecca arranges for a photographer to capture Ted and Keeley in a compromising image. The objective is not legitimate media strategy. It is manufactured reputational damage intended to destabilize Ted and the club.

Higgins is not merely an unfortunate bystander. He is a senior employee who allows access, information, and organizational machinery to serve the owner’s improper purpose. His eventual resignation is a delayed act of conscience, but the episode demonstrates how authority can corrupt the escalation process. Employees may know that conduct is wrong and still conclude that challenging the owner is futile or career-ending.

The DOJ Evaluation of Corporate Compliance Programs asks whether “compliance personnel (1) sufficient qualifications, seniority, and stature (both actual and perceived) within the organization; (2) sufficient resources, namely, staff to undertake the requisite auditing, documentation, and analysis effectively; and (3) sufficient autonomy from management, such as direct access to the board of directors or the board’s audit committee.” It also asks whether managers encourage or discourage compliance through their conduct. Richmond has no credible independent function capable of reviewing Rebecca’s decisions, investigating her conduct, or escalating around her.

Accountability Begins With Truth

Keeley becomes the effective speak-up channel Richmond lacks. Once she discovers Rebecca’s scheme, she does not accept friendship, hierarchy, or reputational risk as reasons to stay silent. She insists that Rebecca tell Ted the truth. Rebecca finally does so in “All Apologies” (Season 1, Episode 9). She admits that she hired Ted to fail, orchestrated the paparazzi scheme, and engineered Jamie Tartt’s return to Manchester City to weaken Richmond. Most importantly, she does not minimize her purpose. She explains that she wanted to hurt Rupert and used Ted and the club to do it.

This is an effective apology because it identifies conduct, intent, and harm. It also accepts the possibility of consequences. Yet it is not a remediation. Nevertheless, Ted forgives her immediately, but an actual organization could not stop there. The U.S. Sentencing Guidelines require an organization to respond appropriately after misconduct and take reasonable steps to prevent similar conduct. DOJ asks whether the company performed a root-cause analysis, disciplined responsible individuals, repaired controls, and tested whether remediation works.

Richmond would need an independent review of affected personnel decisions, financial consequences, sponsor and stakeholder impacts, the use of confidential information, and Higgins’s role. It would also need governance changes that prevent one executive from repeating the conduct. An apology can reopen trust. Only remediation can reduce recurrence risk.

The Conflict Problem Returns With Sam

Rebecca’s growth does not eliminate conflicts. In “The Signal” and “Headspace” (Season 2, Episodes 6 and 7), Rebecca discovers that her anonymous Bantr match is Sam Obisanya, a Richmond player. Their relationship develops in “Man City” (Season 2, Episode 8) and continues secretly into “No Weddings and a Funeral” (Season 2, Episode 10).

The relationship is portrayed with warmth and mutual affection. That does not resolve the organizational issue. Rebecca owns the club that controls Sam’s employment environment. Her decisions can affect contracts, playing resources, sponsorships, reputation, and career opportunities. Even if she never exercises that power improperly, the imbalance creates an appearance of favoritism and raises questions about consent, retaliation, confidentiality, and recusal.

The compliance response is not moral judgment. It is a process. A conflict policy must apply to owners and senior executives, not only employees. Disclosure should go to an independent board member or committee. The organization should document safeguards, remove the conflicted leader from relevant decisions, protect the less powerful party, and monitor for retaliation or preferential treatment. Rebecca eventually pauses the relationship, but Richmond never appears to activate a formal conflict-management process. Personal restraint is not a control.

From Personal Ownership to Stewardship

Rebecca’s leadership changes when she stops treating Richmond as property and begins treating it as an institution held in trust for others. In “Do the Right-est Thing” (Season 2, Episode 3), Sam protests sponsor Dubai Air because of its connection to environmental damage in Nigeria. Rebecca backs the players despite the commercial risk. She recognizes that sponsorship revenue does not outrank organizational values.

Her transformation is clearest in “International Break” (Season 3, Episode 10). Edwin Akufo invites elite club owners to join an exclusive league built around scarcity, control, and profit. Rebecca rejects the proposal by reminding the room that football belongs to the people whose lives and communities give it meaning. She chooses stakeholder legitimacy over a lucrative insiders’ arrangement.

In “So Long, Farewell” (Season 3, Episode 12), she completes that shift by selling 49 percent of Richmond to its supporters. The woman who once used the club as a weapon ultimately distributes part of its ownership to the community.

This is what ethical remediation should seek: not a return to the status quo, but a more accountable operating model.

Questions for CCOs

Rebecca’s journey should prompt five questions:

  1. Can an allegation against the CEO, founder, controlling shareholder, or board chair bypass that person and reach an independent decision-maker?
  2. Do conflict rules cover personal relationships, vendettas, reputational motives, and executive discretion, or only financial interests?
  3. When senior misconduct occurs, who controls the investigation, discipline, disclosure, and remediation plan?
  4. Does the board receive reliable information about culture and mission-critical risks without management filtering?
  5. Are remediation measures tested, documented, and sustained after the responsible leader apologizes?
  6. Rebecca Welton shows that leaders can change. Compliance must make that change governable. Trust is rebuilt when truth is followed by independent review, proportional accountability, control improvements, and evidence that the organization learned.

Next Up: Nate Shelley and Culture Risk

Rebecca’s failure begins with power concentrated at the top. Nate Shelley’s failure develops lower in the organization, where insecurity, humiliation, status, and unaddressed resentment turn a once-overlooked employee into a destructive manager and trusted insider. In Part 3, we will examine the warning signs Richmond missed, the consequences of promoting technical talent without preparing them to lead, and why a speak-up culture must detect harm committed by newly empowered employees as readily as misconduct committed by executives.

Categories
Blog

Ted Lasso Week: Part 1 – Ted Lasso: Ethical Leadership, Psychological Safety, and the Limits of Good Intentions

Season 4 of Ted Lasso has begun dropping (a new episode releases each Wednesday). Matt Kelly reposted a blog he wrote during the original run of the series, and he and I did a deeper dive into the show and its popularity for compliance professionals in an episode of Compliance into the Weeds. I decided to take a deep dive into five characters from the show and use them to explore compliance topics. Over the next 5 blog posts, I will consider team owner Rebecca Welton, Assistant Manager Nate Shelley, player and later coach Roy Kent, and social media influencer Keeley Jones. Today in Part 1, we begin with compliance lessons through the character of Ted Lasso.

Ted Lasso arrives at AFC Richmond with no meaningful knowledge of English football, a skeptical locker room, a hostile press, and an owner who secretly hired him to fail. On paper, he is an obvious control failure. In practice, he becomes the architect of Richmond’s cultural transformation.

For compliance professionals, that transformation is the point. Ted demonstrates how a leader can create trust, encourage candor, and turn values into daily behavior. He also demonstrates the limits of values-led leadership. Good intentions do not investigate misconduct. Empathy does not test a control. Forgiveness does not remediate a root cause.

The compliance lesson from Ted is not simply to “believe.” It is to build a culture in which accountability, information, controls, and oversight support belief.

Culture Is What the Leader Does

Ted’s first contribution is not tactical. It is behavioral. He learns names, asks questions, listens to people with little formal authority, and treats the kit man, Nate Shelley, as a colleague whose observations matter. In “Trent Crimm: The Independent” (Season 1, Episode 3), Ted recognizes that Jamie Tartt and other players are humiliating Nate. Rather than deliver a speech about respect and move on, Ted engages Roy Kent, the informal leader whose intervention can change locker-room conduct.

That is tone at the top connected to conduct in the middle. The DOJ Evaluation of Corporate Compliance Programs (ECCP) asks how senior leaders and managers have encouraged compliance through their words and actions. It states in part, “Beyond compliance structures, policies, and procedures, it is important for a company to create and foster a culture of ethics and compliance with the law at all levels of the company. The effectiveness of a compliance program requires a high-level commitment by company leadership to implement a culture of compliance from the middle and the top.”

The Principles of Federal Prosecution of Business Organizations (Justice Manual) likewise directs prosecutors to examine culture at all levels, including discipline, treatment of complaints, and incentives. 9.28.300 states in part that prosecutors shall consider “the pervasiveness of wrongdoing within the corporation, including the complicity in, or the condoning of, the wrongdoing by individuals in corporate management”. In Section 9-28.800, it directs the DOJ to review a “company’s culture of compliance”.

Ted understands instinctively that culture does not travel through posters. It travels through managers, peer leaders, everyday decisions, and the behavior an organization tolerates. A chief compliance officer can publish a code. Only operational leaders can make that code real during the meeting, on the sales call, and inside the locker room.

Psychological Safety Requires a Response System

Ted creates space for people to speak before they have status. He accepts tactical input from Nate, invites dissent from Coach Beard, and builds the Diamond Dogs as an informal forum for candid discussion. By “La Locker Room Aux Folles” (Season 3, Episode 9), Richmond can confront Colin Hughes’s sexuality and Isaac McAdoo’s reaction with empathy. Ted initially hears the team’s claim that Colin’s identity makes no difference, then corrects the underlying message: the team should care because Colin’s experience matters.

This is psychological safety in practice. Employees must be able to raise a concern, disclose vulnerability, or challenge a decision without humiliation or retaliation. Yet a compliance program needs more than an approachable leader. Equally importantly, a culture of Speak Up must be paired with a culture of Listen Up.

Richmond relies heavily on Ted’s availability and temperament. That is a strength while Ted is present and a key-person risk when he is absent. A mature speak-up program requires intake standards, anti-retaliation controls, escalation criteria, case tracking, trend analysis, and board reporting. An open door is valuable. It is not an operating system.

Accountability Must Apply to Stars and Friends

Ted’s strongest accountability moment comes in “Tan Lines” (Season 1, Episode 5), when he benches Jamie after the star player refuses to follow the team’s approach. Ted chooses collective standards over short-term performance. That is exactly the decision many organizations avoid when the employee at issue is a top salesperson, rainmaker, founder, or executive.

He is less decisive when loyalty clouds his judgment. In “All Apologies” (Season 1, Episode 9), Beard and Nate press Ted to confront Roy’s declining performance. Ted initially resists, even though the competitive risk is visible. He eventually has the necessary conversation and gives Roy a dignified path to support the team from the bench.

The contrast matters. DOJ asks whether discipline is applied consistently and whether the company tolerates misconduct by high performers. Compliance credibility collapses when consequences depend on revenue, rank, or personal affection. Ethical leadership is not the absence of hard decisions. It is the willingness to make them fair and explain the standard.

Forgiveness Is Not Remediation

Rebecca’s confession in “All Apologies” presents Ted’s greatest strength and clearest compliance blind spot. She admits that she hired him to fail, manipulated club decisions, and used people as instruments in her campaign against Rupert. Ted forgives her immediately.

At a human level, the scene is powerful. At an organizational level, forgiveness cannot close the matter. Richmond would still need to establish what happened, preserve evidence, identify affected decisions, assess financial and stakeholder harm, determine whether others participated, evaluate disclosure obligations, and strengthen governance.

The US Sentencing Guidelines require organizations to respond appropriately after misconduct and take steps to prevent recurrence. DOJ similarly focuses on root-cause analysis, remediation, and whether control improvements are tested. Ted offers grace, which can support rehabilitation. He does not create a record showing that the organization learned from the failure.

This distinction should matter to every CCO: mercy concerns the person; remediation concerns the institution. A company may do both. It cannot substitute one for the other.

Vulnerability Can Strengthen the Control Environment

Ted’s panic attacks show the cost of a culture in which even a supportive leader believes he must appear invulnerable. His attack during karaoke in “Make Rebecca Great Again” (Season 1, Episode 7) remains largely private. In “Headspace” and “Man City” (Season 2, Episodes 7 and 8), he finally engages with Dr. Sharon Fieldstone and begins addressing the trauma connected to his father’s suicide. After Nate leaks his panic attack to the press, Ted speaks honestly to the team and the public in “Inverting the Pyramid of Success” (Season 2, Episode 12).

Leaders retain legitimate medical privacy. The compliance point is not compelled disclosure. Organizations need trusted support channels, succession and contingency plans, and an environment where asking for help is not treated as weakness. Ted’s eventual candor reduces stigma. His earlier concealment creates an information vacuum that Nate weaponizes.

Within the COSO Internal Control Framework, Ted materially improves the control environment and information and communication. Richmond’s weakness is monitoring. Warning signs involving Nate, including humiliation of subordinates, resentment, and escalating hostility, do not reach a reliable response process before he leaks Ted’s health information and leaves for West Ham.

The Final Test Is Whether Culture Outlasts the Leader

By Season 3, Ted increasingly shifts from hero to system builder. “Sunflowers” and “The Strings That Bind Us” (Season 3, Episodes 6 and 7) show Richmond developing Total Football through shared learning, role flexibility, and trust. In “So Long, Farewell” (Season 3, Episode 12), Ted leaves, but Roy, Beard, Rebecca, Higgins, and the players can carry the culture forward.

That is the institutional test. A compliance program that depends on one charismatic executive is not sustainable. Caremark oversight principles require boards to make a good-faith effort to establish and monitor information and reporting systems, particularly around mission-critical risks, as the Delaware Supreme Court emphasized in Marchand v. Barnhill (the Bluebell Ice Cream case). Ted changes Richmond’s values. Governance must ensure that those values become repeatable processes, reliable information, and accountable decisions.

Practical Takeaways for CCOs 

Ted Lasso offers five questions for a CCO and compliance team:

  1. Do employees trust leaders, and can the organization demonstrate that concerns receive a consistent response?
  2. Are high performers held to the same behavioral standards as everyone else?
  3. When misconduct occurs, does forgiveness follow investigation and remediation rather than replace them?
  4. Are managers trained and monitored as culture carriers, especially after promotion?
  5. Would the speak-up culture and compliance program remain effective if a trusted leader departed tomorrow?

Ted’s enduring lesson is that ethical culture begins with human connection. Effective compliance begins there as well, but it cannot end there. Richmond becomes stronger when curiosity replaces judgment, candor replaces silence, and team standards replace individual entitlement. The next step for any real organization is to convert those behaviors into controls that can be tested, monitored, reported, and sustained.

Join us tomorrow in Part 2, as we turn to Rebecca Welton, whose decision to use AFC Richmond as an instrument of personal revenge reveals the risks created when concentrated authority operates without independent challenge. We will examine executive conflicts, institutional remediation, and Rebecca’s transformation from conflicted owner to accountable steward by requiring governance that can hold power to account.

Categories
Blog

The NBA Betting Scandal, Part 4: The Role of Compliance in Sports Leagues

We previously considered the who, the what, and the histories of the NBA betting scandal. Today, we explore the ‘how’: how a compliance function could have prevented this, and what both sports leagues and corporations can learn from each other about safeguarding integrity. Whether your organization manages global investments or global fan bases, the lesson remains the same: governance without compliance is merely a façade, and compliance without culture is noise.

The NBA’s Blind Spot: Compliance Is Not Just for Corporations

The NBA, like many professional leagues, has long emphasized rules enforcement rather than risk management. It has compliance policies, anti-gambling rules, player education programs, and disclosure requirements, but these are largely reactive. What’s missing is the proactive, integrated approach that corporate compliance professionals have built over the last two decades.

Think about the Sarbanes-Oxley Act (SOX). Following a series of accounting scandals in the early 2000s, companies not only created new rules but also established compliance infrastructures, internal controls, whistleblower channels, independent oversight committees, and risk-based monitoring systems.

The NBA, in contrast, still operates under a “trust-the-player” model, one that assumes personal integrity will outpace financial temptation. The DOJ indictment proves that assumption no longer holds. In today’s data-driven, gambling-integrated sports environment, league compliance must evolve into a true governance function, not merely a disciplinary office.

The Corporate Compliance Framework Applied to Sports

To understand what that evolution might look like, I want to apply the classic corporate compliance framework — the Seven Elements of an Effective Compliance Program, as outlined in the US Sentencing Guidelines —to a professional sports context.

1. Standards and Procedures

Corporations have codes of conduct that define acceptable behavior. Sports leagues have them too, but they’re often vague or limited to rulebooks. The NBA needs a clear, enforceable code of compliance that articulates not just what players cannot do, but also why a framework rooted in integrity, rather than punishment, is necessary. Imagine a “Sports Compliance Charter” that explicitly defines insider betting as a form of fraud, akin to insider trading. That reframing alone would elevate the stakes, moving it from a “rules violation” to a “trust violation.”

2. Oversight and Accountability

Corporate boards delegate compliance oversight to audit and ethics committees. The NBA’s governance, however, largely resides in the Commissioner’s office. That’s too much concentration of oversight for a league managing billions in sports betting partnerships.

A modern model would involve an independent Compliance and Integrity Committee reporting directly to the league’s Board of Governors. This committee would review potential conflicts of interest, audit betting-related data, and monitor patterns of suspicious player performance. Independence breeds credibility.

3. Due Diligence and Risk Assessment

Before a merger, corporations perform risk-based due diligence. Before every season, leagues could conduct a similar compliance risk assessment, focusing on areas such as gambling exposure, data security, and player-agent relationships. Who are the players with large gambling debts? Which coaches or trainers have undisclosed financial interests in betting companies? These are not personal invasions; they are integrity controls. Compliance starts by identifying risk, not reacting to scandal.

4. Training and Communication

Corporate compliance officers understand that training isn’t about memorizing policy; it’s about shifting mindsets. The NBA’s anti-gambling training should move beyond the “don’t do this” model toward scenario-based ethics education where players explore gray areas, learn about real-world enforcement cases, and understand the long-term reputational damage of misconduct. In corporate terms, this distinction lies between check-the-box training and culture-building education. Compliance is not a slide deck; rather, it is a dialogue.

5. Monitoring and Auditing

Just as compliance programs utilize transaction monitoring or expense audits, the NBA can leverage data analytics to identify irregularities in player performance and betting patterns. If a player suddenly exits two games early, as Jontay Porter did, that should trigger an automatic integrity review, just as an anomalous financial transaction might trigger an AML alert.

This is where the corporate concept of continuous monitoring can revolutionize sports compliance. Algorithms already track betting odds in real-time; coupling that data with player analytics would enable early detection of suspicious trends.

6. Reporting and Whistleblowing

No compliance program functions without psychological safety. The NBA should establish anonymous channels for reporting concerns not only for employees but also for players, trainers, and referees. If a player suspects a teammate is manipulating outcomes, there must be a trusted way to report it without fear of retaliation. In the corporate world, such mechanisms are essential to uncovering misconduct early. The same must apply to locker rooms.

7. Enforcement and Remediation

Discipline must be consistent and transparent. When corporations investigate misconduct, they publish their findings, impose proportionate penalties, and integrate the lessons learned. The NBA’s enforcement process remains opaque, with outcomes often perceived as being influenced by politics. Public trust demands transparency in discipline. When penalties are seen as fair and consistent, they reinforce the league’s credibility, just as consistent FCPA enforcement enhances the integrity of the corporate sector.

Compliance Culture: The Missing Link

Ultimately, no framework works without culture. Compliance officers recognize that even the most sophisticated policies are ineffective if the culture prioritizes winning at any cost. Sports leagues often celebrate risk-taking, competitiveness, and personal brand-building, traits that, when unchecked, evolve into entitlement and moral flexibility. That’s the same cultural recipe that fueled Enron, Wells Fargo, and Volkswagen.

The solution is not to suppress ambition, but to align it with ethical purpose. Imagine if the NBA  and other leagues embedded compliance values into player leadership programs, performance reviews, and even contract bonuses. The message would shift from “Don’t get caught” to “Play with integrity.”

The Compliance Officer as Integrity Architect

For compliance professionals, this scandal presents an opportunity to reimagine the role of the compliance officer not just in business, but in every trust-based institution. In corporations, the CCO acts as an integrity architect, designing systems that enable ethical decision-making even under pressure. Sports leagues need the same role. Call it the Chief Integrity Officer: a function that bridges governance, analytics, education, and enforcement.

This role could oversee not just gambling risks, but conflicts of interest, sponsorship ethics, and social media conduct, the entire ecosystem of reputation management. In the modern economy, integrity is a managed asset, and someone must be accountable for its stewardship.

Moreover, corporate compliance programs succeed when leadership models ethical behavior. The same applies in sports. When coaches or executives participate in insider schemes, as alleged in the case of Damon Jones, they set a destructive tone. But imagine the opposite, a league where coaches discuss integrity as openly as game strategy, and general managers reward transparency over secrecy. Tone at the top is contagious. In corporations, it builds trust. In sports, it rebuilds it.

From Scandal to Systemic Change

The NBA betting scandal is a compliance failure, but it can also be a catalyst. Like Enron and WorldCom before it, this crisis can drive reform if the league commits to systemic change.

For compliance officers, the takeaway is both familiar and urgent:

  • Do not wait for regulation to force change.
  • Design compliance as governance, not guidance.
  • Measure culture as closely as you measure performance.

Whether you’re managing a multinational enterprise or a billion-dollar sports league, the principle remains constant: integrity isn’t enforced; it’s engineered.

Final Thought: Compliance Beyond the Court

The NBA’s scandal is not simply a sports story. It is a warning about what happens when performance eclipses principle. For compliance professionals, it also serves as a form of validation.

Our work, often behind the scenes, is what protects institutions from self-destruction. The NBA didn’t fail because of bad luck; it failed because of missing systems. The same can happen in any organization that mistakes compliance for bureaucracy instead of recognizing it for what it truly is: the infrastructure of trust. Whether you are in a boardroom or a locker room, culture always calls the next play.

Join us tomorrow, as we continue our exploration in Part 5, to delve into the intersection of culture, incentives, and the psychology of ethical failure. We will examine how even well-meaning individuals cross ethical lines when the system prioritizes results over values.

Categories
FCPA Compliance Report

Ellen Hunt on Compliance ROI and on a Due Diligence and the US Sentencing Guidelines

In this episode of the Diligent Compliance Week 2025 Speaker Preview Podcasts series, Ellen Hunt discusses her two presentations at Compliance Week 2025, “Culture Effectiveness and ROI: How to Move the Needle” and “Assessing Effectiveness: Do the 30-Year-Old Federal Sentencing Guidelines Still Work? “

In her first panel presentation, they will discuss the following:

  • Demonstrate measurable and quantifiable ROI
  • Build psychological safety that drives ethical decision-making and engagement.
  • Navigate matrix environments to expand the influence.
  • Use data to tell compelling compliance success stories.
  • Partner with the C-suite to help them navigate disruptive changes, including deregulation and major economic geopolitical shifts.

In her second presentation, she and Carrie Penman, the Chief Risk and Compliance Officer at Navex, will debate whether the US Sentencing Guidelines should be updated.

I hope you can join us at Compliance Week’s 20th Anniversary National Conference. This year’s event will be held April 28-30 at The Mayflower Hotel, Autograph Collection, Washington, D.C. The lineup is first-rate, with some top ethics and compliance practitioners around.

Drop by the Diligent booth for some Compliance Podcast Network coffee to gain insights and make connections at the industry’s premier cross-industry national compliance event, offering knowledge-packed, accredited sessions and take-home advice from the most influential leaders in the compliance community. Back for its 20th year, compliance, ethics, legal, and audit professionals will gather safely face-to-face to benchmark best practices and gain the latest tactics and strategies to enhance their compliance programs.

Categories
FCPA Compliance Report

FCPA Compliance Report – Eric Morehead on Understanding the Role and Function of the U.S. Sentencing Commission

Welcome to the award-winning FCPA Compliance Report, the longest-running compliance podcast. In this episode, Tom welcomes Eric Morehead to discuss the role and function of the U.S. Sentencing Commission.

Eric is the Director of Advisory Services Solutions at LRN and former Assistant General Counsel at the U.S. Sentencing Commission. He and Tom review the intricacies of the U.S. Sentencing Commission’s role, structure, and impact. Eric walks through his professional journey and explains the Sentencing Commission’s function in standardizing federal criminal sentences and promoting organizational compliance programs. He emphasizes the importance of the Sentencing Guidelines, the process for their amendment, and the challenges faced by the Commission, such as quorum issues. The discussion also touches on current topics, including the potential impact of executive orders on DEI policies and the FCPA pause, stressing the continued relevance of the Sentencing Guidelines in compliance program development.

Key highlights:

  • Eric Morehead’s Background and Role at the U.S. Sentencing Commission
  • Understanding the U.S. Sentencing Commission
  • Process of Creating and Amending Sentencing Guidelines
  • Impact of Sentencing Guidelines on Compliance Programs
  • Current Issues in Compliance: DEI and FCPA Enforcement

Resources:

Eric Morehead on LinkedIn

LRN

US Sentencing Guidelines for Organizations

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

The Trafigura FCPA Enforcement Action – Part 3 – The Penalty

We continue our exploration of the resolution of the FCPA enforcement action involving the Swiss trading firm G Trafigura Beheer B.V. (Trafigura), an international commodity trading company with its primary operations in Switzerland. The company pleaded guilty and will pay over $126 million to resolve an investigation stemming from the company’s corrupt scheme to pay bribes to Brazilian government officials to secure business with Brazil’s state-owned and state-controlled oil company, Petróleo Brasileiro S.A. Petrobras (Petrobras). The matter was resolved via a Plea Agreement. Information detailing the company’s conduct was also issued.

Given the multi-year nature of the bribery scheme, how high it went up in the organization, the lack of self-disclosure, and the admittedly lack of stellar cooperation, one might wonder how Trafigura could obtain any discount from their overall penalty.  There was no total figure to show the amounts of bribes paid by Trafigura in the Plea Agreement.  However, it was noted that Trafigura earned over $61 million in profits from the business obtained through the corrupt scheme. Yet Trafigura received a 10% discount off the 50th percentile of the applicable US Sentencing Guidelines acceptable range. How did Trafigura achieve this discount?

Cooperation

The starting point for this analysis is the Plea Agreement. However, we should note that Trafigura failed to preserve and produce certain documents and evidence on time and, at times, took positions inconsistent with full cooperation, “particularly during the early phase of the department’s investigation.” Additionally, Trafigura was slow to exercise disciplinary and remedial measures for certain employees whose conduct violated company policy. Finally, Trafigura “ultimately accepted responsibility for its criminal conduct. Its previous position in resolution negotiations also caused significant delays and required the offices to expend substantial efforts and resources to develop additional admissible evidence before the defendant constructively reengaged with the offices in agreeing to a negotiated resolution.”

This cooperation included (i) providing timely updates on facts learned during its internal investigation, (ii) making factual presentations to the DOJ, (iii) facilitating the interviews of employees and agents, including an employee located outside the United States, and arranging for counsel for employees where appropriate; (iv) producing relevant non-privileged documents and data to the department, including documents located outside the United States in ways that navigated foreign data privacy laws, accompanied by translations of certain documents; and (v) providing all relevant facts known to it, including information about individuals involved in the conduct. The compliance professional should note that Trafigura provided documents to the DOJ outside the United States in ways that navigated foreign data privacy laws.

The Remediation 

The Plea Agreement also included information on the remediation Trafigura carried out. Trafigura also took steps to fix the problems. These included (i) creating and implementing better, risk-based policies and procedures for things like fighting corruption, using middlemen and consultants, making payments to third parties, and assessing the risk of joint ventures and equity investments; (ii) improving the processes and controls around high-risk transactions; (iii) spending more money on training employees and testing their compliance; and (iv) making sure that the problems were fixed regularly. The final point is perhaps the most significant, as we have now seen the DOJ call out Albemarle and SAP for discontinuing their use of third-party agents.

Prior Misconduct

Trafigura also had prior misconduct, which the DOJ called out. While noting it was “not recent,” Trafigura had sustained a 2006 guilty plea for entering goods through false statements and a 2010 conviction for violating Dutch export and environmental laws concerning the discharge of petroleum waste in Côte d’Ivoire.

Fine Calculation

The explanation from the DOJ raised an open question in the minds of many compliance professionals regarding recent FCPA enforcement. That question was about how culture and prior misconduct were factored into the acceptable determination. This case follows the recent SAP enforcement action, in which a similar analysis was conducted. The DOJ does not discount fines off the low end of an acceptable range but instead in the middle between the high and low range. In the case of Trafigura, the high end of the acceptable range (after the complete calculation under the Sentencing Guidelines) was $170,345,061, and the low range was $85,172,530. As a result of the defendant’s cooperation and efforts to make things right, as well as the fact that some Trafigura Group companies had been guilty of similar crimes in the past, the DOJ took 10% off the middle of the two ranges, which put them in the 50th percentile. This led to a “total criminal fine” of $80,488,040, 10% less than the fifth percentile above the lowest possible fine under the Sentencing Guidelines.

Join us tomorrow, and we will conclude with lessons learned from the Trafigura enforcement action.

Categories
Blog

The SAP FCPA Enforcement Action-Part 4: The Fines: Self-Disclose, Self-Disclose, Self-Disclose

We continue our exploration of the SAP Foreign Corrupt Practices Act (FCPA) enforcement action. Today we go full geek in a look at the fine and penalty and most importantly what the fine and penalty communicate about what the Department of Justice (DOJ) and Securities and Exchange Commission (SEC) want from companies embroiled in a FCPA investigation. First the numbers.

DOJ

According to the Deferred Prosecution Agreement, the criminal fine and penalty is in the amount of $63,590,859, equal to approximately 54% of the Criminal Penalty ($63,700,000), reduced by $109,141 under the Criminal Division’s Pilot Program Regarding Compensation Incentives and Clawbacks. Additionally, the DOJ agreed to a “credit toward the Criminal Penalty the amount paid by the Company to authorities in South Africa for violations of South African law related to the same conduct described in the Statement of Facts, up to a maximum of $55,100,000 (the “Penalty Credit Amount”).”

SEC

According to the SEC Order, “SAP acknowledges that the Commission is not imposing a civil penalty based upon the imposition of an $ 118.8 million criminal fine as part of SAP’s resolution with the United States Department of Justice.” However, SAP did agree to disgorgement in the following amount, $85,046,035 and prejudgment interest of $13,405,149, for a total payment of $98,451,184. SAP received a disgorgement offset of up to $59,455,779 based on the U.S. dollar value for any payments made or to be made to the Government of South Africa or a South African state-owned entity in any parallel proceeding against Respondent in South Africa.

The SEC Order also reported these additional fines and penalties.

  • On March 15, 2022, SAP entered into a civil settlement with the South African Special Investigating Unit and others relating to the DWS conduct described above and paid ZAR 11 344.78 million ($21.4 million), which represented reimbursement of the entire amount SAP received from DWS under the 2015 and 2016 deals with DWS.
  • On October 18, 2023, SAP entered into a settlement agreement with the South African Special Investigative Unit and others relating to the Transnet conduct described above, pursuant to which it paid ZAR 214.39 million (approximately $11.42 million based on the exchange rate on the date of payment).
  • On November 1, 2023, SAP entered into a civil settlement with the South African Special Investigating Unit and others relating to the Eskom conduct described above, pursuant to which it paid ZAR 500 million (approximately $26.63 million based on the exchange rate on the date of payment).

The bottom line, as reported by the FCPA Blog is SAP agreed to pay a $118.8 million criminal penalty to the DOJ and an administrative forfeiture of $103.4 million to the SEC. SAP has also paid approximately $59.4 million to various South African authorities, for which they received a penalty credit of $55 million from the DOJ.

Fine Calculation

Let’s start with the DOJ. The basis comes from the US Sentencing Guidelines.  From the DPA we note the following:

  1. The November 1, 2023 U.S.S.G. are applicable to this matter.
  2. Offense Level. Based upon U.S.S.G. § 2Cl.1, the total offense level is 42, calculated as follows:
  • 2Cl.l(a)(2) Base Offense Level 12
  • 2Cl.l(b)(l) More than One Bribe +2
  • § 2Cl.l(b)(2), 2Bl.l(b)(l)(M) +24

Benefit (More than $ 65,000,000)

  • 2C 1.1 (b )(3) Involvement of High-Level Public Official +4

TOTAL                                                                                      42

  1. Base Fine Based upon U.S.S.G. § 8C2.4(d), the base fine is

$ I50,000,000.

  1. Culpability Score. Based upon U.S.S.G. § 8C2.5, the culpability score is

6, calculated as follows:

  • 8C2.5(a) Base Culpability Score 5
  • 8C2.5(b )(3)(B)(i) Unit had 200 or more employees + 3

and High-Level Personnel

  • 8C2.5(g)(2) Cooperation, Acceptance -2

TOTAL                                                                                      6

Calculation of Fine Range:

Base Fine                                                                     $ I50,000,000

Multipliers                                                       1.2 (min) / 2.4 (max)

Fine Range                                     $180,000,000 to $360,000,000

The key area to noted is the highlighted line entitled “§ 8C2.5(g)(2) Cooperation, Acceptance”.

The reason this line is so critical is that it is the one area under the US Sentencing Guidelines that a company can receive a discount or at least credit for actions it has taken to reduce the multiplier and thereby reduce the overall fine range. In the Sentencing Guidelines it states,

(g)       Self-Reporting, Cooperation, and Acceptance of Responsibility 

 If more than one applies, use the greatest:

  8C2.5(g)(1) (1)       If the organization (A) prior to an imminent threat of disclosure or government investigation; and (B) within a reasonably prompt time after becoming aware of the offense, reported the offense to appropriate governmental authorities, fully cooperated in the investigation, and clearly demonstrated recognition and affirmative acceptance of responsibility for its criminal conduct, subtract 5 points; or

 8C2.5(g)(2) (2)       If the organization fully cooperated in the investigation and clearly demonstrated recognition and affirmative acceptance of responsibility for its criminal conduct, subtract 2 points; or

 8C2.5(g)(3) (3)       If the organization clearly demonstrated recognition and affirmative acceptance of responsibility for its criminal conduct, subtract 1 point.

All this means a company if company self-discloses to the DOJ, it can receive a 5-point discount off the overall multiplier. SAP did not self-disclose so it lost this discount. If SAP had self-disclosed the multiplier range would have been something like 0.7 to 1.4, making the fine range $126 million to $252 million. From there the discount under the Sentencing Guidelines led the following “The Fraud Section and the Office and the Company agree, based on the application of the Sentencing Guidelines, that the appropriate criminal penalty is $118,800,000 (the “Criminal Penalty”). This reflects a 40% discount off the 10th percentile of the Sentencing Guidelines fine range.” By my estimation, this failure to self-disclose cost SAP an additional $20,000,000 under the Sentencing Guidelines alone.

But the analysis does not end there as the overall fine and penalty is also governed by the Corporate Enforcement Policy, under which a company can garner a full declination if the following criteria are met (1) self-disclosure, (2) extensive cooperation, (3) extensive remediation, and (4) profit disgorgement. Obviously, SAP failed to meet this burden as it did not self-disclose so a full Declination was never in the cards. But the company could and did receive credit under the Corporate Enforcement Policy with a monetary penalty in the amount of $63,590,859, equal to approximately 54% of the Criminal Penalty. There was a further reduction of the overall criminal fine, reduced by $109,141 under the DOJ’s Pilot Program Regarding Compensation Incentives and Clawbacks.

Moreover, under the Corporate Enforcement Policy, SAP’s failure to self-disclose cost it an opportunity of at least 50% and up to a 75% reduction off the low end of the U.S. Sentencing Guidelines fine range. Its actions as a criminal recidivist, resulted in it not receiving a reduction of at least 50% and up to 75% will generally not be from the low end of the U.S.S.G. fine range but rather at the 40% amount noted above. SAP’s failure to self-disclose cost it an estimated $20 million under the Sentencing Guidelines. It’s failure to self-disclose and recidivism cost it a potential $94.5 million in discounts under the Corporate Enforcement Policy.

While all these numbers might be enough to make your head swim (as it did mine); the significance and why I went through it in this detail is that the DOJ is clearly sending the message that self-disclosure is the single most important thing a company can do in any FCPA investigation or enforcement action. Kenneth Polite said that when announcing the updated Corporate Enforcement Policy in January 2023; it was enshrined the new Monitor Selection Policy as the number one reason for a company not having a monitor required. I heard Fraud Section head Glenn Leon say it as well at Compliance Week 2023 in a Fireside Chat with Billy Jacobsen.

The DOJ’s message could not be any clearer. Self-disclose; Self-disclose; Self-disclose.

 Resources

SEC Order

DOJ DPA

Join us tomorrow where we conclude with lessons learned for the compliance professional.

Categories
Blog

The World Has Changed: McDonald’s and the Oversight Duty of Officers-Part 3

This week, we are exploring a shift in the duties of care owed by corporate officers to the corporation. This shift is coming through the Chancery Court of Delaware in the case of McDonald’s Corporation and its former Executive Vice President and Global Chief People Officer of McDonald’s Corporation, David Fairhurst and his part in the creation of an absolute toxic atmosphere of sexual harassment at the very highest levels of the organization. The case is styled In re McDonald’s Corporation Stockholder Derivative Litigation, and in it, the court formally recognizes the oversight duties of officers of Delaware corporations. Today we discuss the role of the Chief Compliance Officer (CCO) in both the reasoning for the decision and what it means for CCOs going forward.

Perhaps one of the most interesting parts of the court’s opinion is that it draws from the US Sentencing Guidelines and their creation of the Chief Compliance Officer position as both reasons for the decision and as a guide to how the CCO position will be impacted by this ruling. The judge pointed to the US Sentencing Guidelines as a key basis for the creation of the original Caremark Doctrine. The court stated that a key reason for “recognizing the board’s duty of oversight was the importance of having compliance systems in place so the corporation could receive credit under the federal Organizational Sentencing Guidelines.” However, the Guidelines did not stop at the board level. The US Sentencing Guidelines mandated the creation of the CCO position.

Specifically, the “Guidelines state that “[h]igh- level personnel of the organization shall ensure that the organization has an effective compliance and ethics program” and such senior person(s) “be assigned overall responsibility for the compliance and ethics program.” The Guidelines went on to define an organization’s “high-level personnel” as “individuals who have substantial control over the organization or who have a substantial role in the making of policy within the organization,” which includes “a director; an executive officer; an individual in charge of a major business or functional unit of the organization, such as sales, administration, or finance; and an individual with a substantial ownership interest.”

The court somewhat dryly concluded “It would seem hard to argue that, simply by virtue of being an officer, the Chief Compliance Officer could not owe a duty of oversight. That, however, is the logical implication of Fairhurst’s position that only directors can owe a duty of oversight.”

The responsibilities of the CCO are wide and sometimes varied. Here the court stated, ““[s]pecific individual(s) within the organization shall be delegated day-to-day operational responsibility for the compliance and ethics program. Individual(s) with operational responsibility shall report periodically to high-level personnel and, as appropriate, to the governing authority, or an appropriate subgroup of the governing authority, on the effectiveness of the compliance and ethics program.” But the Delaware court also provided CCOs with some additional ammunition in their quest for true influence in a corporation by stating that “to carry out such operational responsibility, such individual(s) shall be given adequate resources, appropriate authority, and direct access to the governing authority or an appropriate subgroup of the governing authority.”

Finally, the CCO has a broad scope within an organization. Indeed the court noted, that only the Chief Executive Officer (CEO) has as broad a remit, stating “Although the CEO and Chief Compliance Officer likely will have company-wide oversight portfolios, other officers generally have a more constrained area of authority. With a constrained area of responsibility comes a constrained version of the duty that supports an Information-Systems Claim.”

Yet the breadth of this portfolio does not mean a CCO can be liable for every corporate failure, even those directly in culture or compliance. Here the standard of liability for the CCO is critical and standard is breach of the duty of loyalty through bad faith. The court noted, that in the decision of Stone v. Ritter, upholding the original Caremark decision, “the Delaware Supreme Court adopted the Guttman formulation and stated that a breach of the duty of loyalty, such as acting in bad faith, was a “necessary condition to liability.” After Stone, then-Vice Chancellor Strine acknowledged that Caremark duties carried overtones of care, but explained that “to hold directors liable for a failure in monitoring, the directors have to have acted with a state of mind consistent with a conscious decision to breach their duty of care.”

Rarely, if ever do you see a CCO engage in bad faith. There have been some instances but I can think or only one or two that rise to the level of bad faith. The good news for CCOs is that while there may be a new cause of action against them for a duty of oversight; if there is a compliance program in place and if that compliance program detects wrongdoing which is reported up to the Board; a CCO has most probably met their duty under this decision.

Please join me tomorrow as I explore how this court decision, together with the CCO certification mandate by the Department of Justice, the Monaco Memo and the new Corporate Enforcement Policy will all change the relationships and dynamics of Chief Compliance Officers in the corporate world.

Categories
FCPA Compliance Report

Eric Morehead – The US Sentencing Guidelines at 30

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast in compliance. I visit Eric Morehead, the Director of Advisory Services at LRN, in this special episode. We discuss the US Sentencing Guidelines on the 30th anniversary of their enactment and review the recent report on the history of the Sentencing Guidelines. Morehead, a former staff attorney at the US Sentencing Commission, looks at the numbers and considers the broader impact of the Sentencing Guidelines on compliance in the US and across the globe.

Some of the highlights include:

  • What are the US Sentencing Guidelines?
  • Why were they enacted?
  • How have the DOJ and Courts supported them?
  • What were the two amendments to the US Sentencing Guidelines?
  • What may be down the road for the US Sentencing Guidelines?

Resources

LRN

Eric Morehead on LinkedIn

A Deep Dive Into Organizational Sentencing Data by Eric Morehead on Law360

Categories
Compliance Into the Weeds

300th Anniversary Episode – Policies Policies Policies

The award-winning, Compliance into the Weeds is the only weekly podcast that takes a deep dive into a compliance-related topic, literally going into the weeds to explore a subject. In this special 300th Anniversary episode, we consider a recent academic paper that suggests that policies play a small role in persuading employees not to engage in bribery and corruption. Highlights include:

·       What did the paper conclude?

·       What is the role of procedures?

·       Tom details the one function of policies.

·       How does an operationalized compliance program work?

·       What is the intersection of policies and internal controls?

 Resources

Matt in Radical Compliance