Tag: Volkov Law Group

Categories
Blog

Assessing Communication Compliance: Ephemeral Messaging and Retention

I recently had the opportunity to visit with Alex Cotoia, Regulatory Manager, and Daniela Melendez, an Associate at The Volkov Law Group, on the importance of addressing electronic communications preservation and management in this new age of rapid technological change. They joined penned an article for the Volkov Law Group’s site, Corruption, Crime and Compliance entitled, “Google’s Failure to Preserve Electronic Communications — A Warning to Every Company of a New Reality Surrounding Electronic Data.”

Ephemeral messaging, a method of communication that automatically erases content after a short period of time, is becoming increasingly popular in both personal and business settings. Platforms like Snapchat and Instagram offer features that allow messages to disappear, providing a sense of privacy and security. However, the use of ephemeral messaging in business comes with its own set of challenges and legal implications. Additionally, as both Cotoia and Melendez noted “companies have to devote significant resources and attention to information technology and security, electronic communications and business-generated data, and to overall information security and governance.”

The pointed to a recent case involving Google, where the companies document retention policy for ephemeral messaging was 24 hours, yet a Court Order required such messages be preserved. The Court found Google failed to preserve its chat data, despite a preservation order that directed Google to preserve chat records by changing the default settings for the chat system.  The Court found that Google did not effectively emphasize the importance of those obligations to its employees.

The episode highlighted the concerns raised by the Department of Justice (DOJ) regarding the use of ephemeral messaging for illegal activities, leading to more enforcement actions. This poses challenges for investigations, particularly in the corporate sector. They related that at a “fundamental level, the case underscores the criticality of applying document preservation policies to all media used by an organization’s employees to conduct company business. This echoes guidance provided by the U.S Department of Justice in the context of recent updates to its guidelines concerning the “Evaluation of Corporate Compliance Programs.”  The most recent iteration of those guidelines calls on companies to thoroughly understand the various communication channels—including ephemeral messaging applications—utilized by a company’s employees to conduct business.”

The Google case is as an example of the legal liabilities and sanctions that can result from failing to preserve relevant evidence. In this case, Google was sanctioned by a district judge for failing to preserve employee chat evidence relevant to an antitrust litigation. The employees did not follow the company’s policies regarding document preservation, leading to legal consequences.

The implications of the Google case extend beyond commercial litigation and preservation of evidence. The DOJ’s focus on ephemeral messaging applications in their guidelines for evaluating corporate compliance programs sends a clear message to organizations that they need to adopt or refine their data preservation policies in relation to employee communication.

One of the key considerations for companies is to assess their risk profile and determine whether ephemeral messaging applications are appropriate for conducting business. High-risk industries, such as those prone to corruption, should prohibit the use of these applications due to the potential for concealing illegal activities. On the other hand, companies with lower risk profiles may be more lenient in allowing employees to use ephemeral messaging applications for legitimate business purposes.

The DOJ guidelines also emphasize the need for companies to proactively manage authorized communication channels, monitor and preserve all business-related electronic data, and develop specific policies for employee obligations regarding personal devices and document retention. This requires companies to account for all communication channels, maintain data consistently, and constantly monitor content for any evidence of illegal activity.

The Google case serves as a wake-up call for companies accustomed to more lax preservation policies. It highlights the importance of enforcing existing policies and providing comprehensive training to employees on document preservation. Failure to do so can result in legal consequences and sanctions.

Cotoia and Melendez also reported that they observed “an uptick” in inquiries from clients regarding ephemeral messaging policies and the need for guidance in this area. Companies are seeking advice on how to navigate the challenges and legal implications associated with ephemeral messaging in business.

The use of ephemeral messaging in business presents challenges and legal implications that organizations need to address. It is crucial for companies to refine their data preservation policies, consider the appropriateness of ephemeral messaging for their business, and proactively manage authorized communication channels. By doing so, companies can mitigate the risks associated with ephemeral messaging and ensure compliance with legal requirements.

Categories
FCPA Compliance Report

FCPA Compliance Report – Alex Cotoia and Daniela Meléndez Communications Compliance

Welcome to the award-winning FCPA Compliance Report, the longest-running podcast in compliance. In this episode, Tom Fox welcomes Alexander Cotoia and Daniela Meléndez from the Volkov Law Group to discuss the challenges and legal implications of ephemeral messaging in business.

Cotoia’s perspective emphasizes the significant risks ephemeral messaging poses for companies, particularly in terms of compliance and data preservation. He advocates for proactive measures, such as refining data preservation policies and monitoring all business-related electronic data. Similarly, Melendez, with her extensive knowledge and experience in conducting internal investigations, underscores the potential legal liabilities companies may face if they fail to secure relevant information. She cites real-world examples, like the Google case, to stress the importance of enforcing document preservation policies and educating employees on their responsibilities. Join Tom Fox, Alex Cotoia, and Daniela Meléndez as they delve deeper into this topic on the next episode of the FCPA Compliance Report podcast. 

Key Highlights:

  • Ephemeral Messaging: Balancing Compliance and Risk
  • Preserving Evidence and Compliance in Messaging
  • Data Preservation Policies and Risk Assessment
  • Paradigm Shift in Monitoring Business Communications

Resources:

Alex Cotoia on LinkedIn

Daniela Melendez on LinkedIn

Volkov Law Group

Google’s Failure to Preserve Electronic Communications — A Warning to Every Company of a New Reality Surrounding Electronic Data

Tom Fox

Instagram

Facebook

YouTube

Twitter

LinkedIn

Categories
Blog

The Continuous Improvement of Corporate Culture

Welcome to a special five-part blog series on building a stronger culture of compliance, sponsored by Diligent. Over this series I have visited with Yvette Hollingsworth-Clark, Viktor Cuijak, Jessica Czeczuga; Michael Parker; and today it is Alexander Cotoia. In this series, we considered what is culture, how to assess culture, putting together a strategy to manage culture based upon this assessment, the monitoring of that strategy going forward. We conclude on how to use this information from your monitoring to engage in continuous improvement of your culture.

Many compliance professionals struggle with the ‘softness’ of culture. However, properly viewed culture can be seen as another type of risk for any organization. Viewed through this lens, culture can then be assessed, managed, monitored and improved as any other business risk. This has become even more important since the announcement in October 2021 by Deputy Attorney General Lisa Monaco, that the Department of Justice would assess corporate culture as a part of corporate compliance enforcement action. In this concluding Part 5, we consider how to continuously improve your compliance program with Alexander Cotoia, from the Volkov Law Group.

Alexander Cotoia, a regulatory compliance manager at the Volkov Law Group, has a rich background in commercial litigation and has spent a significant part of his career as a paralegal before transitioning to an in-house role at Virgin Galactic. Cotoia emphasizes the importance of compliance culture in organizations, believing that a culture promoting compliant behavior reduces the likelihood of ethical lapses or legal violations. He argues that creating a culture of compliance is not only ethically sound but also makes good business sense in today’s era where consumers are well-informed, and employees prioritize alignment with organizational values. Cotoia suggests that organizations should reinforce their values and highlight the economic benefits of compliance to gain buy-in and engagement from employees, while also emphasizing the need for continuous improvement, conducting root cause analysis, and involving various stakeholders to address cultural issues effectively.

At its core, compliance culture is about promoting and encouraging behavior that aligns with ethical and legal standards. It goes beyond simply following rules and regulations; it involves fostering an environment where employees understand the importance of compliance and are committed to upholding it. As Cotoia emphasized, creating a culture of compliance makes good business sense in today’s era, where consumers are more informed than ever before and a new generation of employees are demanding that organizations align with their values.

One key aspect highlighted in the podcast episode is the role of leadership, particularly the CEO, in driving and reinforcing a culture of compliance. Cotoia stressed the importance of CEOs being actively involved in the compliance process, emphasizing the organization’s values, and demonstrating how compliance contributes to the overall success of the organization. By doing so, CEOs can set the tone at the top and inspire employees to embrace compliance as an integral part of their work.

To establish and maintain a culture of compliance, organizations need to employ various tools and strategies. Cotoia discussed the importance of conducting root cause analysis, which involves identifying the underlying causes of non-compliance or ethical lapses. This analysis can be facilitated through anonymous surveys that measure employees’ perception of compliance within the organization and the extent to which compliance concerns are integrated into their daily work. By understanding the root causes, organizations can implement targeted remedial measures to address the identified issues.

Collaboration among stakeholders is also crucial in promoting a culture of compliance. Cotoia emphasized the need for involvement from various departments, such as the financial team, legal, and compliance officers, depending on the specific compliance challenges faced by the organization. By working together, these stakeholders can collectively solve problems and ensure that compliance is embedded throughout the organization.

Monitoring the effectiveness of remedial measures is another critical aspect of compliance culture. Organizations should regularly assess whether the implemented measures are achieving the desired outcomes. This can be done through continuous improvement efforts, such as periodic pulse checks and assessments of employee understanding and engagement with compliance initiatives. If the results indicate that the remedial efforts are not effective, organizations should be willing to revisit the root cause analysis and adjust their approach accordingly.

We also discussed the importance of ongoing communication and collaboration for continuous improvement and alignment with compliance standards. Organizations should foster an environment where employees feel comfortable reporting compliance concerns and where open dialogue is encouraged. This not only helps identify potential issues but also demonstrates the organization’s commitment to addressing them.

In conclusion, the importance of compliance culture in organizations cannot be overstated. It not only minimizes ethical and legal risks but also contributes to the overall success and reputation of the organization. By involving leadership, conducting root cause analysis, collaborating with stakeholders, monitoring effectiveness, and fostering ongoing communication, organizations can create and maintain a culture of compliance that aligns with best practices and meets the expectations of employees and consumers alike. As Alexander Cotoia aptly stated, “Creating a culture of compliance just makes good business sense.”

Tune into Alexander Cotoia on the Diligent podcast series Unlocking Success: The Crucial Role of Culture in a Best Practices Compliance Program.

Categories
Blog

Reprioritizing Your Third-Party Risk Management Program – Key 2022 FCPA Enforcement Actions

From the Foreign Corruption Practices Act (FCPA) enforcement actions in 2022, one clear theme emerges; that is, organizations must reprioritize their third-party risk management programs. Many companies are becoming complacent in this arena, not realizing the potential consequences of not properly assessing their third-party risk management practices. I recently had the opportunity to visit with Alexander Cotoia of the Volkov Law Group to discuss importance of reprioritizing third-party risk management and how organizations can assess the effectiveness of their current practices. We review three 2022 FCPA enforcement actions to explore the importance of proper third-party risk management and how to avoid the potential consequences of not properly assessing these risks. Join us as we explore the details and implications of these enforcement actions and how organizations can reprioritize their compliance programs for the ever-changing dynamics of third-party risk management.

Here are the steps you need to follow to reprioritize your third-party risk management program.:

  1. Understand that third-party risk, especially as it pertains to anti bribery and corruption concerns, is a universal constant and still the highest risk.
  2. Reassess the framework by which third parties are evaluated and objectively evaluate the totality of risks posed by a potential business partner to the organization.
  3. Implement a risk-based approach to third party risk management.
  1. Understanding third-party risk

Understanding that third party risk, especially as it pertains to anti-bribery and corruption, is a universal constant is an important step in the risk management process. As evidenced by three key enforcement actions, ABB Limited, Oracle and GOL Airlines, organizations must evaluate the risks posed by potential business partners and ensure that the information collected is adequate to objectively assess the totality of the risks. Organizations should be aware that the DOJ requires companies to adopt a risk-based approach to third party risk management. To ensure that the organization is compliant with these regulations, they should review their existing practices and be prepared to supplement them if necessary. Additionally, organizations should be aware that they may be given credit for voluntary disclosure and cooperation efforts when faced with potential violations. This may be beneficial when determining penalties and is an important factor to consider when dealing with third party risk.

  1. Reassess your third-party framework

Reassessing the framework by which third parties are evaluated and objectively evaluating the totality of risks posed by a potential business partner to the organization is a critical step in reprioritizing your third-party risk management strategy. This should be approached holistically, focusing on the information being collected and its adequacy in objectively evaluating risks. Organizations should adopt a risk-based approach, as recommended by the DOJ, and not simply have a one size fits all approach. This approach should include due diligence, assessing the potential partner’s reputation and business practices, verifying their legitimacy and background, and understanding their country of origin and its laws. Additionally, organizations should consider the potential partner’s relationship with government officials and whether it could violate any anti-bribery or corruption laws. If any of these issues are identified, organizations should look into it further to ensure that their partner is compliant. By doing this, organizations can ensure that they are not engaging in any activities that could be deemed illegal or unethical. 

  1. Implement a risk-based approach

Implementing a risk-based approach to third party risk management is essential to any organization’s compliance program. This involves assessing the external parties on which an organization relies operationally, and identifying any risks associated with those external parties. This assessment should include evaluating their qualifications and experience to ensure they are able to meet the organization’s expectations. Additionally, organizations should consider conducting background checks on potential external parties, and assessing any potential conflicts of interest that may arise. Once potential external parties have been identified, organizations should consider conducting due diligence to ensure that the external party has not been involved in any fraud, bribery, or other criminal activities. Organizations should also consider developing contracts and compliance policies for external parties and monitoring their activities to ensure compliance. Finally, organizations should consider developing a training program for their external parties to ensure they understand the organization’s expectations and policies. By implementing a risk-based approach to third party risk management, organizations can reduce the risk of an FCPA violation and ensure their organization remains compliant.

Third-party risk management one of the most critical components of any organization’s compliance program. Organizations should take the initiative to reprioritize third-party risk management and assess the effectiveness of their current practices. Through the exploration of three enforcement actions and the introduction of the joint compliance note, this article has highlighted the importance of properly assessing third-party risk and how to best prepare for the ever-changing dynamics of third-party risk management. By implementing a risk-based approach to third party risk management, organizations can protect themselves from potential violations of the FCPA and ensure their organization remains compliant. With the right tools, processes, and dedication you can achieve the same results and protect your organization from costly fines and penalties.

For more information, on Diligent’s Third-party Risk Management solution, click here.

Listen to Alexander Cotoia on the podcast series, sponsored by Diligent here.

Check out the Volkov Law Group here.