Investigations Quarterly, Issue 13


Published on

In this issue of IQ Magazine, the authors discuss the competing challenges organizations face in meeting their regulatory obligations while trying to manage profitable businesses. A common theme is repeated throughout all the articles – corporations need to remain vigilant in managing business risks and to reinforce an organizational culture of integrity, transparency, and accountability.

IQ’s featured articles are:

- All Eyes on the Independent Investigation
- Investigating Financial Statement Frauds: If You Think You’re Done Looking… Keep Looking
- “Walking a Beat” To Reduce Corruption: Rethinking Due Diligence in the Age of Anti-Corruption
- A Troubling Bank Balance– Competing Duties for Banks When Making Suspicious Activity Reports

Published in: Business
  • Be the first to comment

  • Be the first to like this

No Downloads
Total views
On SlideShare
From Embeds
Number of Embeds
Embeds 0
No embeds

No notes for slide

Investigations Quarterly, Issue 13

  1. 1. INVESTIGATIONS QUARTERLY 6 All Eyes on the Independent Investigation 3 If You Think You’re Done Looking…Keep Looking 9 “Walking a Beat” To Reduce Corruption 13 A Troubling Bank Balance 2012 » VOLUME 1 » ISSUE 13
  2. 2. Letter from the publishersINVESTIGATIONS QUARTERLY Jeff Green, Ellen Zimiles, PUBLISHERS Keeping a Razor Sharp Perspective on the Regulatory Landscape Jeff Green Anticorruption rules and regulations play a critical role in societies and countries around +1.202.973.2441 the globe. They help guide us in how we think and operate our businesses and conduct ourselves in a variety of business situations with vendors, business partners, customers, and Ellen Zimiles foreign officials, etc. They are designed to protect, but they also create significant financial +1.212.554.2602 and legal obligations for corporations who do business on a domestic and/or international scale. Rarely are rules and regulations repealed, and they only seem to get tougher over time. But in the grand scheme of things, regulatory enforcers challenge all of us to think and EDITORS innovate in new ways and to continue to strive toward conducting business more effectively Darcy Healy and efficiently. Jeffrey Locke In this issue of IQ Magazine, the authors discuss the competing challenges organizations face in meeting their regulatory obligations while trying to manage profitable businesses. A DESIGN common theme is repeated throughout all the articles – corporations need to remain vigilant Elliott Robinson in managing business risks and to reinforce an organizational culture of integrity, transpar- FEEDBACK AND INQUIRIES ency, and accountability. Investigations Quarterly welcomes all letters, In our cover story,“All Eyes on the Independent Investigation,” the authors discuss the comments and inquiries to the authors. Please competing challenges organizations face in effectively managing internal investigations. In- address all correspondence to: ternal investigations have far-reaching implications and the authors stress the importance of conducting investigations thoroughly while communicating with appropriate stakeholders in Darcy Healy (U.S.) order to ensure a well-run investigation. +1.202.973.3128 In “Investigating Financial Statement Frauds: If You Think You’re Done Looking… Keep Looking,” the authors uncover common elements that comprise a financial statement Howard Gendler (U.K.) fraud. It behooves company stakeholders to understand a fraudster’s motives and recognize +44.207.469.1120 the typical and atypical schemes they create in order to hide their crimes. The authors advise companies to conduct fraud investigations beyond the area where the fraud was directed John Flannery (Asia) (typically the inflation of net income). Recognizing where the gaps or weaknesses lie within +1.202.481.7305 the financial reporting process can go a long way in avoiding potential regulatory violations or having to reissue a financial statement. Unsolicited manuscripts on matters dealing with Preventing fraud doesn’t always begin with catching a thief or conducting a post review or fraud and investigations are welcome and will be investigation. In many cases, companies can save themselves a lot of grief and expense by considered for publication. conducting due diligence assessments before they enter into business relationships with em- ployees, business partners or vendors and other high-risk relationships. In many instances, Investigations Quarterly is published by Navigant. due diligence begins simply with building better communication channels with internal Copyright ©2012. clients and third parties.“Walking a Beat” To Reduce Corruption: Rethinking Due Dili- The opinions expressed here in are those of the gence in the Age of Anti-Corruption” offers readers a unique perspective on due diligence investigations and third party risk assessments and asks readers to rethink the role of com- authors and editors. munication in today’s global marketplace. Investigations Quarterly (IQ) is not published with the Regardless of how regulations are implemented around the globe, countries face similar intention of rendering legal, professional or account- challenges in meeting competing stakeholder expectations. In “A Troubling Bank Balance ing advice or services. – Competing Duties for Banks When Making Suspicious Activity Reports,” the authors The media are welcome to quote from the contents discuss balancing the expectations of customer instructions and meeting regulatory report- ing requirements with the UK’s Serious Organised Crime Agency (SOCA). The authors if properly attributed. Any substantial reproduction of remind us the delicate balance global institutions face in overseeing legal, regulatory and the content of Investigations Quarterly requires the financial obligations with multiple stakeholders. permission of the publishers and authors of the articles. We hope you find this issue of IQ Magazine to be informative and enlightening and Cover illustration by Josh Leipciger welcome your comments and questions.
  3. 3. 2012 » VOLUME 1 » ISSUE 13Eileen M. Felson, efelson@navigant.comNicole E. Wrigley, Esq., nwrigley@winston.comIf You Think You’re DoneLooking…Keep LookingInvestigating financial statement fraud»» Every fraud has to be hidden Illustration by Peter Giesbrecht somewhere on a company’s books. Most financial statement frauds start small but eventually grow in size, scope and duration.»» According to confessed fraudsters, committing the initial fraud is easy; the hard part is concealing and ending it.»» When performing a fraud investigation or a post-mortem on a financial statement fraud in a litigation context, it is important to focus on the area where the fraud was directed but also on seemingly unrelated areas.This article focuses on financial state-ment frauds used to manage or increaseearnings. These are frauds committed notfor financial personal gain (such as steal-ing cash) but for other incentives, suchas continued employment/advancement,fear of delivering bad news to investors oran intimidating supervisor, or a desire toincrease the value of performance-relatedbonuses. Most frauds, regardless of theirform, start small and inevitably grow. Inthe beginning, fraudsters typically be-lieve the fraud will be short lived or canbe reversed when “things turn around.”Yet, in most cases, neither the fraudsters’personal motivations nor the company’sfinancial results change or “turn around.”Often, future earnings expectations in-crease as a result of the false positive orinflated performance. The fraudsters arethen forced to continue and likely escalate ing or accounting, each fraudulent entry Every income statement fraud necessar-the fraud in order to avoid exposure. to revenue or expense needs an equal ily has an impact on the balance sheet. and opposite entry either somewhere A fundamental challenge for the fraud-How Earnings Fraud Results else on the income statement or on one ster is just where on the balance sheet toin Balance Sheet Fraud of the three parts of the balance sheet – assets, liabilities, or equity. For example, hide the fraud. This decision will have a trickle-down effect for periods to come.One of the primary goals of a financial if revenue is falsely inflated, the fraudster Income statement fraud eventually muststatement fraud is to make the compa- has four choices: 1) increase expenses; 2) be reversed out of earnings in some futureny’s earnings or net income appear better increase assets; 3) decrease liabilities; or period. Indeed, financial statement fraudthan reality. Since revenues - expenses 4) decrease equity. Increasing expenses is sometimes referred to as stealing from= net income, the fraudster must either is not an option, because that defeats the tomorrow to pay for today. Current earn-record fake revenue or artificially lower fraudsters’ purpose – to increase net in- ings are inflated at the price of having toexpenses to improve earnings on the in- come. The other side of the fraud has to take losses in the future. When inevitablycome statement. However, because of the be concealed in assets, liabilities, or equity “things don’t turn around,” the fraud mustbasic concept of double-entry bookkeep- on the balance sheet. remain hidden on the balance sheet in 3
  4. 4. INVESTIGATIONS QUARTERLY order to postpone tomorrow, avoid detec- the fraudster inflates revenue, the fraud- accounting manager used inventory-in- tion, or risk reporting even lower earnings ster needs to understate liabilities. transit and accounts payable accounts on in a later period. the balance sheet to offset fraudulent rev- As shown in the chart below, whatev- enue he had put on the income statement. Why the Hiding Place of er balance sheet account the fraudster chooses as the hiding place for the fraud Like most fraudsters, the manager believed Balance Sheet Fraud Matters presents various challenges and risks of that he would be able to reverse the bal- ance sheet fraud in the next period when detection. Consider the asset side of the balance results improved. Of course, results did not sheet. Fake assets cannot live forever. A The fraudster’s choice of hiding place may improve, the manager continued to inflate fake asset today means booking expenses necessarily lead to the next challenge of revenues, and the fraud grew. such as depreciation, amortization, im- expanding the fraud and involving an ad- Since he had limited balance sheet ac- pairment charges, or write-offs tomorrow. ditional person or persons, i.e., collusion. counts within his purview in which to hide This poses the following challenge to the Collusion can make a fraud much more the fraud, the manager continued to use fraudster going forward: because the fake difficult to detect while it is occurring be- the same balance sheet scheme. Eventu- assets are only temporary and result in cause the fraudsters can circumvent the ally, however, the corporate accounting future hits to earnings, the fraudster must company’s internal controls. In theory, a department questioned why: 1) an inven- continue to record fraud to offset the lone fraudster will eventually be discovered tory-in-transit account had an old balance eventual income statement drain. by a properly designed system of internal that did not go away – by definition, goods controls including strong segregation of Consider the liability side of the balance in transit in one period should have arrived duties (i.e., the separation of key respon- sheet. In general, hiding fraud in liability by the following period; and 2) an accounts sibilities for the company’s books and re- accounts can be more difficult. As dis- payable account had a negative balance – cords among various employees). As a re- cussed above, hiding fraud in a liability the opposite of its natural balance, indicat- sult, in order to avoid detection, fraudsters account requires the fraudster to lower ing the division was actually owed money often need to recruit accomplices to assist the balance. Fraudulent entries to liability by its vendors. There was no legitimate with their scheme. accounts are the opposite of the normal explanation, and the fraud was uncovered direction; they are the “wrong sign.”When Consider the following real-life scenario because of the company’s existing moni- revenue increases (or expenses decrease), in which internal controls played a role toring controls. The discovery of the fraud a liability account decreases. As a result, if in detecting a fraud. A midlevel divisional could have played out much differently if collusion had played a role. Account Potential Risk How a Collusive Fraud Cash May be discovered when book balance is compared to bank balance Scheme Can Escalate Needs to be converted to cash within a reasonable timeframe or written Accounts Receivable Collusion can and does occur at even the off; creates need to falsify detailed customer receivable listing most respected companies; someone will Prepaid Expense Needs to be expensed over a pre-set time period, usually within a year be willing to either participate or over- look a perceived error, mistake or even an Subject to physical count and needs to be turned over (sold) within the Inventory obvious fraud. In contrast to the exam- company’s normal sales cycle or written off ple above, in a collusive fraud, fraudsters Subject to depreciation over the life of the asset and/or impairment work together to manipulate the balance Fixed Assets charges if not supported by the company’s cash flows sheet and to actually launder the fraud through various accounts. The origina- Subject to amortization over the life of the asset and/or impairment Intangible Assets tors or ringleaders of the fraud are usually charges if not supported by the company’s cash flows those: 1) most knowledgeable about the Usually wholly subject to computer-generated rather than manual en- company’s actual results; 2) with the most Accounts Payable tries; creates need to falsify detailed vendor payable listing authority; and 3) in the best position to circumvent internal controls. They typi- Accrued Expenses May be discovered if over-used and account balance is the “wrong sign” cally have key responsibilities for com- Requires detailed footnote disclosures and is generally verifiable with ponents of financial reporting and have Long-Term Debt 4 financial institutions financial and accounting backgrounds.
  5. 5. 2012 » VOLUME 1 » ISSUE 13They know which parts of the balance Perhaps the most unpredictable escala-sheet have been infected and can deflect tion of this particular scheme was thatinquiries for each other. Nevertheless, the fraudsters actually paid property taxesbecause there can be unintended conse- on the fake fixed assets. Consider somequences on the financial statements as a of the after-effects of that decision alone,fraud escalates, the fraud schemes may which:need to become increasingly complex and »» required using cash from therequire the involvement of still others. company’s true operations toConsider the following example where essentially “fund” the fraud;the fraudsters decide to bury the fraud in »» expanded the reach of the fraud bythe fixed assets account on the balance requiring the filing of fraudulent taxsheet. They need to figure out means of returns in numerous jurisdictions;dealing with various unforeseen conse- »» increased the drain on the incomequences, such as: statement by increasing property tax1. Is depreciation expense reasonable expense; in comparison to the balance in fixed »» involved recruiting members of the tax assets? department into the fraud, either as2. Is the increase in fixed assets in line active or unknowing participants; and goal of the fraud was typical: the artificial with the growth of the company – »» required lying to field personnel about inflation of net income by recording fake the number of physical locations, unexpected increases in property tax revenue. But, it is significant that burying employees, customers, etc.? expense. the impact of the income statement fraud3. Do the company’s forecasted cash in fixed assets on the balance sheet and The fraudsters in this example went to flows support the level of fixed assets – the later follow-on schemes (depreciating great lengths to hide the fixed asset fraud can an impairment charge be avoided? fake assets, paying property taxes on fake on the balance sheet. Their schemes were4. Do the fraudulent increases assets, creating false documents, and re- successful for a time, because their meth- in earnings and assets cause cruiting others into the fraud) – had noth- ods were both counterintuitive and in- unreasonable changes in period- ing to do with the primary fraud scheme. volved substantial collusion to perpetrate over-period comparisons of common and conceal the fraud. The ringleaders of Forensic investigators cannot assume financial ratios? the fraud eventually recruited employees that, if fraud is found in one place or if a5. Are the fake fixed assets subject to in the fixed asset department to: 1) enter whistleblower raises one issue, the whole property taxes? false fixed assets into the books and re- fraud scheme has been revealed. Other cords; 2) prepare false invoices to support parts of the fraud may have been con-Each one of these questions presents a the false fixed assets when questioned; 3) cealed in completely unrelated balanceunique challenge to the fraudsters. Yet, use special codes and names when refer- sheet accounts. These hiding places mayfraudsters have gone and will continue ring to the fake assets; 4) create a software have caused both unintended and unpre-to go to extraordinary lengths to sustain program to exclude the fake assets when dictable impacts on the company’s finan-their fraud schemes and to overcome the printing reports; and 5) lie to others who cial statements. Sophisticated fraudstersunfavorable after-effects. were not part of the scheme. use complex schemes to respond to theseFor example, the authors investigated a impacts. What may appear at first blushmatter where fake assets were put onto When is a Fraud to be a simple income statement schemethe books to offset fake revenue. Withregards to Question 1 above, the fraud- Investigation Complete could have unexpected results. A com- prehensive forensic investigation shouldsters found what seemed to be a simple A logical start-off point in conducting a therefore analyze not only the predictablesolution: depreciate the fake fixed assets. forensic investigation of how a fraud was accounts but also the seemingly unrelat-However, that apparent solution created committed includes a detailed review of ed accounts that may have been infectedthe need to record more fraud in future revenue and expense account activity. In by the fraudsters’ various concealmentperiods to offset the additional expense. the example discussed above, the primary schemes. 5
  6. 6. Rick Ostiller, John C. Tang, Esq., All Eyes on theINVESTIGATIONS QUARTERLY Independent Investigation Effectively managing an independent investigation Factors To Consider When Determining Whether To Perform an Independent Investigation Depending upon the circumstances, man- agement may advocate conducting an “inter- nal” investigation by itself, rather than hav- ing the Board’s independent directors and outside advisors perform an “independent” investigation. Understandable concerns about cost containment often influence management’s desire to conduct an internal investigation. However, while an indepen- dent investigation may involve more time and expense, it undoubtedly carries signifi- cantly greater weight in the eyes of courts, regulators, auditors, and other interested third parties, such as the press, who may lat- er judge the investigation with the benefit of hindsight. Consistent with the value placed on independent investigations, the Sarbanes Illustration by Josh Leipciger Oxley Act of 2002 contains provisions per- mitting (although not requiring) companies »» The credibility of the investigation is of derscored the need for companies to have to empower the audit committee and other paramount importance. a plan in place to investigate and resolve independent Board committees to retain issues promptly and effectively should prob- independent counsel and other advisors. »» Accuracy, efficiency, proportionality, sound processes and judgment, active lems arise. Who conducts the investigation can make a committee and Board involvement, and When circumstances dictate that a company significant difference to regulators or other responsiveness to the company’s various conduct a probe independently of man- interested third parties. For example, in constituencies are all characteristics of a agement, the Board of Directors or a Board exercising their charging discretion, both well-run investigation. committee typically takes responsibility for the SEC and the DOJ give strong consid- »» The minimum investigation necessary managing the investigation with the assis- eration to the company’s investigation. A to satisfy the business judgment rule tance of outside advisors. Since an investi- reliable and properly conducted investiga- in a court of law may not be enough to gation can have far-reaching implications tion that is shared with the government can satisfy the court of public opinion or for an organization, the company’s directors lead not only to reduced charges but even to other interested third-party constituents have an obligation to manage the project no charges being filed at all.1 However, the such as the Securities and Exchange effectively, balancing often-competing con- government can be a skeptical consumer. Commission (SEC), US Department of siderations in the best interests of the com- If it perceives an investigation is insuffi- Justice (DOJ), and the company’s outside pany’s stakeholders. ciently independent because the person(s) auditors. conducting it is(are) deemed too familiar or This article discusses several topics related too aligned with the potential subjects of the The financial crisis that started in late 2008 to investigations, namely: 1) the factors a investigation, the investigators’ work may has led to a heightened focus on corpo- company should consider when determin- not receive the full benefits that would oth- rate governance and financial transparency, ing whether to perform an independent erwise accrue to an independent investiga- including the passage of the Dodd-Frank investigation; 2) the initial steps a Board of tion. Similarly, while an investigation may Act in 2010 and the implementation by the Directors should take when an issue arises provide the basis for a motion to dismiss a SEC of its whistleblower award program in that merits an independent investigation; shareholder derivative lawsuit in its prelimi- 2011, not to mention corresponding litiga- 3) keys to a well-run investigation; 4) com- nary stages, the independence of the investi- tion and criminal prosecution activity. These mon investigative challenges; and 5) re- gators is a key factor in the court’s consider- and other related developments have un- porting considerations. 6 1. S.E.C. Enforcement Manual § 6.1.2; U.S. Attorney’s Manual § 9-28.720.
  7. 7. 2012 » VOLUME 1 » ISSUE 13ation of whether to defer to the findings of pendent investigation. Alternatively, the sider the company’s business, legal, reputa-the company’s investigation.2 company’s audit committee may lead the tional, and other interests surrounding the investigation (provided its members are not matters under investigation.The company’s outside auditors, who gen- associated with the people, companies, anderally work in parallel with the company’s To the extent that the Board does delegate issues that prompted the investigation).investigators, may also take a dim view of the investigation process to a committeean investigation that isn’t sufficiently inde- If the Board decides to form a special com- or rely on the work of internal or externalpendent. Maintaining the confidence of the mittee, the Board should establish a char- personnel, it is important to remember thatoutside auditors is obviously a critical objec- ter or resolutions that clearly delineate the in the end it is the Board’s investigation,tive. Often, the audit firm will have its own committee’s charge and authority. Among and the Board is the ultimate fact finder andforensic accountants conduct a “shadow” the matters that the charter or resolutions decisionmaker (bearing in mind that, as cir-investigation that is intended to monitor the should specifically address are the commit- cumstances warrant, a Board may decide towork of the company’s investigators. The tee’s authority to retain outside advisors, empower a committee with the Board’s de-primary goal of the shadow investigation is incur costs, gain access to company informa- cisionmaking authority).to ensure that the scope and process of the tion and personnel, and whether the com- It is certainly appropriate for the directors toindependent investigation is adequate and mittee is empowered with the full decision- utilize and rely upon the help of others (suchsufficiently robust to allow the auditors to making authority of the Board, or rather is as outside advisors) in the investigation pro-rely on the findings. empowered to recommend a course of ac- cess. It is not expected or legally required tion to the Board based upon the investiga-In summary, the credibility of the investiga- that individual directors or committee mem- tion’s findings and conclusions.tion is of paramount importance. While an bers personally conduct the investigationindependent investigation can be more cost- The committee should promptly check that without assistance. But, by the same token,ly than a management-led process, it has the appropriate persons have been directed the directors cannot discharge their fiduciarygreater impact, and if handled appropriately to preserve relevant documents and in- duties by “over-delegating” their responsi-can be managed to keep costs under control. formation, and the committee should also bilities to the point of abdicating them. It is evaluate the need to engage outside advisors important to strike the right balance.Initial Steps a to assist with the investigation. In addition, The Board, through its committee, should the committee should communicate withBoard Should Take the company’s outside auditors and work stay informed and remain actively involved throughout the investigation, by monitor-If the Board decides to undertake an inde- with the appropriate resources within the ing, overseeing, and directing the course ofpendent investigation, it often will form a company (for example, the investor relations the work. Examples of oversight and direc-special committee of independent (i.e., non- department) to plan for external communi- tion include: meeting regularly with andemployee) directors to manage and oversee cations regarding the investigation and the obtaining regular reports from the outsidethe investigation. For the reasons discussed matters that prompted it. The recipients of advisors; providing feedback on the inves-above, it is essential that the members of such external communications will depend tigation; challenging the committee’s advi-the committee be disinterested and inde- upon the circumstances, but often will in- sors by raising questions and participatingpendent of any of the people, companies, clude various regulators (SEC, DOJ, Finan- in decisionmaking; in certain circumstances,and issues that could be the subject of the cial Industry Regulatory Authority (FINRA), reviewing key documents and interviewinvestigation. Although some types of con- listing agencies, etc.), investors (individuals summaries prepared by the investigators;nections between members of the commit- and institutional holders), market analysts, and formally making final findings of facttee and the subject(s) of the investigation the press, and other interested third parties. and decisions about any disciplinary actions,(for example, common membership in atrade organization or social club) may not be Keys to a Well-Run reporting, process remediation, or other measures arising from the investigation.legally disabling, the Board should identifyand objectively consider all connections, Investigation At a minimum, the investigation must behowever modest, at the time the special Accuracy, efficiency, proportionality, sound sufficiently thorough to satisfy the directors’committee is formed. processes and judgment, active committee fiduciary duty to ensure that the Board ad- and Board involvement, and responsiveness equately investigates problematic issues thatIndeed, it is not unusual for a Board to ap- come to the Board’s attention, and to make to the company’s various constituencies arepoint additional directors with no prior con- any remedial or process and control adjust- all characteristics of a well-run investigation.nection to the company, primarily for the ments based upon the results of the investi- In addition to their fact-finding mission, thepurpose of constituting the special com- gation.3 In this regard, the typical evaluation committee and its advisors must also con-mittee charged with conducting the inde- standard for the committee’s investigation,2. Zapata Corp. v. Maldonado, 430 A.2d 779 (Del. 1981).3. In re Caremark Int’l Inc. Derivative Litig., 698 A.2d 959 (Del. Ch. 1996). 7
  8. 8. INVESTIGATIONS QUARTERLY whether carried out using internal resources Common Investigative (such as those in China) or prohibitions on or independent outside personnel, is the business judgment standard, which gives Challenges “US-style” discovery may pose a significant obstacle to gaining access (let alone timely significant deference to a Board’s considered Numerous challenges are bound to arise access) to necessary information. A number judgment regarding the cost and scope of during the course of every investigation, of jurisdictions outside the United States the investigation, as long as that decision is no matter how well managed. One com- also have expansive privacy statutes and made in good faith and on an informed and mon investigative challenge is balancing the data security laws that may limit the ability disinterested basis. It is important to bear in company’s attorney-client privilege against of a company’s investigators to take docu- mind, however, that the minimum inves- responding to appropriate information re- ments and other information (including, tigation necessary to satisfy the business quests from important third parties (such as for example, information obtained during judgment rule in a court of law, may not be regulators, auditors, and courts) about the interviews) out of that country – sometimes enough to satisfy the court of public opin- investigation. Government regulators are upon pain of criminal penalties. Therefore, ion, or other interested third-party constit- generally prohibited from asking for privi- it is essential to understand in advance and uents such as the SEC, DOJ, and the compa- leged material and basing their charging de- plan for the requirements and restrictions of ny’s outside auditors. cisions on whether the company will waive non-US jurisdictions. work product and the attorney-client privi- The investigative team should establish a work plan and be prepared to adjust it as the lege as part of its cooperation, although they Reporting Considerations facts emerge and circumstances change. It is will expect the company to provide “factual With respect to reporting on the investiga- important for the committee and its advisors information.”4 This balance is often achieved tion, certainly the company must provide to be disciplined and thorough in identifying by providing high-level status reports that sufficient information about the investiga- areas of inquiry and designing and carry- convey the progress or results of the inves- tion to meet applicable public reporting ob- ing out the appropriate investigative steps. tigation without disclosing privileged details. ligations. Beyond that, the company should In addition, the team should remain flexible Another common challenge is for the com- consider the implications of disclosure about and willing to follow the investigation into mittee to conduct its investigation while the the investigation on potential shareholder additional areas as it learns information. At company preserves its position with respect or derivative litigation and regulatory ac- the same time, the committee should main- to threatened or pending litigation stem- tion. Two of the most important reporting tain its focus on the core investigation issues, ming from the matters under investigation. considerations are the report’s format (oral and avoid unnecessary and expensive “scope In addition to allocating limited resources vs. written, detailed vs. summary, exhibits vs. creep.” Therefore, the investigative team and managing the company’s ongoing re- no exhibits, etc.) and the intended audience. should carefully consider significant scope sponsibilities to its personnel, customers, Regulator and external auditor expectations, changes, and obtain Board or committee ap- and shareholders, the Board needs to remain as well as the scope and nature of the find- proval (as the case may be) before imple- attentive to coordinating the (at times con- ings (among other considerations), will all menting them. If unrelated allegations arise flicting) demands and strategies on both the affect those decisions. The range of potential during the investigation, the committee may litigation and non-litigation fronts. When outcomes from an investigation will vary responsibly determine to refer those matters and what steps are taken – or not taken – in depending on the circumstances, but typical to other constituencies within the company one arena can have an unintended collateral potential outcomes include: (including management and the legal de- impact on the other. partment) for appropriate consideration. »» financial reporting restatements; Yet another common challenge lies in the »» corporate governance changes and In addition to interviews of relevant per- fact that the Board committee and its ad- internal controls enhancements; sonnel, the team should preserve, collect, visors conducting the investigation lack and review relevant documents (includ- »» remedial actions, including termination/ subpoena power. This circumstance can ing electronic data) and perform financial reassignment of and pursuing financial significantly hinder the investigators’ ability or accounting analyses as needed. It is also reimbursement from wrongdoers; to obtain cooperation and information from very important to meet regularly with the important third parties. An additional chal- »» regulator attention and monitoring; and company’s outside auditors, who (as noted lenge for investigations that involve obtain- »» shareholder litigation. above) will ultimately need to concur with ing information from third parties outside the scope and process of the investigation, the United States is the need to navigate the After the investigation, directors should fol- particularly if it relates to internal controls applicable laws and practices in the local low up to ensure that recommended actions over financial reporting or results in a finan- jurisdiction. For example, state secrecy laws are implemented. cial restatement. 8 4. S.E.C. Enforcement Manual § 4.3; U.S. Attorney’s Manual, § 9.28.720.
  9. 9. 2012 » VOLUME 1 » ISSUE 13Scott Moritz,“Walking a Beat” To Reduce CorruptionRethinking due diligence in the age of anti-corruption Illustration by Peter Giesbrecht»» Performing traditional due diligence investigations of thousands of third parties is cost-prohibitive and inefficient.»» Alternative approaches to managing third-party risk utilize risk-scoring criteria in conjunction with list matching.»» In order for anti-corruption programs to be truly effective, they must create communication channels between compliance, its internal clients within the organization and third parties.Due diligence investigations have longbeen an invaluable tool used to assistcompanies and their counsel in evaluatingthe risks posed by prospective commer-cial relationships with third-party busi-ness partners, customers, suppliers andother potentially high-risk relationships.The traditional approach to due diligencefor many years has consisted of the per-formance of field investigations utilizingin-country investigators and human intel-ligence resources. While still a very viableand important investigative approachunder certain scenarios, global companieshave had to rethink this approach whenseeking to address the potential risks thatlarge numbers of third parties with whomthey do business may represent. Much ofthis rethinking is simply economic real-ity. Performing traditional due diligenceinvestigations of thousands of third par-ties across the globe is cost-prohibitiveand can be grossly inefficient. By apply-ing more moderate depth investigationsacross a large population and couplingthem with productive, two-way commu-nication with third parties, leading com-panies have been tremendously successful Risk-Appropriate Due party risk. Some companies focus most of their energy and resources on particu-in mitigating their overall corruption risk. Diligence When Dealing larly high-risk relationships such as salesDiscussed below are the various ways with Large Numbers of agents, distributors and freight forward- ers. Others bifurcate their third-partycompanies have sought to narrow theirfocus on high-risk relationships and Third Parties populations in an effort to distinguish upstream suppliers and vendors who doimplement effective, two-way communi- Increasingly, global companies are em- not act on behalf of the company fromcations between them and their high-risk bracing alternative approaches when commercial entities who represent thethird parties. considering how to manage their third- 9
  10. 10. INVESTIGATIONS QUARTERLY company in some way and may act as in- its third parties. Indeed, another way that such as those outlawing aggressive pan- termediary on behalf of the company in companies are rethinking due diligence handling and other petty crimes, it sent dealings with other companies, govern- relates to how they engage directly with a signal that people do care. This same ment agencies or state-owned companies. their third parties in the furtherance of concept can be applied to anti-corruption. the due diligence and compliance pro- Indeed, where community policing and Still others focus on their third-party pop- cesses. In the past, a company sought to anti-corruption converge relates to one ulations more broadly utilizing sophisti- perform due diligence with a certain de- of the major underpinnings of how the cated risk-scoring criteria in conjunction gree of reticence to keep the third party NYPD successfully applied the broken with performing automated comparisons they were investigating from finding out. windows theory to reduce crime. In an of their third-party data to a wide array It was almost as if the company was doing effort to build trust between the police of- of watchlists. This risk scoring and list something wrong or delivering a message ficers that enforce the law in high-crime matching are both a form of background to the third party that the company dis- neighborhoods and the residents and screening and a means of narrowing focus trusted them. business owners in those communities, to only those third parties that represent the NYPD reverted back to the early days a disproportionately high degree of risk While this mindset regarding due dili- of their existence and reinstituted foot pa- relative to the total population of third gence investigations still exists to a de- trols. By taking police officers out of their parties. Under this scenario, they then uti- gree, it is giving way to a growing corpo- patrol cars and significantly increasing lize a form of due diligence that is based rate culture of mutual transparency that the numbers of uniform officers “walking upon open source, publicly available in- is having a very positive effect on overall a beat,” they took the first very important formation and subscription database re- awareness regarding anti-corruption. This step to signal to the community that they search to further winnow the population. new archetype is similar to the concept cared. This very successful practice built Companies who have implemented this of community policing that has been personal relationships between commu- approach “clear” large numbers of their used to reduce crime in many major cities nity police officers and the residents and third parties utilizing moderate depth across the world. Innovated by the New business owners comprising the com- investigations thereby enabling them to York City Police Department (NYPD), the munities they were policing. Over time, significantly limit their spend by focusing concept of community policing is based the police officers, residents and business on those remaining entities for which ei- upon the “broken windows theory” that owners began to get to know and trust ther significant issues have been raised or leaving broken windows unrepaired in a one another. Once trust is established, insufficient information has been found high-crime neighborhood is a signal that people exchange information more read- preventing informed decisions. no one cares and leads to more vandalism ily and begin to understand one another’s and crime. No matter which of these options a com- perspective. pany applies, in order for their efforts to This can easily be related to a company’s be truly effective, these investigative due “community” of third parties. If a third Cultural Change Starts diligence and compliance techniques must be coupled with an effective com- party perceives that a company “doesn’t care”, they may take this as a signal that with Communication munication strategy across the company they can conduct business unethically Compliance at its most elemental starts and out to the third parties themselves. without fear of reprisal. When the NYPD when people understand their obligations That communication strategy centers on began enforcing quality of life, crimes under the compliance program and do providing a framework for two-way com- munication between the company and its third parties. Engage Directly with Third Parties To Build Trust As important as applying due diligence economically is the notion that success- ful third-party anti-corruption programs depend upon effective two-way com- munication between the company and 10
  11. 11. 2012 » VOLUME 1 » ISSUE 13what is required out of a sense of obliga-tion. Indeed, many compliance programsare aimed at this minimum standard.However, meeting this minimum stan-dard is not likely to create cultural changeand successful anti-corruption programsneed to strive to affect cultural changeacross their companies and out to thethird parties with and through whomthey do business. In order for an anti-corruption program to be truly effective,it must create communication channelsbetween compliance, its internal clientswithin the organization and the third par-ties whose actions could lead to corrup-tion liability. This communication starts people to share sensitive information there are put to rest at the outset therebywith sensitizing the organization’s key about themselves, their colleagues and eliminating any future barriers to the re-employees whose responsibilities include business can be uncomfortable and cause lationship between the parties. Spendingengagement with third parties to the po- the recipient of the questionnaire to recoil a fair amount of time setting the tone willtential risks of these commercial relation- and to feel as if they are being unfairly provide a solid foundation for the rela-ships, how to recognize them, what they subjected to what they consider to be an tionship going forward.may mean in terms of their continuing invasive process. That is why it is so im- Those initial conversations will inevitablycompliance obligations and how to con- portant to designate a business sponsor to be followed by many others wherein thevey this information to the third parties in serve as your company’s ambassador for parties continue to exchange information,a way that is not construed to be offen- each third party with which you do busi- build trust and foster understanding ofsive in any way. This last part is easier said ness. It then becomes the business spon- one another’s perspectives.than done. sor’s responsibility to explain the compa-A Questionnaire Is Not ny’s third-party anti-corruption program, the rationale behind it, to emphasize the Business Sponsors Act asSupposed To Be a mutual benefits of the relationship and Your Cops on a Beat to serve as the company liaison goingWarning Shot forward. That initial conversation should Community policing fosters positive, two- way communication between members also highlight the fact that the vast major-Use of questionnaires is a highly effective of the community and the police officers ity of such steps result in a strengtheningway to collect information from prospec- that are imbedded in that community to of the relationship between the companytive or existing third-party business part- protect them from harm. By designating and its third parties. During this initialners. How that questionnaire is distribut- business sponsors as part of your overall conversation, it is important to stress thated and the communications that precede third-party anti-corruption program, you this program is similar to those in placeits transmittal will set the tone for all are effectively taking the police officers at an increased number of organizationsfuture communications between the par- out of their patrol cars and having them and it would be reasonable to expect itties. If the first time the third party learns “walk a beat” among your community to be part of the process whenever theirabout your third-party anti-corruption of third parties. Much like patrol officers company engages with a global company.program is when a questionnaire arrives who spend many years in a community It is of critical importance to emphasizein their inbox, you have missed an op- building relationships and trust in the that asking them to complete a question-portunity to begin the process of building community, your business sponsors are naire is not in any way an indication thattrust and you may have set the relation- on the front lines of your anti-corruption they are not trusted – quite the contrary. Itship back by putting the third party on the program building long-term relationships actually signals the importance of the re-defensive if the questionnaire is construed that are critically important components lationship and the company’s willingnessas a warning shot fired by the company. of your anti-corruption program and your to make a substantial investment in it toUnder the best of circumstances, asking commercial success as a whole. ensure that any issues that may be out 11
  12. 12. INVESTIGATIONS QUARTERLY FCPA Compliance Programs • Best Practices On December 19, 1977, four years after Watergate first foreign business officials as well as facilitating payments. Training exposed corporate corruption, President Jimmy Carter signed and education must be provided at all levels – from the Board the Foreign Corrupt Practices Act into law. This statute’s anti- down to the third-party intermediaries such as consultants, agents, bribery provision makes it unlawful for a U.S. person and foreign vendors, suppliers, distributors, and joint-venture partners so that issuers of securities to make corrupt payment to a foreign official everyone understands what constitutes FCPA violations. for the purpose of obtaining or retaining business for or with, Since 2005, the Department of Justice has been brought or directing business to any person. This law also mandates more prosecutions than in the almost thirty years between the publicly traded companies to maintain records that accurately enactment of FCPA in 1977 and 2005. On January 26, 2011, and fairly represent the company’s transactions. Additionally, it Assistant Attorney General Larry Breuer stated, “In the Criminal requires these companies to have an adequate system of internal Division, we have dramatically increased our enforcement of accounting controls. the Foreign Corrupt Practices Act in recent years. That statute, In November 1991, Congress enacted the Federal Sentencing which was once seen as slumbering, is now very much alive and Guidelines to prevent and detect organizational wrongdoing. well. In fact, over the last two years, we have charged more than These guidelines articulate the elements of an organization’s 50 individuals with FCPA-related offenses and collected nearly compliance program that are required to receive consideration $2 billion in FCPA-related fines and penalties – by far the most for eligibility for a reduced sentence if convicted of a crime. people charged and penalties imposed in any similar period.” The Federal Sentencing Guidelines require organizations Global organizations are currently seeking guidance regarding to create standards to reflect government regulations and what constitutes a “Best Practices” FCPA program. Chief industry standards that apply to most organizations. In essence, compliance officers and general counsels have discovered that compliance programs, when “effective,” identify and define legal each resolved FCPA settlement agreement imposed in the last and ethical behavior, establish controls to alert management several years contained compliance requirements that represent of potential illegal activity and significantly improve the overall what constitutes a Best Practice FCPA Compliance Program. performance of an organization. The Department of Justice advised that the suggestions contained The United States Sentencing Commission amended its existing in each FCPA settlement agreement should be incorporated into guidelines in 2004. These amended guidelines clearly expressed an organization’s compliance program. the expectations that senior level executives of organizations should be directly involved in overseeing its compliance It is important to keep in mind that the purpose of designing and program, and that they would create an organizational culture implementing an “effective” FCPA Compliance Program is not that is compliant with the law. The Foreign Corrupt Practices Act to pacify the regulators. It is one of the most critical ways for (“FCPA”) presents additional standards that must be considered your organization to promote the values of your organization when designing and implementing compliance programs. Global and operational excellence. Your compliance program must be a organizations must now develop a program that effectively significant part of the overall business strategy and permeate the addresses laws and regulations in multiple jurisdictions as well as entire organization. industry standards. Compliance officers at global organizations To view a list of key best practices for FCPA compliance programs, are now, more than ever before, accentuating the need to review please visit and monitor existing standards and educating employees to Questions or comments to the author can be directed to create a culture internally that is ethical and corruption free, and which will include reviews of all entertainment and meals for 12
  13. 13. 2012 » VOLUME 1 » ISSUE 13Peter Burrell, pburrell@willkie.comRita Mitchell, rmitchell@willkie.comDavid Savell, dsavell@willkie.comA Troubling Bank BalanceCompeting duties for banks when making suspiciousactivity reports»» UK financial institutions are obligated Shah v HSBC3 to report suspected anti-money The courts have demonstrated a willing- laundering activity to the UK’s Serious ness to protect banks from civil actions, Organised Crime Agency (“SOCA”). which allege violations of the duty of»» UK courts have demonstrated a confidentiality and duty of care, by relying willingness to protect financial on the criminal sanctions that banks face institutions from civil liability resulting if they do not comply with the regime, from a breach of contract. specifically highlighting the low level of Illustration by Peter Giesbrecht»» UK financial institutions can protect suspicion that is required before a Suspi- themselves from potential civil liability cious Activity Report (“SAR”) to SOCA if they maintain detailed records must be made. ascertain the reasons for the making supporting their report to SOCA. of a SAR. Last year, HSBC (“the bank”) was suc-Unlike in the US and other jurisdictions, cessful in obtaining summary judgment The trial concluded in February 2012 fol-UK financial institutions and other firms on a claim brought by one of its custom- lowing evidence from the bank’s Moneyin the UK regulated sector not only have ers, Mr. Shah, and his wife. In summary, Laundering Reporting Officer (“MLRO”),to report suspicions of money launder- Mr. Shah sought damages for breaches of its Nominated Officer (“NO”), who wasing (including suspicions about their own duty and failure to follow his instructions also the head of the money launderingclients) but they must also seek con- to process transactions while requests for reporting office, and, separately, a formersent from the authorities to carry out any consent under the POCA were pend- officer of the Metropolitan Police.transactions that relate to the proceeds of ing with the SOCA. On 4 February 2010, Banks frequently rely on “tipping off” is-the crime. Until a reporting firm receives however, the Court of Appeal allowed in sues to avoid informing a customer ofactual or deemed consent under the legis- part Mr. Shah’s appeal against summary what is happening on a frozen account.lation, it is not in a position to carry out a judgment. The key points from the judg- In other circumstances banks wish tocustomer’s instructions without the risk of ments prior to trial can be summarised as explain why an account is frozen but arecommitting a criminal offence. follows: fearful that such an explanation couldThe criminal consequences of a failure to »» The test for “suspicion” remains of low give rise to a tipping off offence. The for-report and obtain consent, and the low threshold and is subjective.4 mer officer of the Metropolitan Police wassubjective threshold of suspicion required »» Where a firm relies upon having asked, during the hearing, to considerto trigger a disclosure,1 under the Pro- made a SAR and awaits consent from thirteen circumstances in which disclo-ceeds of Crime Act 2002 (“POCA”), have SOCA in defence of a damages claim sure of information to a client would notinevitably led to increased reporting by for breach of duty to a customer, the amount to prejudicing an investigation.firms to SOCA. Making a report and ob- defendant firm can be put to proof In ten circumstances he said it wouldtaining the relevant consents from SOCA at trial of the suspicion of money amount to tipping off, namely:will generally protect the firm from crimi- laundering. »» where a client is told that he is undernal liability under the money laundering »» A failure to make a SAR sufficiently investigation;regime (“the regime”).2 As this brief- promptly could give rise to liability. »» where a client is told he is beinging considers, however, reporting to, andobtaining consent from, SOCA does not »» Financial institutions will have to followed;necessarily protect against the risk of civil consider what duties they have to »» where a client is told that hisaction based on a breach of mandate, or inform their customers about their transactions were being monitored byconstructive trust liability, when firms fail affairs. They cannot seek to rely on the authoritiesto follow customer instructions. tipping off concerns once there is no »» where a client is told that the decision risk of prejudice to an investigation. to remit monies had raised a suspicion »» Customers can obtain relevant that had led to an investigation; disclosures from a firm in order to1. A firm need only suspect that the property concerned is criminal property to trigger its obligation to report, contrary to Part 7 of POCA.2. A firm will normally be exempt from breaching any duty of confidentiality owed to its customer by making an authorised disclosure, contrary to s338 of POCA.3. Shah and Anor v HSBC Private Bank (UK) Limited [2010].4. See, K Ltd v National Westminster Bank plc (Revenue and Customs Commissioners and another intervening) [2006] 4 All ER 907. 13