Key elements of an anti-bribery/anti-corruption framework

Compliance & Ethics

Professional

April

2016

a publication of the society of corporate compliance and ethics

®

www.corporatecompliance.org

Meet Mark Lanterman Chief Technology Officer Computer Forensic Services Minnetonka, MN See page 14

29

33

39

45

EU Data Protection Regulation: Are we nearly there yet?

Jonathan P. Armstrong

Marketing and Data Security Practices: The FTC v. LifeLock settlement Keith M. Gerver and Peter T. Carey

“To disclose, or not to disclose? That is often a tough question.”

Peter Anderson

The Ethics Wheel: Shaping corporate culture Susan Korbal

This article, published in Compliance & Ethics Professional, appears here with permission from the Society of Corporate Compliance & Ethics. Call SCCE at +1 952 933 4977 or 888 277 4977 with reprint requests.

by Robin Singh, MSc-Law, MBA, CFE

Key elements of an anti-bribery/anti-corruption framework »» To successfully develop and implement an anti-corruption framework, an organization must have an excellent tone at the top. »» An anti-corruption framework must have a robust, clear, and comprehensive definition section for any employee or vendor to refer to. »» Assess your organization’s culture with adequate risk assessments and take steps to mitigate problem areas. »» The degree of confidentiality and mechanism of reporting offered to employees will inform the level of trust those employees maintain. »» Investigation procedures and disciplinary actions that an employee might face are indicators of an organization’s tolerance and intolerance toward misconduct.

Singh

as a compliance measure of the OECD convention of 1997.

Top Nine elements of anti-bribery framework The Bribery Act of 2010 in the United Kingdom came into force on July 1, 2011. The Act is a representation that strengthens the position of the United Kingdom on corruption and bribery and is a major milestone in the development of anti-bribery legislations at a global level.

Here are the Top Nine elements of anti-bribery framework, according to the UK Bribery Act. 1. Procedures should be proportionate: Procedures that exist to prevent any act of bribery should be proportionate to the risk. Moreover, policies should be accessible, clear, practical, enforced, and effectively implemented. +1 952 933 4977 or 888 277 4977 www.corporatecompliance.org

Compliance & Ethics Professional® April 2016

A

nti-bribery statutes are enforced in many nations across the world.

One of the most prominent statutes is enforced in the United Kingdom through the Bribery Act of 2010 and various nineteenth century and twentieth century laws. The United States of America has enforced the Foreign Corrupt Practices Act of 1977 (FCPA). Some other countries with strong anticorruption frameworks in place are Russia, Italy, Ireland, China, and Brazil. Although the Netherlands has not laid down a specific statute against anti-corruption, its Dutch Criminal Code (DCC) constitutes bribery by a civil servant as a criminal offense (Article 177, 177a, and 178 of Dutch Criminal Code). These articles were specifically introduced into the Dutch Criminal Code

73

Compliance & Ethics Professional® April 2016

2. Commitment of top management: Top management should be thoroughly committed to confrontation of bribery across the company. Management should work towards creating a culture where accepting or giving bribes must be discouraged.

3. Risk assessment: While assessing risks, both internal and external risks should be considered. Regular risk assessments should be performed and the results should be documented.

4. Due diligence: The anti-bribery approach has to be risk-based and proportionate.

Persistent efforts should be given by all parties who are providing services for the business.

5. Communication and training: Procedures as well as policies should be understood and embedded. Training that is conducted should be in proportion to risks and customized according to specific needs. Unless you train, the framework/policy is ineffective and you can forget about getting compliance. Train and carry out refresher trainings to make it a success.

6. Internal audits: Internal audits should be conducted according to documented procedure to check the effectiveness of anti-bribery procedures.

7. Monitoring and review: Evaluation is essential to find out how effective the procedures for bribery prevention are in an organization and make changes wherever necessary.

8. Reporting: It is a question that is defined differently and offers a different level of confidentiality depending on the institution that is developing the anti-corruption framework, such as non-governmental or governmental institutions can offer. Depending on the type of reporting and the degree

74 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977

of confidentiality, an organization can proactively propose their assistance as intermediaries in addressing such offences.

9. Investigation & Discipline: The framework should define an organization’s zero tolerance towards such crimes and the level of discipline to which an organization is willing to go to set a lesson and ingrain a culture of integrity.

Comparison between Chinese anti-corruption laws and FCPA Many people are under the impression that all nations where they carry out business transactions have anti-corruption laws similar to those in their home countries. However, such assumptions often lead to negative consequences, especially if you are not familiar with the legal system and cultural practices of a country where you are currently conducting your business. For example, if your company has business interests in the People’s Republic of China (PRC), you may have to revisit your compliance program to make sure that you are complying with China’s severe and singular anti-corruption regulations. We will now illustrate how the USA’s FCPA is different from China’s anti-corruption laws.

One law versus a set of laws FCPA provides the central set of guidelines that are applicable for American companies that do business overseas and with international organizations that have their presence in the U.S. The FCPA is a single United States federal law, and its rules for conducting international business have simplified the processes that help in ensuring compliance. In contrast, China’s anti-corruption rules do not exist as a single law. They are spread across various rules and regulations that include the Anti-Unfair Competition Law,1 Provisional Measures

Differences in definitions Anti-corruption rules in the United States are more clearly defined than in China as far as the prohibition of actions is concerned.

For instance, it is stated by the FCPA that giving gifts of value or payments to foreign officials, so that their positions can be used to secure a commercial contract or bypass custom regulations, is prohibited.

On the other hand, anti-corruption laws in China are not defined specifically. The definition given is quite broad, because the exchange of gifts is very common in China, and a distinction between a gift and a bribe with no expectations is quite tough to make out.

such conduct may be prohibited by other legislation in the U.S. Bribery of foreign officials To bribe a foreign official is considered an offense by both the FCPA and the UK Bribery Act. However, the FCPA defines a foreign official in a broader manner than the UK Bribery Act.

To bribe a foreign official is considered an offense by both the FCPA and the UK Bribery Act. However, the FCPA defines a foreign official in a broader manner than the UK Bribery Act.

Comparison between FCPA and UK Bribery Act Active and passive bribery The UK Bribery Act prohibits active as well as passive bribery, but the FCPA prohibits only active bribery.

Bribery on a private level The UK Bribery Act covers bribery even on a private level, unlike the FCPA, although

Intent Under the FCPA, one has to prove that a person who is trying to bribe someone else is doing so with a “corrupt” intent.

This is not the case in the UK Bribery Act, where there is no requirement to prove an improper intent.

What are the three top tests that a compliance officer or an internal auditor should follow?

The main reason to conduct substantive testing is to detect red flag or potential corruption violations. An internal audit should not be treated as an investigation, but as a process like any other process. If any red flag or serious potential violation is detected, protocol must be immediately put into place for consultation. The following are some tests that a compliance officer must follow for an anti-corruption audit: 1. Risk assessment: The Audit/Compliance Review should be based on an organization’s risk assessment/fraud risk assessment to concentrate on areas that face elevated level of risks for bribery/corruption.

A compliance officer must test how effective +1 952 933 4977 or 888 277 4977 www.corporatecompliance.org

Compliance & Ethics Professional® April 2016

on the Prohibition of Commercial Bribery, PRC Criminal Law, and many other judicial decisions and laws. Because each law’s scope is to cover a certain aspect of corruption, a specific compliance program needs to be created especially for China that must cover all the different laws that constitute the anticorruption rules of China.

75

the company’s existing controls are, in comparison to the need derived by the business. Furthermore, the controls can be tested in relation to any international leading practice which would befit the organization.

2. Pre-site procedures and planning: Pre-site planning procedures may include a notification letter to the business units to be audited; teleconferencing with management to explain the aim of the audit process and talk about potential corruption risks; and requests for relevant information, especially financial data so that the process of choosing samples for testing transactions can be started.

3. Fieldwork: In an anti-corruption audit, fieldwork is conducted for one to two weeks and includes onsite procedures at a business unit. The focus of the fieldwork is to do a compliance test for the different elements of an anti-corruption compliance program and to conduct substantive testing to detect red flags or potential violations.

Compliance & Ethics Professional® April 2016

Top clauses to include in vendor contracts To ensure compliance with the FCPA and UK Bribery Act, it is important to identify high-risk affiliates, subsidiaries, and personnel, including consultants, agents, contractors, and employees in a company. It should be understood that a company is responsible for FCPA violations that are committed by these stakeholders. Here are some clauses that should be included in a contract with your contractors or vendors to avoid violation of FCPA: ·· A standard contract may include warranties and representations; ·· A clause should mention your discretion to terminate that contract if your partner is found to violate the FCPA or the UK Bribery Act; and ·· An indemnification clause can be also included if a contractor or a vendor is

76 www.corporatecompliance.org +1 952 933 4977 or 888 277 4977

found to be a party in violation of the anticorruption/anti-bribery act.

Impact of data analytics for proactive anti-bribery review The regulatory environment has become quite stringent in today’s business world, and all those US firms that have global business interests are under tremendous pressure to ensure that their compliance programs on anti-corruption and anti-bribery are improved. Potentially improper payments that would expose the organization to risks under the FCPA should be detected and prevented. At many of the multinational companies, senior management, boards, and compliance audit committees are focused towards anti-corruption compliance.

Anti-corruption and anti-bribery analytics tests of controls incorporate concepts of big data that can integrate data from multiple sources (e.g., text mining, transactional data, and email and social media) to isolate as well as prioritize rogue activity and areas of risk. These anticorruption analytics can be used by executives in reducing costs pertaining to compliance fieldwork or internal audits. These analytics are included in the risk assessment process to find out which company locations should be audited, rather than simply running the analytics.

Impact of anti-bribery framework on policies The UK Bribery Act provides various restrictions on the conduct of employees in various situations while they deal with stakeholders and government clients as part of the anti-bribery provisions. A clear Standard of Conduct (also called a Code of Ethics), conflict of interest policy, and other anti-fraud policies are required. If the employees are not made aware of the various restrictions and provisions of the Act, they may violate them out of sheer ignorance. Thus, extensive training on the complete scope of violations, along with appropriate scenarios and examples, must be

given to staff that is in sync with their work profiles. It is rightfully stated that creating awareness is the first major step to complying with this anti-corruption law.

Where does the legal element fit in an anti-bribery framework?

The Compliance department works closely with Legal Affairs to interpret/understand the legal angle when carrying out an investigation.

Section 7 of the UK Bribery Act declares a criminal offense in all those circumstances where persons associated with a relevant commercial organization have committed an act of bribery in order to procure business for the said organization. The guidance provided by the Act and its implication must be understood well in advance, such as understanding the meaning of relevant commercial organization, business,

bribery, and associated person in relation the evidence identified in the investigation.

Similarly, on the FCPA front, the legislative history speaks of keywords such as willful blindness, deliberate ignorance, and taking a head-in-the-sand, which needs to be interpreted in correlation with the evidence obtained. At the end, a decision for prosecution should be done on the merits of how strong the available evidences are and whether it is really in the interests of the public/organization/stakeholder to prosecute. ✵ 1. The Supreme People’s Court of the People’s Republic of China: Anti Unfair Competition Law. Posted September 9, 2003. Available at http://bit.ly/china-court

Robin Singh (robinsingh002@yahoo.com) is Corporate Senior Compliance and Fraud Examiner at Abu Dhabi Health Services Company in Abu Dhabi, United Arab Emirates. @drobinsingh ae.linkedin.com/in/whitecollarinvestigator www.advancedcompliancesol.com

4.13.2016 | Right to be forgotten, right of erasure, so nothing left to chance?

4.28.2016 | Navigating the Challenges of U.S. Export Controls

• ROBERT BOND, Head of Data Protection and Cyber Security Law, Charles Russell Speechlys LLP

• JULIO FERNANDEZ, Principal Consultant, Fernandez Export Advisory LLC

4.14.2016 | Preparing for a Regulatory Exam of Your Organization: Your Plan from Start to Finish

5.31.2016 | Compliance Risk Mitigation in Developing Economies

• CATHERINE COLYER, Chief Compliance Officer & Fair Lending Officer, Veterans United Home Loans

• IBRAHIM YEKU, Legal Counsel , Solola & Akpana

Learn more and register at corporatecompliance.org/webconferences

+1 952 933 4977 or 888 277 4977 www.corporatecompliance.org

Compliance & Ethics Professional® April 2016

Upcoming 2016 SCCE Web Conferences

77