There is nothing like an internal whistleblower report about a Foreign Corrupt Practices Act (FCPA) violation, the finding of such an issue or (even worse) a subpoena from the Department of Justice (DOJ) to trigger the Board of Directors and senior management attention to the compliance function and the company’s compliance program. Such an event can trigger much gnashing of teeth and expressions of outrage followed immediately by proclamations “We are an ethical company.” However, it may well be the time for a very serious reality check.
In addition to robust investigation, a company must engage in remediation of the offending conduct. The 2020 Update to the Evaluation of Corporate Compliance Programs mandated the additional significance of this by providing that this process must be considered “both at the time of the offense and at the time of the charging decision and resolution”. When you consider the strictures around continuous monitoring and continuous improvement in compliance programs it is clear why this analysis is so important. Obviously, a key test of any compliance program is when a deficiency is found and a violation occurs. The question then becomes, what did you do about it?
In the 2020 Update, under C. Analysis and Remediation of Any Underlying Misconduct, the DOJ stated, “Finally, a hallmark of a compliance program that is working effectively in practice is the extent to which a company is able to conduct a thoughtful root cause analysis of misconduct and timely and appropriately remediate to address the root causes.” This requires you to not only look at the issues in question but to also fix them going forward. But more than simply looking into it, a company must engage in “remediation to address the root causes”.
The 2020 Update went on to state, “Prosecutors should consider “any remedial actions taken by the corporation, including, for example, disciplinary action against past violators uncovered by the prior compliance program.”” It also referenced “any additional steps that demonstrate recognition of the seriousness of the misconduct, acceptance of responsibility for it, and the implementation of measures to reduce the risk of repetition of such misconduct, including measures to identify future risk”. In the same section, the DOJ posed the following questions:
- Remediation – What specific changes has the company made to reduce the risk that the same or similar issues will not occur in the future? What specific remediation has addressed the issues identified in the root cause and missed opportunity analysis?
Obviously, the investigation will be critical for you to help understand what remediation your compliance program will need. One of the things rarely considered is how the investigation triggers the remediation process and what the relationship is between the two. Russ Berland, Chief Compliance Officer (CCO) at Aventiv Technologies, has said, “Somebody found a way to get around your system. Maybe they colluded to overcome the internal controls. Maybe there was a group that simply wasn’t well trained, didn’t understand, or there was a group that was extremely well trained and decided to do it anyway. But somehow, there are issues in your system, and by system, the overall system of the executive tone, the governance, the compliance program, the internal controls, all at a meta level.”
It is axiomatic that you cannot finds gaps in your compliance system until you stress test it. Viewed in this light, your compliance failures can be viewed as such a stress test. Berland said, “You just got handed a stress test, and this is where the system broke down. Now you know there is a gap. Absent the investigation, as painful and difficult as that is, that gap would have just been sitting there.” The investigation will raise information to you about the failures of your compliance program that you may not have known existed previously.
While there will be a desire by some folks to not give out any information about the investigation until it is completed and there is a final report, you must resist this at all costs. If the results of the investigation are not made available to you as the CCO or the compliance professional charged with remediating the compliance program, any such remediation will be extremely difficult, because, as Berland noted, “you’re just going off suppositions and guesses.”
There must be a solid line of communication between the people who are doing the investigation and the people leading the remediation. Otherwise, you can only begin your remediation in the most general terms and you will not be able to deal with specific gaps in your compliance program or risks that need to be managed.
Such an approach can also be a recipe for disaster. First, and foremost, the DOJ will not give you credit and you may lose the types of benefits articulated in the FCPA Corporate Enforcement Program. Moreover, the executive attention will have dissipated, or, as Berland concluded “When you’ve got the energy, use it. When it’s gone, its gone.”
Finally, never forget that from the DOJ (and Securities and Exchange Commission (SEC)) perspective, the key is to use the information to both fix the problem so that it does not occur again but also improve your compliance regime.
Three key takeaways:
- How does your investigation inform your remediation plan?
- A compliance program failure offers a way to upgrade your regime
- Your investigative team must inform your remediation team.
[View source.]
