![Thomas Fox - Compliance Evangelist](/img/client_headers/TomFox/FCPAHeader.jpg)
I have been studying the legend of King Arthur and thought it would be good idea to have an article legend of King Arthur, the Roundtable and his knights all round compliance. It turns out there are many compliance lessons from the entire oeuvre of Arthurian legends. Many of the tales can inform your (modern day) compliance program.
I. Arthur and Leadership
I begin with King Arthur and some leadership lessons that might apply to a Chief Compliance Officer (CCO), compliance practitioner or others who might be responsible for an anti-corruption compliance program based on the Foreign Corrupt Practices Act (FCPA), UK Bribery Act or similar anti-bribery law.
According to the legends, King Arthur achieved quite a bit in one lifetime. He, established a kingdom, ruled his castle, Camelot and brought peace and order to the land based on law, justice, and morality. He founded an order known as the Knights of the Round Table where in all knights are seated as equals around the table, symbolizing equality, unity, and oneness. Nicole Lastimado, in a blog post entitled “Characteristics of a Good Leader :)”, identified five characteristics that she believed made Arthur a good leader.
Adapting Lastimado King Arthur was (1) Honest, in that he displayed sincerity, integrity, and candor in his actions. (2) Intelligent, because he read and studied. (3) Courageous, because he had the perseverance to accomplish a goal, regardless of the seemingly insurmountable obstacles. (4) Imaginative because he adapted by making timely and appropriate changes in his thinking, plans, and methods. Finally, (5) Inspiring, because through demonstrating confidence, he inspired his knights and those in his Kingdom to reach for new heights. I would add as a separate category that Arthur led from the front.
I thought about those qualities when I read a couple of recent articles in the Houston Chronicle. The first was by the Chronicle Business Columnist, L. M. Sixel, entitled “Leaders possess the keys to safety”, and the second was an Op-Ed entitled “Trust Shaken”. Both articles discussed corporate issues that have led to catastrophic injuries or even deaths and more importantly how the entities involved reacted. The first article discussed safety at the workplace and the second health issues in the processing of food products.
In her article Sixel, wrote, “A company truly interesting in making sure its workers are safe has to come up with ways to make it easy and risk-free to bring up potential safety problems.” Moreover, the corporate attitude which fosters this “starts with leadership.” She cited to Frank Reiner, the president of the Chlorine Institute, who recently said in a speech to the group’s annual conference in Houston “You have to eliminate the fear.” Additionally, “Once the cause is identified, similar accidents can be prevented, he said. The message that people are free to come forward to talk about what went wrong and why has to come from the top down. Identifying problems not only is everyone’s responsibility but also a companywide expectation.”
Equally important is for a company to learn from its mistakes. Obviously, there should be a root cause analysis after a disaster. At the same conference, the Keynote Speaker, John E. Michel, a retired U.S. Air Force brigadier general and author of “The Art of Positive Leadership: Becoming a Person Worth Following”, said “After a disaster, there is a big investigation to find out why it happened and fix the problem before it can happen again. Sometimes, whole fleets are grounded after an airline crash.” However, Michel noted that it is important to keep learning even if there is no disaster. Michel “likes to pay attention to “near misses” and learn from the times things could have gone horribly wrong but didn’t” and that “There are debriefing sessions even when things go well on a flight mission and there are always tweaks to be made.”
Another speaker at the conference Mark Briggs, area director of the Houston South office for OSHA, noted it was important for employees to feel their suggestions and comments around safety are considered by management, saying “You have to show you care and that’s it’s not just a one-month project.” If management shows that it takes employee recommendations around safety seriously, it will help employees down the chain feel more secure about bringing them to management’s attention.
The Chronicle Op-Ed piece focused on one of the most beloved institutions in the great state of Texas - Blue Bell Ice Cream. Unfortunately for Blue Bell, in March there were five cases of listeria in Kansas, linked to a Blue Bell plant. Three of those persons died, “although a Kansas health official stated that the listeriosis was not the cause of death.” The Chronicle piece noted that after that initial discovery, “multiple strains of listeria have been found in its Brenham and Oklahoma plants, almost 500 miles apart, according to the CDC [Center for Disease Control and Prevention]. Possible explanations include lax safety standards, extremely bad luck striking twice or some undisclosed manufacturing issue.”
A Texas Tribune article by Terri Langford, entitled “State Health Tests Prodded Blue Bell Recall”, said, “The crisis for Blue Bell began on March 13, when Kansas officials determined that Listeria-tainted portions of the company’s ice cream made it into products served to five hospital patients between January 2014 and January 2015. Of the five who became ill, three died. By March 24, Kansas officials traced the source of the listeria to Blue Bell’s plant in Broken Arrow, Okla., built by the Texas company in 1992. On April 3, the Centers for Disease Control had traced Blue Bell’s Listeria strain to six other patients going back to 2010. Four had been hospitalized in Texas for unrelated problems when they became sick from listeria. Five days later, on April 8, the CDC had identified two clusters of Blue Bell listeria victims. The strains were traced to the plants in Oklahoma and Texas.”
Yet it was not until Blue Bell was notified by a representative from the Texas Department of State Health Services, that “lab tests on two Blue Bell ice cream flavors — Mint Chocolate Chip and Chocolate Chip Cookie Dough — came back “presumptive positive” for the deadly bacteria Listeria monocytogenes” that the company announced it was pulling product from its shelves for testing.
What are the lessons from for the CCO or compliance practitioner? You should channel your inner King Arthur and lead. You have to lead management to understand that one of the best sources of information on your own business is your employees. There is a reason the FCPA Guidance lists internal reporting as one of the Ten Hallmarks of an Effective Compliance Program. You must give employees a way to report misconduct and then you must use that information to investigate and communicate to employees going forward. If there are lessons to be learned use those lessons for in-house compliance training. If a true catastrophe or disaster befalls the company, do not wait to remediate. Do so as soon as is practicable, not when the government calls.
II. The Pentecostal Oath and Code of Conduct
One thing for which King Arthur is remembered are his chivalric knights. He helped create this legend, in large part, by establishing a Code of Conduct for the Knights of the Round Table. The King required each one of them to swear an oath, called the Pentecostal Oath, which was Arthur’s ideal for a chivalric knight. The Oath stated, “The king established all his knights, and gave them that were of lands not rich, he gave them lands, and charged them never to do outrageousity nor murder, and always to flee treason; also, by no mean to be cruel, but to give mercy unto him that asketh mercy, upon pain of forfeiture of their worship and lordship of King Arthur for evermore; and always to do ladies, damosels, and gentlewomen succor upon pain of death. Also, that no man take no battles in a wrongful quarrel for no law, ne for no world’s goods. Unto this were all the knights sworn of the Table Round, both old and young. And every year were they sworn at the high feast of Pentecost.” (Le Morte d'Arthur, pp 115-116)
Interestingly, the Oath first appeared in Sir Thomas Malory’s Le Morte d’Arthur and in none of the prior incarnations of the legend. In Malory’s telling, after the Knights swore the Oath, they were provided titles and lands by the King. The Oath specifies both positive and negative conduct; that is, what a Knight might do but also what conduct he should not engage in. The Pentecostal Oath formed the basis for the Knight’s conduct at Camelot and beyond. It was clearly a forerunner of today’s corporate Code of Conduct.
The foundational document of any FCPA compliance program is its Code of Conduct. This requirement has long been memorialized in the US Sentencing Guidelines, which contain seven basic compliance elements that can be tailored to fit the needs and financial realities of any given organization. From these seven compliance elements, the DOJ has crafted its minimum best practices compliance program, which is now attached to every Deferred Prosecution Agreement (DPA) and Non-Prosecution Agreement (NPA). These requirements were incorporated into the 2012 FCPA Guidance, the Evaluation of Corporate Compliance Programs (Evaluation) and new FCPA Corporate Enforcement Policy. The US Sentencing Guidelines assume that every effective compliance and ethics program begins with a written standard of conduct; i.e. a Code of Conduct. What should be in this “written standard of conduct”.
Element 1
Standards of Conduct, Policies and Procedures (a Code of Conduct)
An organization should have an established set of compliance standards and procedures. These standards should not be a “paper only” document, but a living document that promotes organizational culture that encourages “ethical conduct” and a commitment to compliance with applicable regulations and laws.
In the FCPA Guidance, the DOJ and Securities and Exchange Commission (SEC) state, “A company’s code of conduct is often the foundation upon which an effective compliance program is built. As DOJ has repeatedly noted in its charging documents, the most effective codes are clear, concise, and accessible to all employees and to those conducting business on the company’s behalf.” Indeed, it would be difficult to effectively implement a compliance program if it was not available in the local language so that employees in foreign subsidiaries can access and understand it. When assessing a compliance program the DOJ and SEC will review whether the company chapter has taken steps to make certain that the code of conduct remains current and effective and whether a company has periodically reviewed and updated its code.
In each DPA and NPA over the several years the DOJ has stated the following as item No. 1 for a minimum best practices compliance program.
1. Code of Conduct. A Company should develop and promulgate a clearly articulated and visible corporate policy against violations of the FCPA, including its anti-bribery, books and records, and internal controls provisions, and other applicable foreign law counterparts (collectively, the "anti-corruption laws"), which policy shall be memorialized in a written compliance code.
In an article in the Society for Corporate Compliance and Ethics (SCCE) Complete Compliance and Ethics Manual, 2nd Ed., entitled “Essential Elements of an Effective Ethics and Compliance Program”, authors Debbie Troklus, Greg Warner and Emma Wollschlager Schwartz, state that your company’s Code of Conduct “should demonstrate a complete ethical attitude and your organization’s “system-wide” emphasis on compliance and ethics with all applicable laws and regulations.” Your Code of Conduct must be aimed at all employees and all representatives of the organization, not just those most actively involved in known compliance and ethics issues. From the board of directors to volunteers, the authors believe that “everyone must receive, read, understand, and agree to abide by the standards of the Code of Conduct.” This would also include all “management, vendors, suppliers, and independent contractors, which are frequently overlooked groups.”
There are several purposes identified by the authors that should be communicated in your Code of Conduct. Of course, the overriding goal is for all employees to follow what is required of them under the Code of Conduct. You can do this by communicating what is required of them, to provide a process for proper decision-making and then to require that all persons subject to the Code of Conduct put these standards into everyday business practice. Such actions are some of your best evidence that your company “upholds and supports proper compliance conduct.”
The substance of your Code of Conduct should be tailored to the company’s culture, and to its industry and corporate identity. It should provide a mechanism by which employees who are trying to do the right thing in the compliance and business ethics arena can do so. The Code of Conduct can be used as a basis for employee review and evaluation. It should certainly be invoked if there is a violation. To that end, I suggest that your company’s disciplinary procedures be stated in the Code of Conduct. These would include all forms of disciplines, up to and including dismissal, for serious violations of the Code of Conduct. Further, your company’s Code of Conduct should emphasize it will comply with all applicable laws and regulations, wherever it does business. The Code needs to be written in plain English and translated into other languages as necessary so that all applicable persons can understand it.
As I often say, the three most important things about your FCPA compliance program are ‘Document, Document and Document’. The same is true of communicating your company’s Code of Conduct. You need to do more than simply put it on your website and tell folks it is there, available and that they should read it. You need to document that all employees, or anyone else that your Code of Conduct is applicable to, has received, read, and understands the Code. For employees, it is important that a representative of the Compliance Department, or other qualified trainer, explains the standards set forth in your Code of Conduct and answers any questions that an employee may have. Your company’s employees need to attest in writing that they have received, read, and understood the Code of Conduct and this attestation must be retained and updated as appropriate.
The DOJ expects each company to begin its compliance program with a very public and very robust Code of Conduct. If your company does not have one, you need to implement one forthwith. If your company has not reviewed or assessed their Code of Conduct for five years, I would suggest that you do in short order as much has changed in the compliance world.
What is the value of having a Code of Conduct? I have heard many business folks ask that question over the years. In its early days, a Code of Conduct tended to be lawyer-written and lawyer-driven to “wave in a defense situation” by claiming that “see we have one”. But is such a legalistic code effective? Is a Code of Conduct more than simply, your company’s law? What is it that makes a Code of Conduct effective? What should be the goal in the creation of your company’s Code of Conduct?
Just as the Pentecostal Oath was required to be sworn out each year, you should have your employees recertify their adherence to your Code of Conduct. Moreover, just as King Arthur set his expectations for behavior your company should do so as well.
III. The Round Table and Compliance Professionals and Lawyers as Whistleblowers
Next, we use King Arthur’s Round Table as the entry into compliance. The Round Table is the famous table around which he and his Knights congregated. Its shape implies that everyone who sits there has equal status. Wace, who relied on previous depictions of Arthur's fabulous retinue, first described the Round Table in 1155. The symbolism of the Round Table developed over time; by the close of the 12th century it had come to represent the chivalric order associated with Arthur's court, the Knights of the Round Table.
As with all things Arthurian, the origins of the Round Table are a bit murky. One commentator claims Arthur created the Round Table to prevent quarrels among his barons, none of whom would accept a lower place than the others. Others believe it came to prominences as a symbol of the famed order of chivalry that flourished under Arthur. In Robert de Boron's Merlin, written around the 1190s, the wizard Merlin creates the Round Table in imitation of the table of the Last Supper and of Joseph of Arimathea’s Holy Grail table. This table has twelve seats and one empty place to mark the betrayal of Judas. This seat must remain empty until the coming of the knight of purity and chastity who will achieve the Grail. When the Knight Percival comes to the court at Camelot, he sits in the seat and initiates the Grail quest. Whatever the origins of the Round Table, it may be the single most tangible item associated with King Arthur.
I thought about these concepts surrounding the legend of the Round Table in consideration of the announcement earlier this month of a whistleblower award paid out by the SEC of between $1.4 to $1.6 MM to a compliance officer. Sam Rubenfeld reported in the Wall Street Journal (WSJ), in “SEC Awards More than $1.4 Million to Whistleblower Compliance Officer”, that the award was paid “to a compliance officer who provided information that helped the SEC in an enforcement action against the tipster’s company, marking the second time a compliance professional received an award under the SEC’s whistleblower program.” As stated this was the second award paid out to a compliance officer, the first occurred in August 2014 and was in the amount of $300,000.
This un-named whistleblower took his (or her) concerns internally to management but was not successful in persuading management to cease the illegal practices. Moreover, “The compliance officer had a reasonable basis to believe disclosure to the SEC “was necessary to prevent imminent misconduct” from causing “substantial financial harm” to the company or investors, the SEC said.” The FCPA Blog, in “Compliance officer awarded $1.5 million under SEC whistleblower program”, reported, “After that award, Sean McKessy, chief of the SEC’s whistleblower office, said employees who perform internal audit, compliance, and legal functions can be eligible for an SEC whistleblower award “if their companies fail to take appropriate, timely action on information they first reported internally.”” Adding to McKessy was Andrew Ceresney, chief of the SEC’s enforcement division, who said in a statement “This compliance officer reported misconduct after responsible management at the entity became aware of potentially impending harm to investors and failed to take steps to prevent it.”
This second award makes clear that the SEC will treat compliance professionals as all other whistleblowers when it comes to making an award based upon the fine or penalty. In a December 2014 article, entitled “When Should Internal Auditors And Compliance Officers Become SEC Whistleblowers”, Daniel Hurson wrote “while the amount of the [first] award [$300,000] was not particularly hefty, and was dwarfed by several multi-million dollar whistleblower awards given previously, it carried particular significance to astute observers in the corporate legal, internal audit, and compliance communities. Insiders know that compliance officers and internal auditors, beleaguered and sometimes frustrated as they may be, hold the “keys to the kingdom” when it comes to knowledge of corporate ethical and legal lapses within their companies. Prior to this award, it had generally been thought the SEC would continue to discourage such awards on the rationale that it would not want to encourage employees whose job it was to prevent corporate legal and ethical violations to profit from simply doing their jobs.”
Hurson wrote that this initial whistleblower payment to a compliance practitioner marked a change in SEC policy because “It has generally been understood that compliance officers and internal auditors are not permitted to receive whistleblower awards because information they reported to a superior constituting allegations of misconduct was not to be considered “original information” under the Dodd-Frank Act and SEC rules.” He ended his piece with the following, “In the final analysis, however, the real job of a compliance officer is not just training employees to know the FCPA or any of the myriad of laws and regulations that now govern corporate conduct, but doing his or her absolute best to help them comply with the law, and to identify the cases when they fail. An internal auditor is charged with making his or her investigations and reports, but not administering punishment. But the presumption in each case is that the company will take your work seriously and take action to correct and if necessary report the problem to regulatory authorities.
If this does not happen, or the company displays either a lack of good faith or competence in undertaking its end of the bargain, you may have to undertake corrective action, however unpleasant or personally risky. In truth, you owe this to the company, its vast majority of honest employees, and its investors. If certain people in the corporate structure are blind to the “bet the company” risk in ignoring or covering up wrongdoing, your job is to ensure that philosophy does not prevail. I suggest with respect that that duty should remain foremost in the personal decision as to whether and when a compliance officer or internal auditor should, if the situation demands and the law allows, become a whistleblower.”
There was nothing in the SEC Press Release or any of the commentary on the whistleblower award to indicate that the compliance professional involved was a lawyer. However, an equally delicate issue is whether a lawyer can be a whistleblower. In an article entitled “Is the SEC encouraging unethical whistleblowing by counsel?” Nick Morgan explored this issue. Lawyers are also governed by their state bar associations on their ethical obligations, which include confidentiality and loyalty to a client. Morgan noted, “The Dodd-Frank bounty provisions further exacerbated the conflict between federal securities whistleblower law and state attorney ethics requirements by giving attorneys financial incentives to breach attorney-client confidentiality.”
Three state bar organizations, Washington, California and New York, have opined questioned if SEC regulations trump state bar ethical obligations regarding attorney whistleblowers? Indeed in New York, “the New York County Lawyers’ Association’s committee on professional ethics responded to the development by releasing a formal opinion. It concluded that New York lawyers, presumptively, may not ethically serve as whistleblowers for a bounty against their clients under Dodd-Frank, because doing so generally gives rise to a conflict between lawyers’ interests and those of their clients.”
What happens when federal law is in conflict with state regulations regarding lawyers’ ethical obligations? Morgan reported, “no court has yet found that SEC regulations preempt state ethics rules governing lawyers’ communications with their clients. In cases in which conflicts of state and SEC law have appeared, federal courts have been receptive to arguments based on lawyers’ ethical obligations under state law and have balanced the state and federal interests. While the Dodd-Frank bounty provisions increase the incentives for attorneys to act as whistleblowers at their clients’ expense, it is unclear whether those incentives outweigh the risks and burdens associated with taking such actions. Aside from the ethical issues, whistleblowers more often than not go uncompensated and incur significant burdens for their trouble, decreasing whatever temptation some attorneys may feel.”
King Arthur’s Round Table may have been designed so that all Knights were treated as equals. As noted in some of the legends the Round Table is part of the Holy Grail quest storyline, requiring purity of heart and chastity to achieve the Grail. Both strands of the Round Table legend inform the debate on whistleblowers. Even if compliance practitioners may report on their own companies to the SEC, it is not clear about the answer when it comes to lawyers. Further, as lawyers have separate legal obligations they fail to meet the second purpose of the Round Table, to find someone to chase the Grail of whistleblowing.
IV. The Green Knight and the Protection of Whistleblowers
We continue our exploration of Arthurian legends, with one of the most interesting characters in the Arthur canon, The Green Knight, so called because his skin and clothes are green. The meaning of his greenness has puzzled scholars since the discovery of the poem, that identifies him as the Green Man, a vegetation being in medieval art; a recollection of a figure from Celtic mythology; a Christian symbol or the Devil himself. According to Wikipedia, C. S. Lewis suggested the character was “as vivid and concrete as any image in literature” and J. R. R. Tolkien called him the “most difficult character” to interpret in the introduction to his edition of Sir Gawain and the Green Knight. His major role in Arthurian literature includes being a judge and tester of knights, and as such the other characters see him as friendly but terrifying and somewhat mysterious.
In his primary story with Sir Gawain, the Green Knight arrives at Camelot during a Christmas feast, holding a bough of holly in one hand and a battle-axe in the other. Despite disclaim of war, the knight issues a challenge: he will allow one man to strike him once with his axe, under the condition that he return the blow the following year. At first, Arthur takes up the challenge, but Gawain takes his place and decapitates the Green Knight, who retrieves his head and tells Gawain to meet him at the Green Chapel at the stipulated time. One year later, while Gawain is traveling to meet the Green Knight, he stays at the castle of Bercilak de Hautedesert. At Bercilak's castle, Gawain’s loyalty and chastity is tested, Bercilak sends his wife to seduce Gawain and arranges that they shall exchange their gains for the other’s. On New Year's Day, Gawain meets the Green Knight and prepares to meet his fate, where upon the Green Knight feints two blows and barely nicks him on the third. He then reveals that he is Bercilak, and that Morgan le Fay had given him the double identity to test Gawain and Arthur.
I thought about this story of testing when I read an article in the Wall Street Journal, entitled “SEC Gives More Than $600,000 to Whistleblower in Retaliation Case” by Rachel Louise Ensign. She reported on the Paradigm securities matter where an award was made to the whistleblower, which was settled by the firm late last year. The settlement was for $2.2MM and $600, 000 of that amount was paid to the whistleblower for the firm’s retaliation against him. This was the first award to a whistleblower for retaliation from the act of whistleblowing. The award is 30% of $2.2MM, which is the maximum amount a tipster can get under the program. The agency said the “unique hardships” he faced were a factor in the size of his award. SEC Enforcement Director, Andrew Ceresney, was quoted in the article as saying ““We appreciate and recognize the sacrifice this whistleblower made and the important role the whistleblower played in the success of the SEC’s first anti-retaliation enforcement action.””
This award to a whistleblower caps a stunning couple of weeks for whistleblowers who have brought information forward under the Dodd-Frank whistleblowing provisions. First there was the KBR pre-taliation fine and Cease and Desist Order. In this matter, KBR was fined for having language in its internal employee Confidentiality Agreement (CA) that required employees to go to the company’s legal department before releasing certain confidential information to outside parties such as the SEC. The SEC held that such restrictions violated the “whistleblower protection Rule 21F-17 enacted under the Dodd-Frank Act. KBR required witnesses in certain internal investigations interviews to sign confidentiality statements with language warning that they could face discipline and even be fired if they discussed the matters with outside parties without the prior approval of KBR’s legal department. Since these investigations included allegations of possible securities law violations, the SEC found that these terms violated Rule 21F-17, which prohibits companies from taking any action to impede whistleblowers from reporting possible securities violations to the SEC.” This was in the face of zero findings that KBR had actually used such language or restrictions to prevent any employees from whistleblowing to the SEC.
In another part if its Press Release regarding the KBR case Director Ceresney said, “By requiring its employees and former employees to sign confidentiality agreements imposing pre-notification requirements before contacting the SEC, KBR potentially discouraged employees from reporting securities violations to us. SEC rules prohibit employers from taking measures through confidentiality, employment, severance, or other type of agreements that may silence potential whistleblowers before they can reach out to the SEC. We will vigorously enforce this provision.”
Then we have the case of Tony Menendez, who was profiled by Jessie Eisinger in an article entitled “The Whistleblower’s Tale: How an Accountant Took on Halliburton”. The article told the story of a whistleblower, who took his concerns to government regulators and was then outed by the company as the SEC whistleblower and retaliated against. Interestingly, the SEC took no action on the whistleblower claims and the company argued on appeal that “since the SEC hadn’t brought any enforcement action, his complaint about the accounting was unfounded.” The company also claimed that simply because the whistleblower was identified by name, this alone was not the basis for a “material adverse action” against him. While Halliburton won at the administrative hearing level, it lost at the Fifth Circuit Court of Appeals.
So now there is a Court of Appeals opinion holding that if whistleblowing was a “contributing factor” only to the retaliation. Further, the employee is not required to prove motive. Well-known whistleblower expert Jordan Thomas also explained in the Eisinger article, “Whistleblowers can be victims of retaliation even if they are ultimately proved wrong as long as they have a “reasonable” belief that the company was doing something wrong.”
It appears that the SEC will be more like the Green Knight going forward. It will be a tester to determine if retaliation against whistleblowers occurs. From preventing companies from trying to stop whistleblowing via CA’s, to monetary awards for retaliation even where there is no SEC or government action taken, to the award to whistleblowers as a part of an SEC settlement for retaliation by their former employers; the SEC is making very clear that they will test how your company treats whistleblowers. If the SEC finds your company’s conduct lacking, you may well be facing something like the Green Knight going forward.
V. The Quest for the Holy Grail and Compliance Defense
We conclude our Arthurian themed week with the Holy Grail, which has fired the imagination of artists for millennia. What was the Holy Grail? According to Professor Dorsey Armstrong in her Teaching Company lecture series, entitled “King Arthur: History and Legend”, the Holy Grail has taken various forms over the years. For Chrétien de Troyes, it was a fancy serving dish; for Wolfram von Eschenbach, it is a magical stone; for Robert de Boron, it is the cup that Christ drank from at the Last Supper; for the comedy troupe Monty Python, it is a cartoon sketch that no one ever finds; and for the modern-day author Dan Brown, it is both a person, who is a descendant of Mary Magdalene, and a bloodline which leads to the Merovingian kings of France. In other words, it means many things to many people.
One of the articulated reasons for the creation of King Arthur’s Round Table was tied to the Holy Grail, since it was allegedly used at the Last Supper, it seems only natural that Arthur would seek it from his table as well. Indeed, in Robert de Boron’s account of Arthur, the wizard Merlin tells Arthur the Round Table was established to identify the one Knight, who was pure of heart, who could find the Holy Grail. Only after the great quest for and locating of the Holy Grail was achieved could Arthur’s other ambitions come to pass.
Another interesting twist on the Grail legend is that it was in Britain. Curiously it was first ‘discovered’ by some enterprising Monks in Glastonbury, England in the late 12th century. They just happened to come across a well that ‘bled’ water around the time of an annual pilgrimage. Going viral in the Middle Ages was tough but the Monks built upon their initial find by claiming that both King Arthur and his Queen Guinevere were also buried at their abbey. Do you believe any of the above? Are you on your own Grail Quest, however dreamy that quest might be?
I thought about the quest for the Holy Grail in the context of the sirens clarion call for a compliance defense addition to the FCPA, which would give companies a complete defense if they engage in conduct which constitutes a FCPA violation. I see this quest for a compliance defense for companies that violate the FCPA to be as quixotic as the quest for the Holy Grail. As there were two requirements for the Knight who was destined to find the Grail, we will begin pureness of heart. Recognizing that it might be difficult to find a corporation that is ‘pure of heart’, the appropriate analogy might be more than simply spending what may appear to be a large dollar amount on a compliance program. This is because it is not the amount of money you spend that informs the operationalization of your compliance program. Moreover, there are no reported FCPA enforcement actions where a single ‘rogue’ employee simply took it upon themselves to engage in bribery and corruption on behalf of an organization. Finally, every company which engages in corruption obtains a benefit from the conduct.
How about the second part of the Grail quest that requires a ‘chaste’ Knight? Once again it is somewhat difficult to understand how a corporation could be chaste but I think the appropriate analogy is the doing of compliance. Put another way, it is not having a compliance program in place but having an effective compliance program. So not only does the amount of money a company spends become immaterial to our quest but also the same can be said to the claim that having a written program should entitle you some type of defense to any FCPA violations. Just as questing for the Holy Grail is seeking something that does not exist, affording companies a defense from their own FCPA violations by having a written program in place is not a temporal reality.
Under the FCPA Ten Hallmarks of an Effective Compliance Program, the questions posed in the Evaluation of Corporate Compliance Programs and the FCPA Corporate Enforcement Policy, that it is an interplay of the right compliance message, tools in place to communicate and enforce the compliance message and then oversight to ensure compliance with the entire compliance regime. Monitoring and oversight are recognized as a key element so your company should establish a regular monitoring system to spot issues and address them. Effective monitoring means applying a consistent set of protocols, checks and controls tailored to your company’s risks to detect and remediate compliance problems on an ongoing basis. To address this, your compliance team should be checking in routinely with the finance departments in your foreign offices to ask if they have noticed recent accounting irregularities. Regional directors should be required to keep tabs on potential improper activity in the countries they manage. Additionally, the global compliance committee should meet or communicate as often as every month to discuss issues as they arise. These ongoing efforts demonstrate your company is serious about compliance.
In addition to monitoring, structural controls are recognized as an important element. It has been said that large companies “must use structural means to maintain control.” One of the best explanations of the use of internal controls as a structural component of any best practices compliance program comes from Aaron Murphy, a partner at Foley and Lardner in San Francisco, in his book entitled “Foreign Corrupt Practices Act”, where he said, “Internal controls are policies, procedures, monitoring and training that are designed to ensure that company assets are used properly, with proper approval and that transactions are properly recorded in the books and records. While it is theoretically possible to have good controls but bad books and records (and vice versa), the two generally go hand in hand – where there are record-keeping violations, an internal controls failure is almost presumed because the records would have been accurate had the controls been adequate.” These two parts are but a sampling but it is in the doing of compliance that any anti-corruption compliance program becomes effective; it is not simply having one in place.
Finally, as with all quests, what will it bring you if you actually achieve it? As with the Holy Grail, it is a good story but that is about it. I find this view best articulated by Matthew Stephenson, in a blog post entitled “The Irrelevance of an FCPA Compliance Defense”, where he gave three reasons why a compliance defense is not warranted. First (and perhaps almost too obvious to state) is that if your company is invoking a compliance defense, there has been a FCPA violation. The second is “The U.S. Department of Justice (DOJ) already takes into account a corporation’s good-faith efforts to implement a meaningful compliance program when the DOJ decides whether to pursue an FCPA action against the corporation, and what penalties or other remedies to impose. Indeed, the adequacy of the corporation’s compliance program is a standard subject of negotiation between the DOJ and corporate defendants.” Third is that “An FCPA compliance defense would only alter the DOJ’s bargaining position if a corporation unhappy with the DOJ’s position could either (1) convince the DOJ lawyers that the DOJ’s position is unreasonable in light of the corporation’s compliance program, or (2) credibly threaten to go to court and defeat the DOJ’s enforcement action altogether by successfully invoking the compliance defense before a federal judge.” Stephenson discounts subpart 1 because DOJ lawyers already take a company’s compliance program into account. But his second subpart is even more important because no company will go to trial against the government using a compliance defense to a demonstrable FCPA violation. Simply put, no company is going to risk losing at trial when they can control their own fate through settlement. The modern-day Knights seeking the Holy Grail of a compliance defense will never find it because of this last fact. Moreover, just as there were no real Knights who could meet the requirements to actually find the Holy Grail after their quest, there are no companies which can meet the same criteria; that being that a compliance defense could or even should trump a FCPA violation.
We leave our King Arthur with our quest intact, bringing a message I hope that you have ascertained about some of the things you need to do around the nuts and bolts of anti-corruption compliance. I also hope that you might be able to look at the tales surrounding the King Arthur myth for your own inspiration.