Background: DOJ compliance framework

The Department of Justice (DOJ) Foreign Corrupt Practices Act (FCPA) Corporate Enforcement Policy^[2] and the FCPA Evaluation of Corporate Compliance Programs^[3] make clear that inquiry into the effectiveness of a company’s compliance program guides all aspects of the government’s enforcement of FCPA violations. These aspects include its decision to investigate, criminally prosecute, and determine the criminal fines, disgorgement, and civil money penalties under the Federal Sentencing Guidelines. The FCPA Corporate Enforcement Policy was issued in November 2017 and updated in March 2019. The 2017 policy included an explicit presumption that DOJ would resolve a company’s FCPA case through declination when the company satisfied the standards of voluntary self-disclosure, full cooperation, and timely and appropriate remediation.

Some trends have emerged that are the result of the 2017 FCPA Corporate Enforcement Policy and Evaluation of Corporate Compliance Programs and their recent 2019 updates:

• The adoption of a risk-based approach is used to assess a compliance program’s effectiveness.

• Red flags identified in audit findings, the due diligence process, and other internal reviews are expected to be timely remediated. Failure to do so could potentially affect the determination whether corporate disclosures were timely and FCPA allegations of misconduct were adequately addressed.

FCPA prosecutions resulting from third-party management have expanded beyond consultants and sales representatives to greater enforcement relating to the risks associated with distributors, dealers, subcontractors, and resellers.

In both the 2017 and 2019 Evaluation of Corporate Compliance Programs, the DOJ identified third-party transactions as posing a high risk for FCPA misconduct. The 2017 and 2019 updated guidance defines three key risk areas where misconduct is likely to occur: (1) documentation of payment terms and services to be performed; (2) compensation and incentive structures; and (3) due diligence performed to identify red flags in the selection of third-party agents and remediation of compliance issues regarding those third-party relationships.

Corporations are expected to establish sufficient internal controls to mitigate those risks. A requirement that a parent corporation implement sufficient robust controls, as determined by DOJ and the SEC on a case-by-case basis, has become the new standard for measuring compliance with the FCPA accounting provisions. This diverges from the statute’s original requirement of reasonableness in the design of controls.^[4]

Internal accounting controls are defined in the statute as a system to provide reasonable assurance that transactions are authorized and recorded in accordance with generally accepted accounting principles;^[5] however the DOJ and the SEC increasingly have applied a shifting and higher standard in their settlements of enforcement actions, creating uncertainty as to the requirements for an effective compliance program, despite criteria set out in the DOJ’s Evaluation of Corporate Compliance Programs.

Knowledge by the parent corporation of the inadequacy of accounting controls is not a requirement for liability under the FCPA accounting provisions; violations of the accounting provisions are subject to strict liability. However, the parent’s knowing circumvention^[6] or failure to implement internal accounting controls^[7] can give rise to criminal liability.

Theories for civil enforcement actions have extended to cover claims that parent corporations failed to devise and implement controls robust enough to prevent or detect misconduct, a standard hard to define given the limited judicial precedent and the failure of the statute to mandate any particular kind of internal controls system.^[8]

Also, there is a trend for the SEC to require disgorgement by parent corporations with no defined nexus between the profits received and the alleged misconduct, and no explanation as to how the penalty was calculated.^[9]

The DOJ, in assessing the design and effectiveness of a compliance program, evaluates corporate monitoring by the parent corporation of third-party arrangements, including the continuous updating of third-party due diligence, training of local managers on compliance risks, and auditing of third-party books and records for suspicious payment activity. As part of their internal accounting and books and records controls analysis, the DOJ and SEC focus on the integrity of financial and operational controls implemented by the parent corporation, including the maintenance of standardized global policies and procedures regarding third-party discounts and the benchmarking of discounts against industry standards. Other accounting internal controls include the presence of accounts payable procedures to verify that expenses are within stated contract terms; payments are supported by detail and receipts; and that payment is authorized. The absence or breakdown of controls affected the resolution of FCPA enforcement actions between 2017 and 2019. Recent enforcement actions have been directed at third-party transactions where excessive discounts, false credit notes, inflated invoices, or sham transactions were used to conceal improper payments to foreign officials.