The most frequently-given reason for not communicating the significance of the UK Act to employees was that it was ‘not relevant’ to the company’s business - even though 90% of companies said that they do business overseas.
There is an even greater lack of awareness of the corresponding US legislation. Under the US Foreign Corrupt Practices Act (FCPA), the US authorities can prosecute US companies and foreign companies with a US footprint for corrupt practices involving public officials abroad. But almost half (46%) of respondents who conduct business in the US either wrongly believe they are not subject to the FCPA or do not know whether they are subject to it.
In the US, the Department of Justice and the Securities and Exchange Commission have been active in prosecuting companies under the FCPA, for conduct occurring both within and outside the US including on foreign businesses with a US footprint. Therefore, the fact that nearly half of respondents whose companies conduct business in the US believe they are not subject to the FCPA, or do not know if they are subject to it, is worrying. In addition, 56% of respondents who said they are subject to the FCPA did not have, or did not know whether they had, an FCPA compliance programme.
A comprehensive understanding of the provisions of the US FCPA, the UK 2001 Act and other anti-bribery and corruption rules and regulations is critical to any multinational enterprise. In order to prevent, detect and respond to bribery and corruption issues, an effective global compliance programme should be implemented.
Each company needs to consider their specific risk factors and relevant business processes in order to implement an effective programme. There is no single answer as to what an effective compliance programme should look like; however, an effective programme may include the following points.
Tone at the top
Establishing the appropriate tone at the top, including the assignment of one or more independent senior individuals charged with responsibility for compliance, is central to an effective compliance programme. Those charged with responsibility for anti-bribery and corruption compliance should be supported by a team of adequately trained, qualified and capable people who have the time and resources available to meet their anti-bribery and corruption responsibilities.
A global compliance policy
A company should have a clearly articulated global compliance programme which sets out the requirements of the UK, US and other anti-bribery and corruption legislation relevant to jurisdictions where the entity conducts business, along with the policies and procedures the company has adopted in order to comply with the legislation.
Training and certification
Regular training for employees, agents and third parties should be given to ensure they are aware of their responsibilities under the relevant anti-bribery and corruption legislation, and the activities for which they may be found liable. Employees, agents and third parties should also be required to sign an annual certification to demonstrate their understanding.
Integrity due diligence
In-depth, accurate and timely information can assist a company in making informed decisions regarding who they are doing business with and enables them to take necessary precautions for monitoring high-risk areas of their operations. Integrity due diligence involves the search, collection and analysis of information - from both public and confidential sources - on the background, ownership, business track record, reputation and integrity of entities or individuals.
‘Whistleblower’ hotlines
A reporting system for employees, agents and third parties to report suspected anti-bribery and corruption violations and other criminal conduct can be an important element of an effective compliance programme. A hotline enables anonymous reporting and can often be the first indication of a problem that needs to be addressed.
Monitoring for compliance and continuous feedback
A risk-based approach to monitoring for compliance should be adopted. This approach should target activity towards those areas that are considered most at risk for the entity; for example high-risk jurisdictions or business areas in which controls are considered to be weak, or where previous questionable conduct has occurred.
An annual risk assessment should be completed to ensure changes in the nature and size of business operations are taken into account. Monitoring for compliance in conjunction with a risk-based approach may include in-country visits to conduct on-site audits and to review systems and controls. This type of regular testing can help to ensure that issues are identified when they are ‘isolated incidents’ and prevent weaknesses from evolving into ‘systemic problems’.
Response programme
To be effective against the threat of fraud, corruption and misconduct, organisations should have a robust cross-border investigations methodology which will enable them to respond efficiently and effectively to violations.
Potential consequences for non-compliance
Penalties for non-compliance can be severe. An internal investigation is likely to be costly and may lead to in-depth scrutiny of other transactions, as well as creating a significant diversion of management time and attention in order to respond to regulatory requests.
In the US, fines and penalties are rising steadily into the tens of millions of dollars and can include the potential disgorgement of profits from illicitly gained contracts. The fines handed down are often compounded by negative press coverage, the loss of investor confidence, criminal convictions, deferred and non-prosecution agreements and the possible risk of debarment from contracting with government and other entities.
In 2007 the US regulators brought some 38 actions against companies and individuals for violations of the US FCPA. In addition, bribery and corruption investigations continue in a variety of jurisdictions by law enforcement organisations around the globe.
Although it is not publicly known precisely how many investigations are being undertaken by any particular regulatory agency, at a recent anti-corruption conference it was stated that there may be as many as 100 active investigations underway by US authorities. In addition to this, there are rumoured to be at least a dozen investigations underway in the UK by law enforcement agencies.
Prosecutors are also talking to each other on a more frequent basis. In addition to the formal procedures in place to assist in multi-jurisdictional investigations, informal periodic meetings have begun to take place. These meetings allow prosecutors to share information and effective strategies for taking action against those accused of violating the rules.
With increased activity by both the US and UK regulators, failure to take action now could result in companies being caught up in expensive investigations resulting in heavy fines and penalties, and having to handle the associated negative publicity and a loss of investor confidence. The costs associated with an investigation in the future are likely to far outweigh the cost of implementing an effective anti-bribery and compliance programme today.
Jennifer Hammond is a director at KPMG Forensic in London.
